Restricting Access to Reports > Clients

Day-to-Day Users
#1

cavernosum wrote on Sunday, March 29, 2015:

Hi

I am wondering if there is a way that we can restrict access to the reporting feature of v 4.1.2?

At the moment the user (physician) can easily print off access ‘Reports’ on the L side menu and obtain a listing of all the patients of the clinic with names and contact details.

This poses a problem for our patient management and privacy issues for our patients.

I would like to simply omit the “Reports” menu altogether for physician access.

How can I accomplish this?

Thank you.

#2

fsgl wrote on Sunday, March 29, 2015:

Try this.

#3

fsgl wrote on Sunday, March 29, 2015:

Primary document, rep, will work in left.php, but no corresponding ACO or groups of ACO’s.

Closest ACO is Financial Reporting, all; but there remains Clients, Clinics, Visits, etc.

Need more coffee.

#4

fsgl wrote on Sunday, March 29, 2015:

This is going to be a toughie.

Can’t work from the bottom up because Front Office has Reports, too.

The ACO('s) is/are probably hiding in Administration/Superuser.

No likely suspect at the moment.

Will be a big bummer if it does not exist.

#5

fsgl wrote on Monday, March 30, 2015:

Public document, rep, does work with ACO, Accounting, Financial Reporting for all of the Reports giving a “Not Authorized!” denial & white screen.

Problem is that it is a blunt instrument, denying access to both Front Office & Administrator.

#6

banaitv wrote on Monday, March 30, 2015:

Means one doc gets upset when he see his patient up for consultation with
another or start calling patients of another doctor promising better
treatment. Third possibility administration want to shift patient from one
doc to another. All ridiculous! Do you really want to do this?
On 30-Mar-2015 5:55 am, “fsgl” fsgl@users.sf.net wrote:

Public document, rep, does work with ACO, Accounting, Financial Reporting
for all of the Reports giving a “Not Authorized!” denial & white screen.

Problem is that it is a blunt instrument, denying access to both Front
Office & Administrator.

Restricting Access to Reports > Clients
https://sourceforge.net/p/openemr/discussion/202504/thread/80ae203d/?limit=25#b528

Sent from sourceforge.net because you indicated interest in
https://sourceforge.net/p/openemr/discussion/202504/

To unsubscribe from further messages, please visit
https://sourceforge.net/auth/subscriptions/

#7

bradymiller wrote on Monday, March 30, 2015:

Hi,

The general strategy of acl is to control access to stuff(ie. patient info, financial info. etc.). To control access to the reports is a bit difficult under this strategy since the reports are for different things(and a single report may even have different types of data in it). We could stray a bit from this strategy (like is done for access to administration->database) and consider making a separate aco section for Reports with the main ACO in the section(something like reports_a) to control whether the reports is shown on left_nav (and also allows report to show on the report script) and can even make more granular ones for the types of reports etc(like reports_clinical, reports_financial, etc.). If any developer wants to attack this, it wouldn’t be too tough a project, and I think would be a useful addition for further ACL granularity.

-brady
OpenEMR

#8

blankev wrote on Monday, March 30, 2015:

Hiding it in the left menu, could solve part of the problem. Leaving only the Super user and Top level trusted users to allow this part of the menu?

Something similar to sign procedures, something that can only be done by Doctors. Not even the Administator can sign the Laboratory inputs.

#9

fsgl wrote on Monday, March 30, 2015:

The ACO Financial Reporting works well for Reports, Financial because it is completely missing for Front Office.

The OP will need to create new ACO’s: Clients Reporting, Clinic Reporting, etc. or one for Reports, globally, as suggested by Brady. This is the closest documentation I’ve been able to find on creating a new ACO. I have no idea how it’s done; hence my comment, big bummer.

There should not be any HIPAA concerns within the same practice provided that each employee signs a Confidentiality Agreement. It sounds more like a competition problem.

If the owner of the practice does not have a non-competition agreement from the physicians in question; hiding Reports is merely a stalling technique, not a deterrent.

These agreements have restrictions in the way they are worded. The location of the new practice must be outside a radius of a specific number of miles & only for a finite period of time, such as 2 years.

Like a marriage, it’s the luck of the draw. Difficult to know in advance who will stay & be happy in a practice & who will seek greener pastures.

#10

fsgl wrote on Monday, March 30, 2015:

Just looked at acl_setup.php file, only 1 out of 3 files to contend with.

If Brady does not have the time, Jason will need to be a programmer.

Otherwise this is not going to get done.

#11

fsgl wrote on Tuesday, March 31, 2015:

On second thought, the 3 files have enough hints such that adding new ACO’s may not be an insurmountable task.

If unsuccessful, it can be safely assumed that this poster disappeared without a trace in Github.

#12

cavernosum wrote on Thursday, April 02, 2015:

Thank you for all your responses. I was expecting notifications to tell me there were replies but didn’t realise it doesn’t do that.

Unfortunately I am no programmer. Thank you for your suggestions, I will have a play around and see if I can accomplish anything.

We have anti competition clauses but mostly non enforceable because you are going against the livelihood of the practitoner in question. Whilst stopping the reporting is only stalling, it doesn’t help when the reporting is so easily accessible. I was surprised when a practitioner told me that she printed a list of her clients and also able to print the other 4 independent physicians’ client data without the help of the front desk.

Again thank you for your help. If anyone is interested in doing some customisation work for this problem, please PM me for discussion.

#13

blankev wrote on Thursday, April 02, 2015:

Opening four OpenEMR facilities four all practitioners, might solve a part of your problem. But that means you might have to grand access for the other doctors on a lower level (a non-reporting level). It is possible to open all four Facilities on four browser tabs, or four different browser instances.

#14

fsgl wrote on Thursday, April 02, 2015:

Tried mightily to add new ACO’s for Clients, Clinics, Visits, Procedures, Insurance, Blank Forms & Services in acl_setup.php & acl_upgrade.php. Nothing transferred to ACL GUI.

Used ACL Administration, Advanced to create above, but feckless when moved to the Inactive column. Creating a big ACO for Reports failed as well.

Nasty surprise in ACL Administration, Advanced. Any attempt to delete the new ACO gave “ACL Administration Not Authorized!” with subsequent loss of entire group under Administration in Left Navigation. Best to backup or create system image before working in this touchy part of ACL.

Cannot use the public document, rep, in Disallowed section of left_nav.php because no one will have access to a majority of Reports.

We gave it the old college try.

#15

fsgl wrote on Saturday, April 04, 2015:

In lieu of decorated eggs & Peeps, the Easter Bunny thought you might prefer this instead.

To hide Reports:

  1. Experiment on test copy first. Create a system image before attempt on production copy.
  2. Create new section, Reports & individual ACO’s in ACL Administration, (Advanced) link. Assign reporting ACO’s to Administrators & any other ARO.
  3. Do not delete any ACO’s. That will cause Administration in Menu to disappear completely, hence the need for a system image/backup.
  4. Check that Globals, CDR tab, has “Enable CQM Reporting” & “Enable AMC Reporting” selected.
  5. Insert in openemr/interface/main/left_nav.php lines 189 -193:
    $disallowed[‘rep’] = !($GLOBALS[‘enable cqm reporting’] || $GLOBALS[‘enable amc reporting’] ||
    acl_check(‘accounting’, ‘financial_reporting_m’) || acl_check(‘accounting’, ‘financial_reporting_a’) ||
    acl_check(‘reports’, ‘clients’) || acl_check(‘reports’, ‘clinic’) || acl_check(‘reports’, ‘visits’) ||
    cl_check(‘reports’, ‘procedures’) || acl_check(‘reports’, ‘insurance’) || acl_check(‘reports’, ‘blank_forms’) || acl_check(‘reports’, ‘services’));
  6. Insert the following into each .php files for Blank Forms; Demographics, Superbill/Fee Sheet, Referral:
    require_once("$srcdir/acl.inc");
    if (!acl_check(‘reports’,‘blank’)) die(“Not authorized!”);

See Wiki article for more detailed instructions & screenshots.

I’ve yet to figure out how to have a continous line of code with the slider below it.

#16

bradymiller wrote on Sunday, April 05, 2015:

Awesome documentation,
I think better after adding the ACOs, to then go back to the Administration->ACL gui and add the ACOs to the Administration->write group (this is easier and avoids adding the Administration->"" group missing a return value). Also note this part of doc won’t be relevant anymore after it gets into the codebase, although still will be a nice example for folks to add aco and acl_checks in the codebase.
-brady
OpenEMR

#17

fsgl wrote on Sunday, April 05, 2015:

Hi Brady,

We have about 60% of Left Navigation done. Database & Fees should be not be biggies. Just Messages & Miscellaneous to crack.

Would be very good if all the snippets enter the codebase in the next version. I don’t mind the article becoming obsolete in the process.

Really be nice for users to move ACO’s to & fro without getting their hands dirty. At that time you can pretty things up. It will also save them from toasting Administration from Left Navigation when they try to delete an ACO.

#18

kodusote wrote on Sunday, April 05, 2015:

Hi fsgl,

Great thanks to those who wrote the wiki. It is a very good guide for those requiring more granular control. The ACL manual bundled with OpenEMR is not for the uninitiated.

It is also possible with access control of the navigational menu to limit the menu item displayed. That way the user does not see reports he/she is not authorised to view or edit.

Much appreciated.

Kayode

#19

fsgl wrote on Sunday, April 05, 2015:

Hi Kayode,

It was our pleasure.

Hope to get the balance of left_nav done today & documented.

Still don’t understand “what’s grep got to do with it”, so had to use the Disallowed section instead.

Thanks, Rod!

#20

kodusote wrote on Monday, April 06, 2015:

Hi fsgl,

“grep” is a Linux command for searching matching patterns such as a string of text in a file. For example, with it you can search for all the occurrences of “acl_check(‘reports’, ‘blank’)” in the left_nav.php file.

Kayode