Latest technology stack
OpenSpecimen is built using the latest versions of all the technology platforms used internally. This includes Tomcat, Apache, Oracle, MySQL, Java, etc.
HTTPS/SSL
OpenSpecimen supports (and highly recommends) using SSL enabled webserver to ensure encrypting data over the network.
User account security
Organizational Single Sign On (SSO)
This enables users to login into OpenSpecimen using their organizational credentials. It also ensures only active organizational users can access OpenSpecimen. You can configure one or more Identity Providers (IdP) to authenticate users in OpenSpecimen.
Currently, we support LDAP and SAML based authentication, apart from the in-built user module of OpenSpecimen.
Two-factor authentication
Two-factor Authentication enables OpenSpecimen customers to implement an additional security layer to protect user accounts from being hacked. When 2FA is configured, users will need to enter an additional One Time Password (OTP) along with the username and password.
This is a system-level configuration and applies to all the users.
Password encryption
User passwords for local accounts are stored in MySQL database. To protect the user passwords, OpenSpecimen uses bcrypt to hash the user passwords before storing them in database.
Application features
Password protection
Note: This does not apply if user accounts are integrated with the Customer's Identity Providers (IdP).
Password should be of length N characters (default 8)
Password complexity defined via RegEx as per customer needs (default: one capital, one number, special character)
Cannot be the same as the last N passwords
Password expiry every N days
Passwords are never emailed in free text
Passwords are stored in a one-way encrypted format
Accounts are locked after N failed attempts
Accounts are locked after N days of inactivity
Where N is configured as per the Customer's needs.
Login Audit
Every login and logout session is recorded, including failed login attempts.
Data manipulation audit
Every action that results in data being changed is audited (i.e., create, edit, delete). The audit information contains:
Timestamp
User id
IP address
Record id
In the case of edit: old value and new value
Currently, audit reports will have to be generated either directly from the database or via REST API calls. There is no user interface for the same. Building a UI driven audit reporting module is present in our product roadmap.
Reporting audit
Every time a user runs a report, a log is maintained, which includes information like:
User ID
Timestamp
Report ID
Internal SQL generated
PHI data security
Across the globe, security of PHI data is a matter of concern. There are many strict rules (e.g. HIPAA in the USA, GDPR rules in Europe, etc.). OpenSpecimen provides features to make clients compliant with these rules.
Restricted access to PHI
OpenSpecimen supports restricting access to data based on
Collection Protocol
Site
Hierarchy of user roles (Admin > Tissue Banker > Technician > Researcher)
With right combinations of the above 3 parameters, every user will be able to see only part of data entitled to them. This applies to all modules within OpenSpecimen. Ability to Create/ Edit/ Delete etc. can also be restricted via roles.
Data shared via emails
All the email notifications received by end users can be configured not to show any PHI data. As a general rule, user gets emails for the work concerning him.
Please refer this wiki page to know more about when email notifications are generated and sent to users.
Administrator emails
Administrator email address: Email address is mentioned in Settings --> ‘Administrator Email Address'. All the emails in the systems are CC’d to this email.
IT admin: IT admin email address is mentioned in Settings --> IT administrator email address. This email address is optional and receives notifications for uncaught system errors. This usually do not contain any PHI data.