ACL Fine Granular Control

Preface

A practice, with staff performing a multitude of tasks, at some point, would wish to delineate the degree of access to the various parts of OpenEMR. Because the Navigation Menu is the nexus of all modules, it is this part of the application that users seek to customize access for staff, commensurate with their duties.

Ideally changing permissions should be as simple as described in the Wiki article, but that is not the case. Because permissions tend to overlap and because each permission may encompass more functions than its stated title, fine granular control is difficult to achieve.

Adding to the complexity is the fact that new snippets need to be added to the relevant .php file. Forum members are all too aware that, even with the help of developers, at least 2 pages of discussion are usually required to accomplish the task. Fine tuning is possible with a healthy dose of patience.

There is an excellent explanation of ACL by the authors of the module. It can be found by navigating from Administration->ACL-> (Advanced) link in the heading->Manual tab. "Star Wars" aficionados will appreciate the analogy.

Two important concepts are ARO or Access Request Objects (the Group to whom access is granted) and ACO or Access Control Objects (functions to which access is being granted).

If a practice has many groups of ARO's beyond the default, it may be easier to start with the Front Desk because it has the most limited access. From that set of ACO's the practice can configure additional layers of ACO's.

Advisory

• Experiment on a test copy.

• Backup or create a system image before attempting on the production copy. White screens tend to make even the most hardy amongst us faint with fear.

Elements

Menu

Navigation Menu provides an in-depth look at the left side bar.

Left_nav.php

In addition to the Menu, the user must become familiar with the various aspects of the Access Control Administration (Advanced), the Array and the Disallowed sections of openemr/interface/main/left_nav.php that governs the Menu and the .php files that generate the frames in question.

Array

The Array section, shown below, describes most of what is listed in the Navigation Menu; but not all of it and at times beyond it. Not everything in the Menu can be found here and at the same time Array addresses non-Menu functions. Our task is to find the correct primary document (if available) for hiding the part of the Menu that is of interest to us.

Each of the documents has a short descriptor, a more detailed descriptor, information regarding reference point (whether global or about patients or encounters) and generally the location of the pertinent .php file. Some of the documents are self-evident, while others are more opaque. All will have comments in bold.

• "'ros' => array(xl('Roster') , 0, 'reports/players_report.php?embed=1')": Roster of players, for Athletic teams; probably not relevant to most practices.

• "'cal' => array(xl('Calendar') , 0, 'main/main_info.php')": Calendar for scheduling appointments.

• "'app' => array(xl('Portal Activity') , 0, '../myportal/index.php')": Patient Portal, if enabled.

• "'msg' => array(xl('Messages') , 0, 'main/messages/messages.php?form_active=1')": Messages Center.

• "'pwd' => array(xl('Password') , 0, 'usergroup/user_info.php')": Password, under Miscellaneous.

• "'prf' => array(xl('Preferences') , 0, 'super/edit_globals.php?mode=user')": Preferences, under Miscellaneous.

• "'adm' => array(xl('Admin') , 0, 'usergroup/admin_frameset.php')": Users, under Administration.

• "'rep' => array(xl('Reports') , 0, 'reports/index.php')": Reports, for Clients, Clinic, Visits and Financial.

• "'ono' => array(xl('Ofc Notes') , 0, 'main/onotes/office_comments.php')": Ofc Notes, under Miscellaneous.

• "'fax' => array(xl('Fax/Scan') , 0, 'fax/faxq.php')": Administration, Globals, Miscellaneous tab.

• "'adb' => array(xl('Addr Bk') , 0, 'usergroup/addrbook_list.php')": Address Book under Miscellaneous.

• "'orl' => array(xl('Proc Prov') , 0, 'orders/procedure_provider_list.php')": Providers under Procedures.

• "'ort' => array(xl('Proc Cat') , 0, 'orders/types.php')": Categories of tests in Configuration under Procedures.

• "'orc' => array(xl('Proc Load') , 0, 'orders/load_compendium.php')": Load Compendium under Procedures.

• "'orb' => array(xl('Proc Bat') , 0, 'orders/orders_results.php?batch=1')": Batch Results under Procedures.

• "'ore' => array(xl('E-Reports') , 0, 'orders/list_reports.php')": Electronic Reports under Procedures.

• "'ppo' => array(xl('CMS Portal'), 0, 'cmsportal/list_requests.php')": CMS Portal.

• "'cht' => array(xl('Chart Trk') , 0, '../custom/chart_tracker.php')": Chart Tracker under Miscellaneous.

• "'imp' => array(xl('Import') , 0, '../custom/import.php')": New Documents for import, under Miscellaneous.

• "'bil' => array(xl('Billing') , 0, 'billing/billing_report.php')": Billing module under Fees.

• "'sup' => array(xl('Superbill') , 0, 'patient_file/encounter/superbill_custom_full.php')": Superbill under Visits, Reports.

• "'aun' => array(xl('Authorizations'), 0, 'main/authorizations/authorizations.php')": Authorization under Miscellaneous.

• "'new' => array(xl('New Pt') , 0, 'new/new.php')": New/Search under Patients/Clients.

• "'ped' => array(xl('Patient Education'), 0, 'reports/patient_edu_web_lookup.php')": Patient Education under Miscellaneous.

• "'lab' => array(xl('Check Lab Results') , 0, 'orders/lab_exchange.php')": Lab Exchange in Administration, Globals, Connectors.

• "'dem' => array(xl('Patient') , 1, "patient_file/summary/demographics.php")": Demographics section of Patient Summary.

• "'his' => array(xl('History') , 1, 'patient_file/history/history.php')": History tab of Patient Summary.

• "'ens' => array(xl('Visit History'), 1, 'patient_file/history/encounters.php')": Visit History under Visits,Patients/Clients.

• "'nen' => array(xl('Create Visit'), 1, 'forms/newpatient/new.php?autoloaded=1&calenc=')": Create Visit under Visits, Patients/Clients.

• "'pre' => array(xl('Rx') , 1, 'patient_file/summary/rx_frameset.php')": Prescription module.

• "'iss' => array(xl('Issues') , 1, 'patient_file/summary/stats_full.php?active=all')": Issues tab of Patient Summary.

• "'imm' => array(xl('Immunize') , 1, 'patient_file/summary/immunizations.php')": Immunizations module of Patient Summary.

• "'doc' => array(xl('Documents') , 1, '../controller.php?document&list&patient_id={PID}')": Documents tab of Patient Summary.

• "'orp' => array(xl('Proc Pending Rev'), 1, 'orders/orders_results.php?review=1')": Pending Review under Procedures.

• "'orr' => array(xl('Proc Res') , 1, 'orders/orders_results.php')": Patient Results under Procedures.

• "'lda' => array(xl('Lab overview') , 1, 'patient_file/summary/labdata.php')": Lab Overview under Procedures.

• "'tan' => array(xl('Configure Tracks') , 0, 'forms/track_anything/create.php')": Track Anything module, if enabled.

• "'prp' => array(xl('Pt Report') , 1, 'patient_file/report/patient_report.php')": Report tab of Patient Summary.

• "'prq' => array(xl('Pt Rec Request') , 1, 'patient_file/transaction/record_request.php')": Record Request in Transaction tab of Patient Summary.

• "'pno' => array(xl('Pt Notes') , 1, 'patient_file/summary/pnotes.php')": Notes in Patient Summary.

• "'tra' => array(xl('Transact') , 1, 'patient_file/transaction/transactions.php')": Transaction tab of Patient Summary.

• "'sum' => array(xl('Summary') , 1, 'patient_file/summary/summary_bottom.php')": Summary under Patients/Clients.

• "'enc' => array(xl('Encounter') , 2, 'patient_file/encounter/encounter_top.php')": New Encounter from Encounter History drop down menu.

• "'erx' => array(xl('e-Rx') , 1, 'eRx.php')": E-Prescribe if enabled.

• "'err' => array(xl('e-Rx Renewal') , 1, 'eRx.php?page=status')": E-Prescription renewal.

• "'pay' => array(xl('Payment') , 1, '../patient_file/front_payment.php')": Payment under Fees.

• "'edi' => array(xl('EDI History') , 0, 'billing/edih_view.php')": EDI History under Fees.

• "'dld' => array(xl('Display Documents'), 0, 'main/display_documents.php')": Display from Documents tab of Patient Summary.

Disallowed

If we can work from the Disallowed section, it would be helpful.

Globals

Because the Globals section of Administration in Left Navigation regulates many of the Menu items, settings from there are used to refine access. Become familiar with this set of modules.

.Php

To find the .php for the frame that is to be hidden, right click in the frame -> choose "This Frame" -> "Open In Another Tab". The URL will give the path to the .php file.

ACO's

If the user cannot find an appropriate ACO, chances are that it must be created de novo. This task can be accomplished from Access Control List Administration, (Advanced) link in the heading. This will be described in more details below in the paragraph about Reports.

Methods

There essentially two ways to hide Menu items. The first involves snippets from Globals, Array, Disallowed, an ACO and the specific .php file. The second requires only a related ACO and the specific .php file. By far the latter is easier of the two, because less code changes and therefore less testing are needed.

An example of the first method is described in Calendar and Reports. The second method is used for the other examples.

The following examples will be arranged alphabetically instead of their listing order in the Menu.

Administration

Access Control is fully functional for the various groups of ARO's. Should a situation arise, wherein more work is requested by the community, we can add it to this section.

Calendar

There exist practices that don't want the Front Office to view the Calendar. It is a rare occurrence because the Front Office is predominately responsible for booking appointments. We will use this example because the exercise is fairly straightforward.

• Move the ACO to the right.

• Note that that the Array section has a "cal" document,"'cal' => array(xl('Calendar'), ..."; so we have a fortuitous start.

• Note also the path is at the top of the screenshot, which helps to orient the user.

• Because the Calendar can be disabled from Globals, a statement must address this fact. The second statement asks if the ARO has permission to view the Calendar.

• Insert this snippet into Line 189:

$disallowed['cal'] = !(GLOBALS['disable_calendar'] || acl_check('patients','appointments',, 'write'));

• The openemr/interface/main/calendar/index.php handles the Calendar.

• Insert the 2 snippets:

require_once("$srcdir/acl.inc");

if (!acl_check('patients','appointment',,'write')) die("Access Denied.");

Fees

The same method used for hiding EOB Data Entry, described below under Patients, can be used for each of the items under Fees.

• Move the ACO to the left.

Billing

• In the script for the Billing Module, insert the following:

if (!acl_check('encounters','coding_a')) die("Access Denied.");

Messages

Unless the practice consists only of the physician, most offices will find the Message Center useful. Method two is deployed to hide it, if that is the practice's desire.

• Choose an ACO from Administration, which is generally reserved for Administrators. It does not have to have a direct relationship to the Message Center.

• Insert this snippet:

if (!acl_check('admin','database')) die("Access Denied.");

Miscellaneous

Use the same technique to hide these items as deployed in Messages.

• Insert this snippet:

if (!acl_check('admin','database')) die("Access Denied.");

Modules

Modules have not been implemented; but when that has been achieved, use the simpler hiding technique.

Patients

Every practice will need access to Patients/Clients, but there will be situations where some modules should have limited access.

EOB

If physicians have no responsibilities for billing, it would not be necessary for this ARO to make entries in the EOB Posting Invoice. A good choice for an appropriate ACO would be Encounters, Coding - anything. Navigating to the frame of interest and opening that frame in another tab will inform the user that the path is openemr/interface/patient_file/history/encounters.php.

• Move the ACO to the left.

• Insert this snippet:

if (!acl_check('encounters','coding_a')) die("Access Denied.");

Forms

Despite the fact that the Front Office should not have access to forms like Review of Systems and SOAP, it does.

• The public document, 'enc', exists in the Array section; permitting us to insert the following:

$disallowed['enc'] = !(acl_check('encounters','notes',,'write'));

• Into each of script for the forms, insert these 2 snippets:

require_once("$srcdir/acl.inc");

if (!acl_check('encounters','notes_a',,'write')) die("Access Denied.")

Procedures

Use the easier method for these items.

• Insert this snippet:

if (!acl_check('admin','database')) die("Access Denied.");

Reports

This task tends to be difficult because there are no ACO's except Financial Reporting as vehicles. Although the listing of various reports will be visible, but access is no longer possible.

ACO's

Go to Aministration->ACL, click the (Advanced) link in the header.

• We need to create a new section first. This is done by navigating from the ACL Admin tab and clicking the Edit button in Sections.

• Make the appropriate entries and click Submit.

• Click the Edit button under Access Control Objects.

• Make the appropriate entries and click Submit.

• To assign the new ACO's to Administrators; select Reports in Sections, select the new ACO's in Access Control Objects, move the ACO's over to the Selected box, ensure that Allowed and Enabled are selected, click Administrators in Groups and click the Submit button.

• Check that Physicians are denied access to Financial and other Reports, while Administrators are granted access.

Disallowed

Despite the fact that there exists a public document, rep, in Array; a snippet cannot simply be inserted, because all users will be denied access to Reports. The workaround is to employ a Globals statement. Because many modules are regulated by Globals, it can be used to refine access.

• Check that both "Enable CQM Reporting" and "Enable AMC Reporting" are selected in Administration.Globals.

• Insert into /openemr/interface/main/left_nav.php Lines 189 to 194:

$disallowed['rep'] = !($GLOBALS['enable cqm reporting'] || $GLOBALS['enable amc reporting'] ||

acl_check('accounting', 'financial_reporting_m') || acl_check('accounting', 'financial_reporting_a') ||

acl_check('reports', 'clients') || acl_check('reports', 'clinic') || acl_check('reports', 'visits') ||

acl_check('reports', 'procedures') || acl_check('reports', 'insurance') ||

acl_check('reports', 'blank_forms') || acl_check('reports', 'services'));

.Php

Mercifully it is not necessary to insert snippets into all of the different .php files under the Reports subsections, only to the three Blank Forms.

• Insert into openemr/interface/patient_file/summary/demographics_print.php, openemr/interface/patient_file/printed_fee_sheet.php and openemr/interface/patient_file/transaction/print_referral.php the following:

require_once("$srcdir/acl.inc");

if (!acl_check('reports','blank')) die("Access Denied.");

Acknowledgment

Stephen Waite of Case Management Solutions whose solutions are the exemplars of simplicity and elegance.

El Jefe whose single snippet ("special sauce") and support laid the foundation for this article.

If your head is not spinning after all these code changes, three cheers for you!!!