Office Ally security administrator account user permissions screen

How Do I Let My Biller See Billing but Not Change It in Office Ally?

October 08, 2026•4 min read

Short answer: Log into the security administrator account, which is your username followed by underscore SA. Go to the admin section, then Manage Users. Click the user's name, choose edit, click Show Advanced Settings and then Next to reach the service settings, including the Practice Mate user settings. Set the user type to biller rather than security administrator first, then check the accounting box and set read only so the person can see the billing without being able to change anything.

Unchecked and read only are not the same setting

Your biller needs to see the billing. That does not mean your biller needs to be able to change the billing. Those are two different levels of access, and in Office Ally the difference is a checkbox and a role, sitting in an account most practice owners have never opened.

The part people get wrong is the accounting box. An unchecked box does not mean limited access, it means no access at all. In the account shown in this lesson, one staff member cannot get into accounting because the box is not checked. A checked box with read only is the middle ground most practices actually want for an outside biller: they can see the billing, they cannot act on it.

The steps

  1. Log into the security administrator account. Your login is your username followed by underscore SA.

  2. Go to the admin section.

  3. Go to Manage Users.

  4. Find the user in the list, for example your biller.

  5. To block access outright, disable them. A disabled user cannot get in at all. Disable rather than delete, because deleting removes everything that user ever did in the account.

  6. To adjust what they can do instead, click on the user's name.

  7. Choose edit. Their information appears.

  8. Click Show Advanced Settings.

  9. Click Next to move through the settings.

  10. The service settings appear, including the Practice Mate user settings, where read and write access is controlled.

  11. Check what role the person is assigned. A security administrator holds administrative rights, which is why permission settings behave differently for that user type.

  12. If the person is a biller, set their user type to biller rather than security administrator. Do this before adjusting individual permissions.

  13. Work through the areas one at a time, for example patient visits, and set read only where you want the person to see but not change.

  14. For accounting, check the box and set read only if you want an outside biller to have visibility without risk.

  15. Continue through the remaining screens with Next.

Why the role has to come first

The user type governs what the permissions underneath it can restrict. If someone is set as a security administrator, they carry administrative rights, and the careful read only settings you place below that do not constrain them the way you expect. Set the role, then set the permissions. Doing it in the other order means you spend time on settings that the role quietly overrides.

The mistake this prevents

Leaving an outside biller set as a security administrator. This is the setting that quietly undoes all the others. The practice believes it has limited that person to viewing, and in fact they can adjust access, reset credentials, and reach the settings that govern payments. Nobody discovers this in normal operation, because normal operation never tests the boundary. It surfaces during a dispute, a transition, or an audit. If the person is a biller, set the user type to biller, then set permissions.

The second mistake is confusing an unchecked box with read only access. They look similar on the screen and produce opposite outcomes. An unchecked accounting box locks the person out of accounting entirely, so a biller configured that way simply cannot do the job and will come back saying the software is broken. Practices then swing to the other extreme and leave accounting fully open. Read each area deliberately and confirm which of the three states you are in: no access, read only, or full access.

More Office Ally training

Marie Matteson, MS, is a healthcare consultant, educator, and Office Ally specialist with more than 30 years in healthcare, emergency medicine, and practice management. Helping you understand what's really going on.

All patient information referenced here has been redacted. This content is educational and is not billing, legal, or coding advice. Always follow your payer contracts, your practice policies, and current coding guidelines. Not affiliated with or endorsed by Office Ally.

© Marie Matteson. All rights reserved.

Marie T Matteson MS

Marie T Matteson MS

Marie Matteson, a seasoned medical intuitive healer and expert, brings over 30 years of experience in helping people navigate life's challenges.

LinkedIn logo icon
Instagram logo icon
Youtube logo icon
Back to Blog