Introduction
OpenSpecimen allows controlling data access by assigning roles to users. The privileges can be controlled at a very granular level for each resource in the system.
OpenSpecimen provides default roles that administrators can assign to different users. To view details about default user roles, follow the below steps:
Navigate to the 'Roles' card.
Click on any of the roles to view more information.
Only Super Admins can create custom roles or edit existing roles.
Privileges specific to Super Administrators
Privileges | Description |
|---|---|
Institute | To create one or more institute in the OpenSpecimen |
User accounts | Only super admin can create other super admins |
Extras>>Audit log | Generation of the audit logs |
Extras>>Database Console | Access to database console |
Extras>>API call logs | History of API call logs |
Extras>>Backups | For setting up database and data file backups |
Extras>>Dropdown manager | To manage values to be displayed in the dropdowns |
Extras>>Identity providers | To create and manage user authentication providers |
Extras>>Import records | To upload the data from multiple files at the same time |
Extras>>Print rules | To create and manage specimen label print rules |
Extras>>Specimen units | To add, edit, delete the specimen units |
Extras>>Upgrade history | To view OpenSpecimen upgrade logs |
System Settings | This allows super admin to update system settings. For more information, refer to https://openspecimen.atlassian.net/wiki/x/EQCtAg |
Attach Form | Super admin can attach form at different level. |
Default Roles
OpenSpecimen is installed with some default roles. Below mentioned are the default roles with descriptions.
Resources
The resources define the module and data entry access given to the user.
Privileges of Users
PHI Fields
The below fields marked as PHI in OpenSpecimen won't be visible to the roles with 'Participant (DeId)' privileges:
First Name
Middle Name
Last Name
Birth Date
Social Security Number
Death Date
Master Patient Index
Medical Record Number (MRN)
Surgical Pathology Number
Any custom fields marked as PHI.
Edit Default Roles
The default role listed below should not be renamed or edited. They get auto-assigned to specific users, as stated below:
Role | Auto-assigned to |
|---|---|
Administrator | Institute Administrator, Site Coordinators |
2. The rest of the default roles can be edited.
3. No role can be deleted via UI.
4. While editing a role, keeping at least one resource privilege is mandatory.
5. Editing means you can assign or unassign permissions to a user or altogether remove a resource.
Sign in as Super admin → Navigate to Roles
Click on the user you wish to edit, for example, Administrator.
Click on edit --> Go to any resource. For example Supplies
To give only read access, tick only the read permission.
If you wish not to provide import-export access, then untick the import-export permissions.
Click on the delete icon to remove the privilege.
Once provided with all required access, click the 'Update' button.
Add Coordinator or PI at CP Level
CP level PI and coordinators are not assigned any role by default.
After creating the CP, the admin has to manually assign specific roles to all the users who need to access the CP.
Provide Researcher access to edit request
Researchers can edit their request(if it's pending) if they have 'Read' access to the 'Catalog' resource.
Ensure the researcher also has access to non-PHI data displayed in the catalog.
Create Custom Role
You can create new roles to suit your local needs.
Log in as a super admin user.
Click the 'Roles' card from the home page.
Click the 'Create' button, and enter valid details.
Click the 'Resources' dropdown and select the desired resources.
Check the checkboxes of the privileges assigned to selected resources and click 'Create.'
Repeat steps 4 & 5 to add new resources.
Import / Export
If you have the 'Exp/Imp' privilege along with 'Create' or 'Update' on any resources, you can perform bulk import and export operations of those resources.
Query Resource (v6.3)
The 'query' resource allows you to access the query module.
CRUD + IE rights on the 'Query' resource is added to all the system shipped roles but the 'Researcher.' By default, the 'Researcher' role acquires only the Read and IE rights.
Users who do not have Read privilege on the 'Query' resource will not be able to view the query module in OpenSpecimen.
More details on operations associated with every privilege on query resource: Query Resource Privilege.