Providers, patients, and administrators use the same sign-in.
New SSO accounts start with patient access until an administrator assigns a clinical role.
Records are stored with row-level access control: providers see their clinic's patients, patients see only their own record.