> ## Documentation Index
> Fetch the complete documentation index at: https://hmis-docs.derrickmugabwa.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Initial hospital configuration

> Secure the first account and configure the organization, users, clinical master data, billing, and go-live ownership.

Complete initial configuration in staging first, record the approved values, then repeat the controlled configuration in production. Do not enter real patient records during setup validation.

## Secure the first administrator

<Steps>
  <Step title="Sign in to the administration panel">
    Open `https://{{HMIS_DOMAIN}}/admin` with the named account created during the first deployment.
  </Step>

  <Step title="Replace the temporary password">
    Use a unique password stored in the hospital-approved password manager. Do not share the account between operators.
  </Step>

  <Step title="Enable multi-factor protection">
    Enroll two-factor authentication, store recovery codes in the approved vault, and register a passkey only from a managed device. Verify `APP_URL` matches the production origin before testing passkeys.
  </Step>

  <Step title="Verify recovery mail">
    Confirm password reset and email verification messages are delivered from the approved sender. Review mail logs without exposing reset links.
  </Step>
</Steps>

<Info>
  Public registration is disabled. Administrators must create and assign every staff user through the controlled administration workflow.
</Info>

## Organization and care locations

The foundational seeder creates placeholder organization data. Replace and verify it before creating operational records.

* Legal and display organization names
* Facility code, official contacts, address, and timezone
* Branch codes, names, contacts, and active state
* Departments and whether each is clinical
* Clinics, supported care settings, and owning department
* Wards, rooms, beds, bed types, and bed rates when inpatient care is enabled
* Stock locations, pharmacies, central stores, and user-location assignments

Use stable codes that match approved hospital and integration identifiers. Do not repurpose a code after transactions reference it.

## Roles and users

<Steps>
  <Step title="Review role permissions">
    Confirm the seeded roles and permissions match the hospital's segregation-of-duties policy. Give `super_admin` only to named platform administrators.
  </Step>

  <Step title="Create staff users">
    Use real work identities. Assign the correct user type, role, branch, department, clinic, ward, and stock-location context.
  </Step>

  <Step title="Verify access with test users">
    Test receptionist, cashier, clinician, nurse, laboratory, radiology, pharmacy, store, and administrator workflows as applicable. Confirm each user can see required functions and cannot access restricted functions.
  </Step>

  <Step title="Set account lifecycle ownership">
    Assign responsibility for onboarding, role changes, password reset, MFA recovery, periodic access review, and immediate offboarding.
  </Step>
</Steps>

## Billing and catalogue

* Review payer types and payers; remove or deactivate placeholders that are not approved.
* Import or review the service catalogue, sections, service codes, prices, diagnostic parameters, specimen requirements, and account-head assignments.
* Configure clinic consultation pricing, bed rates, pharmacy catalogue, medication schedules, stock opening balances, and billing rules required by the installation.
* Reconcile a synthetic outpatient and inpatient bill from service order to payment and final bill.

<Warning>
  Do not bulk-import unreviewed production catalogues. Validate duplicates, codes, prices, units, mappings, and effective dates in staging and retain the import report.
</Warning>

## Clinical configuration

* Verify patient identifier rules and uniqueness behavior.
* Configure appointment schedules and clinic capacity.
* Review clinical forms, diagnostic services, specimen types, units, reference ranges, and reporting authorization.
* Configure inpatient wards, nursing assignments, admissions, and bed workflows where used.
* Confirm the midnight outpatient-visit closure rule matches the hospital's operational policy.

## Platform settings

* Set navigation order and dashboard widget visibility for each role.
* Configure navigation badges only for approved operational indicators.
* Verify file upload size limits and storage capacity.
* Confirm the production timezone, locale, mail sender, logging level, and session policy.
* Create integration API tokens only after the corresponding integration is approved.

## Initial acceptance scenario

Using synthetic data, complete:

1. User sign-in, email verification, branch selection, and 2FA recovery.
2. Patient registration and branch/clinic assignment.
3. Appointment or walk-in visit creation.
4. Consultation, diagnosis, clinical notes, and orders.
5. Billing, payer allocation, payment, and final bill.
6. Pharmacy or inventory movement when enabled.
7. Admission, bed assignment, inpatient care, and discharge when enabled.
8. Laboratory and radiology cycles when enabled.
9. Backup creation and isolated restore verification.

Retain sanitized evidence and obtain operational, clinical, finance, security, and IT approval before following the [go-live checklist](/platform/operations/go-live-checklist).