Help
Everything a practice needs in its first week, and the answers to the two questions that come up before anything else.
What is my practice’s address?
Your practice’s name, then .forgedmed.ai — like northlake.forgedmed.ai. It is in your invitation email. Signing in at forgedmed.ai instead is the most common first-week problem; if you land there, the sign-in link will ask which practice you belong to and send you on.
What is my password?
There isn’t one. You sign in with your work account and confirm with your fingerprint, face, or device PIN. Nothing to remember, nothing to write down, and nothing anybody can talk you into reading aloud over the phone.
Topics
The things worth knowing once
Each of these takes a minute and saves a support call.
Signing in for the first time
Three steps, and the third one is the only part that is new.
Go to your practice’s address
Not forgedmed.ai — your practice’s own address, from your invitation email. Bookmark it.
Sign in the way you already do at work
With your Microsoft or Google account if your practice uses one, or with the credentials in your invitation. Your password is never handled by Forged Med.
Set up a passkey when your device asks
Your fingerprint, your face, or the PIN you already use to unlock the device. That is the whole setup, and it replaces every code and every password from here on.
Why a passkey instead of a code
A code can be repeated to somebody on the phone. Every week, somebody is called by a person claiming to be from IT, asked to read out the code on their screen, and does.
It cannot be read out
A passkey never leaves your device. There is nothing to repeat, so there is nothing to be talked out of.
It only works at your practice
It is tied to your practice’s exact address. On a page pretending to be your sign-in screen — even a perfect copy — your device simply will not offer it.
Set one up on each device you use
Your phone as well as your work laptop. Then losing one stops being a problem.
“Confirm it’s you” during the day
Some actions ask for your passkey again — signing a note, exporting records, removing a device.
It has not forgotten who you are
These are the actions somebody would want if they sat down at your unlocked screen while you were with a patient. Your fingerprint is the thing they do not have.
Five minutes, then it asks again
Confirm once and a run of signing does not become a run of prompts.
Adding and removing staff
Your staff list is your access list. Somebody suspended from it cannot sign in again, even if their work email still works. Invite, change roles, suspend and restore on Administration → Staff; inviting and changing roles ask you to confirm it is you, suspending does not.
Give the narrowest role that does the job
You can always widen it. Starting narrow means a mistake shows up as “I can’t see this” rather than as a chart somebody should not have opened.
Remove people the day they leave
Not at the end of the month. This is the single most important thing to keep current.
Test with a real role, not your own
You see everything, so your own sign-in proves less than you think. Have a front-office person try to open a clinical note — they should not be able to.
What Forged Med support can see
Nothing, until somebody at your practice lets them in — for a stated reason, with a clock running, and with every action written into your own audit trail.
They ask for the least they need
Most support questions never touch a patient record. A request names what it wants in plain language, and you read that before deciding.
Patient records is its own decision, every time
Never included by default. Fifteen minutes instead of an hour. Never available through the emergency route. Flagged in red so you cannot approve it by accident.
You can watch and you can stop it
Your security console shows who is asking to come in, who is in now and what they can reach, and lets you end a session with one tap — immediately, with no reason and no fingerprint asked. What they did is recorded and kept, but the record of each visit and anything they revealed is not yet on a screen; your practice asks us for it.
Your audit trail
Every sign-in, every record opened, every note signed, every export — yours to read, and impossible to quietly edit.
It protects your staff too
If somebody uses another person’s account, the record shows it. That cuts both ways, and it is worth telling your team so they hear it from you first.
Forged Med’s own activity is in it
Tagged with the reason you approved, not as ordinary-looking activity by a platform account.
It is evidence, not a log file
Each entry is cryptographically chained to the one before it, so an entry cannot be removed or altered after the fact without the chain failing to verify.
Proving your record has not been changed
For the day somebody outside your practice — a lawyer, an auditor, an inspector — needs more than your word for it.
Keep your receipts somewhere we cannot reach
We periodically publish a short signed receipt covering your record’s history. Save each one to your own email or storage. That single habit is the difference between real evidence and a comfortable claim: a receipt held only by us proves nothing, because we could reissue it.
Then you can demand proof, and we cannot fake it
Hand back a receipt you saved months ago and ask whether the log still contains everything it covered. If anything had been removed or rewritten, no such proof exists — not for us, not for anybody who took over our systems.
One report, and instructions inside it
The record integrity report is a single document with every signature in the period, the proof each is in the log, the public key, and how to check all of it. It is generated and downloaded from the Record integrity tab of the security console. It deliberately contains no clinical content: hand it over alongside the records, not instead of them.
It survives us
Signatures verify against your clinicians’ own keys. Your exported records plus your saved receipts stay checkable by anyone, with no cooperation from Forged Med, in ten years.
Prescribing a controlled substance
The DEA is unusually specific about what the software has to do here. Most of what feels like extra friction is that rule rather than our preference.
Your signing key, every single time
Not the passkey you sign in with. A controlled substance is signed with a separately enrolled, device-bound signing key of a model your practice has approved — a passkey synced between your devices is refused, and until your practice approves a model no signing key can be enrolled. Each prescription is signed separately at the moment you sign it, so somebody at your unlocked workstation can write a draft and nothing more.
What you sign is what you saw
Your signing key signs a fingerprint of the exact prescription on your screen, not a random code. If anything about it changed between the review and your fingerprint, the signature fails — so nobody can alter a prescription on the way out, and nobody has to take our word for that.
Signed means final
A signed prescription cannot be edited by you, by your practice owner, or by us. Wrong quantity? Void it and write a new one. The original stays in the record, marked void, which is what a pharmacist needs to see.
Two people decide who may prescribe
One proposes, and a second — who must be a practitioner with their own DEA registration — approves with their own passkey. The same person cannot do both halves, so nobody can quietly grant themselves Schedule II authority. Taking it away is one person and takes seconds.
Your monthly log is yours to pull
Every controlled substance you signed in a month, available to you within seven days of it ending, without asking anybody. Read it — it is the best way to notice a prescription written under your DEA number that you do not remember writing.
If something is wrong
Before you call
Six things that cover almost everything, and what to have ready if none of them is it.
| What you see | Usually | What to do |
|---|---|---|
| “Your account isn’t set up for this practice” | Your practice has not added you, or somebody removed you. | Your practice administrator can fix this in a minute. Forged Med cannot add you to a practice. |
| Your passkey is not offered | Wrong device, wrong practice, or you are not on your practice’s address. | Check the address bar first. If you work at two practices, each has its own passkey. |
| You lost the device with your passkey | The old passkey is still valid until it is removed. | Tell your practice administrator the same day. They remove it and you enrol on the new device. |
| The page will not load, or just spins | Not something you can fix from your end. | Tell your practice administrator — and say whether anyone else has the same problem. “Just me” and “all of us” lead in completely different directions. |
| A controlled substance will not sign | One of the DEA preconditions is not met — the screen names which, and cites the rule. | Most of them (identity proofing, signing authority, an expired registration) are for your practice administrator, not for you. “Review it again” means something was edited after you reviewed it. |
| Being asked to confirm constantly | Something is ending your session early — often a browser clearing site data. | More often than every five minutes is worth reporting. |
Still stuck?
Your practice administrator can resolve most account problems faster than we can — they hold the staff list, and we do not. Contact us for anything else. We will not confirm or deny which practices use Forged Med, so please have your practice administrator make the introduction.