I am wondering if there is a way that we can restrict access to the reporting feature of v 4.1.2?
At the moment the user (physician) can easily print off access 'Reports' on the L side menu and obtain a listing of all the patients of the clinic with names and contact details.
This poses a problem for our patient management and privacy issues for our patients.
I would like to simply omit the "Reports" menu altogether for physician access.
How can I accomplish this?
Thank you.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
We have created a block feature that can be controlled by existing ACLs code and determined only by the admin user. That way only certain providers can access certain patients even through the reports and printing feature. Please let me know if you are interested in checking this feature out and email to info@acehealthsolutions.com so we can setup a time to demo it to you.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Means one doc gets upset when he see his patient up for consultation with
another or start calling patients of another doctor promising better
treatment. Third possibility administration want to shift patient from one
doc to another. All ridiculous! Do you really want to do this?
On 30-Mar-2015 5:55 am, "fsgl" fsgl@users.sf.net wrote:
Public document, rep, does work with ACO, Accounting, Financial Reporting
for all of the Reports giving a "Not Authorized!" denial & white screen.
Problem is that it is a blunt instrument, denying access to both Front
Office & Administrator.
The general strategy of acl is to control access to stuff(ie. patient info, financial info. etc.). To control access to the reports is a bit difficult under this strategy since the reports are for different things(and a single report may even have different types of data in it). We could stray a bit from this strategy (like is done for access to administration->database) and consider making a separate aco section for Reports with the main ACO in the section(something like reports_a) to control whether the reports is shown on left_nav (and also allows report to show on the report script) and can even make more granular ones for the types of reports etc(like reports_clinical, reports_financial, etc.). If any developer wants to attack this, it wouldn't be too tough a project, and I think would be a useful addition for further ACL granularity.
The ACO Financial Reporting works well for Reports, Financial because it is completely missing for Front Office.
The OP will need to create new ACO's: Clients Reporting, Clinic Reporting, etc. or one for Reports, globally, as suggested by Brady. This is the closest documentation I've been able to find on creating a new ACO. I have no idea how it's done; hence my comment, big bummer.
There should not be any HIPAA concerns within the same practice provided that each employee signs a Confidentiality Agreement. It sounds more like a competition problem.
If the owner of the practice does not have a non-competition agreement from the physicians in question; hiding Reports is merely a stalling technique, not a deterrent.
These agreements have restrictions in the way they are worded. The location of the new practice must be outside a radius of a specific number of miles & only for a finite period of time, such as 2 years.
Like a marriage, it's the luck of the draw. Difficult to know in advance who will stay & be happy in a practice & who will seek greener pastures.
Last edit: fsgl 2015-04-02
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Thank you for all your responses. I was expecting notifications to tell me there were replies but didn't realise it doesn't do that.
Unfortunately I am no programmer. Thank you for your suggestions, I will have a play around and see if I can accomplish anything.
We have anti competition clauses but mostly non enforceable because you are going against the livelihood of the practitoner in question. Whilst stopping the reporting is only stalling, it doesn't help when the reporting is so easily accessible. I was surprised when a practitioner told me that she printed a list of her clients and also able to print the other 4 independent physicians' client data without the help of the front desk.
Again thank you for your help. If anyone is interested in doing some customisation work for this problem, please PM me for discussion.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Opening four OpenEMR facilities four all practitioners, might solve a part of your problem. But that means you might have to grand access for the other doctors on a lower level (a non-reporting level). It is possible to open all four Facilities on four browser tabs, or four different browser instances.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Tried mightily to add new ACO's for Clients, Clinics, Visits, Procedures, Insurance, Blank Forms & Services in acl_setup.php & acl_upgrade.php. Nothing transferred to ACL GUI.
Used ACL Administration, Advanced to create above, but feckless when moved to the Inactive column. Creating a big ACO for Reports failed as well.
Nasty surprise in ACL Administration, Advanced. Any attempt to delete the new ACO gave "ACL Administration Not Authorized!" with subsequent loss of entire group under Administration in Left Navigation. Best to backup or create system image before working in this touchy part of ACL.
Cannot use the public document, rep, in Disallowed section of left_nav.php because no one will have access to a majority of Reports.
We gave it the old college try.
Last edit: fsgl 2015-04-03
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Insert the following into each .php files for Blank Forms; Demographics, Superbill/Fee Sheet, Referral:
require_once("$srcdir/acl.inc");
if (!acl_check('reports','blank')) die("Not authorized!");
See Wiki article for more detailed instructions & screenshots.
I've yet to figure out how to have a continous line of code with the slider below it.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
most welcome, i've got the soup bubbling following your recipe with all of the access denied code added to the php files
i finally have to start thinking now that i'm trying to build the report aco here because we don't have the short descriptor for each of the reports in the primary docs array
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
in reply to your balk on this thread , a little time spent setting up a github account and then you'd be in comfortable country; the linux command line...
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Awesome documentation,
I think better after adding the ACOs, to then go back to the Administration->ACL gui and add the ACOs to the Administration->write group (this is easier and avoids adding the Administration->"" group missing a return value). Also note this part of doc won't be relevant anymore after it gets into the codebase, although still will be a nice example for folks to add aco and acl_checks in the codebase.
-brady OpenEMR
Last edit: Brady Miller 2015-04-05
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
We have about 60% of Left Navigation done. Database & Fees should be not be biggies. Just Messages & Miscellaneous to crack.
Would be very good if all the snippets enter the codebase in the next version. I don't mind the article becoming obsolete in the process.
Really be nice for users to move ACO's to & fro without getting their hands dirty. At that time you can pretty things up. It will also save them from toasting Administration from Left Navigation when they try to delete an ACO.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Hi
I am wondering if there is a way that we can restrict access to the reporting feature of v 4.1.2?
At the moment the user (physician) can easily print off access 'Reports' on the L side menu and obtain a listing of all the patients of the clinic with names and contact details.
This poses a problem for our patient management and privacy issues for our patients.
I would like to simply omit the "Reports" menu altogether for physician access.
How can I accomplish this?
Thank you.
Jason,
We have created a block feature that can be controlled by existing ACLs code and determined only by the admin user. That way only certain providers can access certain patients even through the reports and printing feature. Please let me know if you are interested in checking this feature out and email to info@acehealthsolutions.com so we can setup a time to demo it to you.
Try this.
Primary document, rep, will work in left.php, but no corresponding ACO or groups of ACO's.
Closest ACO is Financial Reporting, all; but there remains Clients, Clinics, Visits, etc.
Need more coffee.
This is going to be a toughie.
Can't work from the bottom up because Front Office has Reports, too.
The ACO('s) is/are probably hiding in Administration/Superuser.
No likely suspect at the moment.
Will be a big bummer if it does not exist.
Public document, rep, does work with ACO, Accounting, Financial Reporting for all of the Reports giving a "Not Authorized!" denial & white screen.
Problem is that it is a blunt instrument, denying access to both Front Office & Administrator.
Means one doc gets upset when he see his patient up for consultation with
another or start calling patients of another doctor promising better
treatment. Third possibility administration want to shift patient from one
doc to another. All ridiculous! Do you really want to do this?
On 30-Mar-2015 5:55 am, "fsgl" fsgl@users.sf.net wrote:
Hi,
The general strategy of acl is to control access to stuff(ie. patient info, financial info. etc.). To control access to the reports is a bit difficult under this strategy since the reports are for different things(and a single report may even have different types of data in it). We could stray a bit from this strategy (like is done for access to administration->database) and consider making a separate aco section for Reports with the main ACO in the section(something like reports_a) to control whether the reports is shown on left_nav (and also allows report to show on the report script) and can even make more granular ones for the types of reports etc(like reports_clinical, reports_financial, etc.). If any developer wants to attack this, it wouldn't be too tough a project, and I think would be a useful addition for further ACL granularity.
-brady
OpenEMR
Hiding it in the left menu, could solve part of the problem. Leaving only the Super user and Top level trusted users to allow this part of the menu?
Something similar to sign procedures, something that can only be done by Doctors. Not even the Administator can sign the Laboratory inputs.
The ACO Financial Reporting works well for Reports, Financial because it is completely missing for Front Office.
The OP will need to create new ACO's: Clients Reporting, Clinic Reporting, etc. or one for Reports, globally, as suggested by Brady. This is the closest documentation I've been able to find on creating a new ACO. I have no idea how it's done; hence my comment, big bummer.
There should not be any HIPAA concerns within the same practice provided that each employee signs a Confidentiality Agreement. It sounds more like a competition problem.
If the owner of the practice does not have a non-competition agreement from the physicians in question; hiding Reports is merely a stalling technique, not a deterrent.
These agreements have restrictions in the way they are worded. The location of the new practice must be outside a radius of a specific number of miles & only for a finite period of time, such as 2 years.
Like a marriage, it's the luck of the draw. Difficult to know in advance who will stay & be happy in a practice & who will seek greener pastures.
Last edit: fsgl 2015-04-02
Just looked at acl_setup.php file, only 1 out of 3 files to contend with.
If Brady does not have the time, Jason will need to be a programmer.
Otherwise this is not going to get done.
On second thought, the 3 files have enough hints such that adding new ACO's may not be an insurmountable task.
If unsuccessful, it can be safely assumed that this poster disappeared without a trace in Github.
Thank you for all your responses. I was expecting notifications to tell me there were replies but didn't realise it doesn't do that.
Unfortunately I am no programmer. Thank you for your suggestions, I will have a play around and see if I can accomplish anything.
We have anti competition clauses but mostly non enforceable because you are going against the livelihood of the practitoner in question. Whilst stopping the reporting is only stalling, it doesn't help when the reporting is so easily accessible. I was surprised when a practitioner told me that she printed a list of her clients and also able to print the other 4 independent physicians' client data without the help of the front desk.
Again thank you for your help. If anyone is interested in doing some customisation work for this problem, please PM me for discussion.
Opening four OpenEMR facilities four all practitioners, might solve a part of your problem. But that means you might have to grand access for the other doctors on a lower level (a non-reporting level). It is possible to open all four Facilities on four browser tabs, or four different browser instances.
Tried mightily to add new ACO's for Clients, Clinics, Visits, Procedures, Insurance, Blank Forms & Services in acl_setup.php & acl_upgrade.php. Nothing transferred to ACL GUI.
Used ACL Administration, Advanced to create above, but feckless when moved to the Inactive column. Creating a big ACO for Reports failed as well.
Nasty surprise in ACL Administration, Advanced. Any attempt to delete the new ACO gave "ACL Administration Not Authorized!" with subsequent loss of entire group under Administration in Left Navigation. Best to backup or create system image before working in this touchy part of ACL.
Cannot use the public document, rep, in Disallowed section of left_nav.php because no one will have access to a majority of Reports.
We gave it the old college try.
Last edit: fsgl 2015-04-03
In lieu of decorated eggs & Peeps, the Easter Bunny thought you might prefer this instead.
To hide Reports:
$disallowed['rep'] = !($GLOBALS['enable cqm reporting'] || $GLOBALS['enable amc reporting'] ||
acl_check('accounting', 'financial_reporting_m') || acl_check('accounting', 'financial_reporting_a') ||
acl_check('reports', 'clients') || acl_check('reports', 'clinic') || acl_check('reports', 'visits') ||
cl_check('reports', 'procedures') || acl_check('reports', 'insurance') || acl_check('reports', 'blank_forms') || acl_check('reports', 'services'));
require_once("$srcdir/acl.inc");
if (!acl_check('reports','blank')) die("Not authorized!");
See Wiki article for more detailed instructions & screenshots.
I've yet to figure out how to have a continous line of code with the slider below it.
just enclose it in pre tags
Last edit: Stephen Waite 2015-04-23
Precisely.
What are pre tags?
It may be in Formatting Help, but the light bulb has yet to come on.
http://www.w3schools.com/tags/tag_pre.asp
it may be browser specific because my long line up above isn't scrollable on chromium
Yippee!!!
Thought I was going dyslexic with Formatting Help, whew.
Thank you again, Dragon Slayer.
Hope that the Starter Project is going swimmingly.
Brady talked about doing only Reports, but if the whole kit & kaboodle are in the codebase, users will be so pleased.
most welcome, i've got the soup bubbling following your recipe with all of the access denied code added to the php files
i finally have to start thinking now that i'm trying to build the report aco here because we don't have the short descriptor for each of the reports in the primary docs array
Was wading about in acl_upgrade.php because of this with very little to show for it.
Hadn't the foggiest about acl_setup.php, so I pretended it didn't matter.
Keep up the good work.
in reply to your balk on this thread , a little time spent setting up a github account and then you'd be in comfortable country; the linux command line...
Awesome documentation,
I think better after adding the ACOs, to then go back to the Administration->ACL gui and add the ACOs to the Administration->write group (this is easier and avoids adding the Administration->"" group missing a return value). Also note this part of doc won't be relevant anymore after it gets into the codebase, although still will be a nice example for folks to add aco and acl_checks in the codebase.
-brady
OpenEMR
Last edit: Brady Miller 2015-04-05
Hi Brady,
We have about 60% of Left Navigation done. Database & Fees should be not be biggies. Just Messages & Miscellaneous to crack.
Would be very good if all the snippets enter the codebase in the next version. I don't mind the article becoming obsolete in the process.
Really be nice for users to move ACO's to & fro without getting their hands dirty. At that time you can pretty things up. It will also save them from toasting Administration from Left Navigation when they try to delete an ACO.