Yes. A SuperAdmin can impersonate any customer by adding ?logwith=<userId> to a /admin/users URL — there is no "Login As" button anywhere in the current admin UI, it's a manual query-string parameter SuperAdmins type in. On a successful impersonation, the system writes a successful login entry to the HIPAA/security activity log under the impersonated customer's user ID (indistinguishable in the log from a normal login by that customer), then logs the SuperAdmin in as that user and redirects to the customer-facing profile page.