bepr020u.local.pdf

RESOURCE AND PATIENT MANAGEMENT SYSTEM

Office of Information Technology Division of Information Resource Management

Albuquerque, New Mexico e-Prescribing Productions

(BEPR)

User Manual

Version 2.0 December 2013 e-Prescribing Productions (BEPR) Version 2.0

User Manual Table of Contents December 2013 ii

Table of Contents

1.0 Introduction

2.0 System Navigation

2.1 Package Management

2.1.1 System Requirements

2.1.2 Accessing the Portal

2.2 Package Operation

2.2.1 BEPR Production Start

2.2.2 Stopping Production

3.0 Managing E-mail Notifications

Appendix A: Rules of Behavior A.1 All RPMS Users

A.1.1 Access A.1.2 Information Accessibility A.1.3 Accountability A.1.4 Confidentiality A.1.5 Integrity A.1.6 System Logon A.1.7 Passwords A.1.8 Backups A.1.9 Reporting A.1.10 Session Timeouts A.1.11 Hardware A.1.12 Awareness A.1.13 Remote Access

A.2 RPMS Developers A.3 Privileged Users

Glossary

Acronym List

Contact Information

User Manual Preface December 2013 iii

Preface

The purpose of this document is to provide the user information about the e-Prescribing Productions for the Local Server. The Local version has a root package name of Rx and several sub-packages including but not limited to: DD (Directory Download), SPI (Surescripts® Provider Identifier), and NewRx (New electronic prescription) which hold code for the various functions of the Local production.

Further definitions of the terms are included in the Glossary.

User Manual Introduction December 2013

1.0 Introduction

The Ensemble Interface Engine (EIE) provides a means to download a file containing pharmacies in the network (Directory Download), to request and receive a Surescripts Prescriber ID (SPI), and to electronically send a prescription (NewRx) to a pharmacy within the Surescripts network.

The purpose of this document is to provide the user information on how to use the EIE BEPR management pages and how to start the production.

User Manual System Navigation December 2013

2.0 System Navigation

2.1 Package Management

RPMS end users do not have direct access to the BEPR application. The messages that are transported by this application may be viewed by IT personnel in the process of troubleshooting. The message content will ultimately be viewed indirectly by third party pharmacy staff including pharmacists, pharmacy technicians and clerks.

Site managers may have access to the Ensemble Management Portal which can be used to directly view message content. Access to Ensemble will be determinate on job duties and level of access should limit the user to a level needed to perform said duties.

2.1.1 System Requirements

Module Minimum Version Ensemble 2012.2 Internet Explorer 8.0

Table 2-1: System Requirements

2.1.2 Accessing the Portal

The management portal is accessed by launching Internet Explorer (“the browser”) and navigating to the following URL populated with the appropriate server information:

http://EIEserver:port/csp/sys/UtilHome.csp

Upon entering the URL into the browser, the user will be presented with the EIE Login page.

Figure 2-1: EIE System Management Login page

Initially, the user will need to log in as an Ensemble super user (i.e., one that holds the %All role). Otherwise, the user will not have the necessary security permissions to access the portal.

2.2 Package Operation

This section describes how to start and stop the BEPR production within Ensemble.

For additional information on how to use Ensemble please refer to the documentation available at http://docs.intersystems.com/ensemble.html.

2.2.1 BEPR Production Start

Select Ensemble; the Available Ensemble namespaces section is displayed.

• Select the e-Prescribing database

Figure 2-2: Ensemble Management Portal page

1. Click Open; Production navigation page is displayed.

Figure 2-3: Production configuration page header

2. Click BEPR; the Productions column is displayed.

3. Click Productions; the Local column is displayed.

4. Click Local; the BEPR.Productions.Local column is displayed.

5. Click Go; the Production Configuration page is displayed

Figure 2-3: Production navigation page

6. Click Start; a confirmation dialog is displayed

7. Click OK; a confirmation dialog is displayed

8. Click “OK; the Production Configuration page is displayed

Figure 2-4: Production Configuration page

2.2.2 Stopping Production

The user may need to stop production.

1. From the Ensemble Management Portal, select the e-Prescribing production.

Figure 2-5: Production Configuration page

2. Click Stop; a confirmation dialog is displayed.

3. Click OK; the Stop Production page is displayed.

4. Click OK.

User Manual Managing E-mail Notifications December 2013

3.0 Managing E-mail Notifications

You can configure the BEPR Ensemble production to automatically send e-mail notifications about new errors. A notification is typically sent as soon as a new error occurs. This functionality is only available on systems that have an e-mail server configured. This functionality is recommended. You will still be able to view errors recorded while processing requests from the EHR GUI in the Notifications tab.

Sign on to the Ensemble SMP as the administrator. Make sure that you are using Internet Explorer (IE) and not another Web browser, since subsequent steps require

IE.

1. From the Production Configuration page click on the Email Alerts Business Operation and the details of this process will display on the right side of the page.

2. In the Basic Settings enter values in the following fields:

Field Name Value SMTP Server IP address or name of the e-mail server at your site

SMTP Port Port number used by your e-mail server.

The default is 25.

Credentials Only required if the e-mail server requires authentication.

SSL Configuration To use email with Secure Socket Layer / Transport Layer Security, the SSLConfig field must contain the name of an existing SSL/TLS Configuration of the Client type.

You can create one using the System Management Portal [Security Management] > [SSL/TLS Configurations] page.

Table 3-1: E-Mail Basic Settings Values

Field Name Value Recipient A comma-delimited list of e-mail addresses that Ensemble will be sending alerts to, e.g. John.Doe@ihs.gov,Jane.Doe@ihs.gov

Cc OITe-RxAlerts@ihs.gov

From The e-mail address that the alerts will appear as coming from, e.g. ERX_<site name>@<site station number

Table 3-2: E-Mail Additional Settings Values

User Manual Managing E-mail Notifications December 2013

If you have a functional e-mail server but do not have some of this information, contact the Help Desk. Do not modify any other values on this screen because it can invalidate the Ensemble production. Once you have entered all required data, click Apply at the top left of the Settings tab.

Figure 3-1: Email Alerts Settings tab

User Manual Rules of Behavior December 2013

Appendix A: Rules of Behavior The Resource and Patient Management (RPMS) system is a United States Department of Health and Human Services (HHS), Indian Health Service (IHS) information system that is FOR OFFICIAL USE ONLY. The RPMS system is subject to monitoring; therefore, no expectation of privacy shall be assumed.

Individuals found performing unauthorized activities are subject to disciplinary action including criminal prosecution.

All users (Contractors and IHS Employees) of RPMS will be provided a copy of the Rules of Behavior (RoB) and must acknowledge that they have received and read them prior to being granted access to a RPMS system, in accordance IHS policy.

• For a listing of general ROB for all users, see the most recent edition of IHS General User Security Handbook (SOP 06-11a).

• For a listing of system administrators/managers rules, see the most recent edition of the IHS Technical and Managerial Handbook (SOP 06-11b).

Both documents are available at this IHS Web site: http://security.ihs.gov/.

The ROB listed in the following sections are specific to RPMS.

A.1 All RPMS Users In addition to these rules, each application may include additional RoBs that may be defined within the documentation of that application (e.g., Dental, Pharmacy).

A.1.1 Access RPMS users shall

• Only use data for which you have been granted authorization.

• Only give information to personnel who have access authority and have a need to know.

• Always verify a caller’s identification and job purpose with your supervisor or the entity provided as employer before providing any type of information system access, sensitive information, or nonpublic agency information.

• Be aware that personal use of information resources is authorized on a limited basis within the provisions Indian Health Manual Part 8, “Information Resources Management,” Chapter 6, “Limited Personal Use of Information Technology Resources.”

http://security.ihs.gov/

December 2013

RPMS users shall not

• Retrieve information for someone who does not have authority to access the information.

• Access, research, or change any user account, file, directory, table, or record not required to perform their official duties.

• Store sensitive files on a PC hard drive, or portable devices or media, if access to the PC or files cannot be physically or technically limited.

• Exceed their authorized access limits in RPMS by changing information or searching databases beyond the responsibilities of their jobs or by divulging information to anyone not authorized to know that information.

A.1.2 Information Accessibility RPMS shall restrict access to information based on the type and identity of the user.

However, regardless of the type of user, access shall be restricted to the minimum level necessary to perform the job.

RPMS users shall

• Access only those documents they created and those other documents to which they have a valid need-to-know and to which they have specifically granted access through an RPMS application based on their menus (job roles), keys, and FileMan access codes. Some users may be afforded additional privileges based on the functions they perform, such as system administrator or application administrator.

• Acquire a written preauthorization in accordance with IHS polices and procedures prior to interconnection to or transferring data from RPMS.

A.1.3 Accountability RPMS users shall

• Behave in an ethical, technically proficient, informed, and trustworthy manner.

• Log out of the system whenever they leave the vicinity of their personal computers (PCs).

• Be alert to threats and vulnerabilities in the security of the system.

• Report all security incidents to their local Information System Security Officer

(ISSO)

• Differentiate tasks and functions to ensure that no one person has sole access to or control over important resources.

• Protect all sensitive data entrusted to them as part of their government employment.

December 2013

• Abide by all Department and Agency policies and procedures and guidelines related to ethics, conduct, behavior, and information technology (IT) information processes.

A.1.4 Confidentiality RPMS users shall

• Be aware of the sensitivity of electronic and hard copy information, and protect it accordingly.

• Store hard copy reports/storage media containing confidential information in a locked room or cabinet.

• Erase sensitive data on storage media prior to reusing or disposing of the media.

• Protect all RPMS terminals from public viewing at all times.

• Abide by all Health Insurance Portability and Accountability Act (HIPAA) regulations to ensure patient confidentiality.

RPMS users shall not

• Allow confidential information to remain on the PC screen when someone who is not authorized to that data is in the vicinity.

• Store sensitive files on a portable device or media without encrypting.

A.1.5 Integrity RPMS users shall

• Protect their systems against viruses and similar malicious programs.

• Observe all software license agreements.

• Follow industry standard procedures for maintaining and managing RPMS hardware, operating system software, application software, and/or database software and database tables.

• Comply with all copyright regulations and license agreements associated with RPMS software.

RPMS users shall not

• Violate federal copyright laws.

• Install or use unauthorized software within the system libraries or folders.

• Use freeware, shareware, or public domain software on/with the system without their manager’s written permission and without scanning it for viruses first.

December 2013

A.1.6 System Logon RPMS users shall

• Have a unique User Identification/Account name and password.

• Be granted access based on authenticating the account name and password entered.

• Be locked out of an account after five successive failed login attempts within a specified time period (e.g., one hour).

A.1.7 Passwords RPMS users shall

• Change passwords a minimum of every 90 days.

• Create passwords with a minimum of eight characters.

• If the system allows, use a combination of alpha-numeric characters for passwords, with at least one uppercase letter, one lower case letter, and one number. It is recommended, if possible, that a special character also be used in the password.

• Change vendor-supplied passwords immediately.

• Protect passwords by committing them to memory or store them in a safe place (do not store passwords in login scripts or batch files).

• Change passwords immediately if password has been seen, guessed, or otherwise compromised, and report the compromise or suspected compromise to their ISSO.

• Keep user identifications (IDs) and passwords confidential.

RPMS users shall not

• Use common words found in any dictionary as a password.

• Use obvious readable passwords or passwords that incorporate personal data elements (e.g., user’s name, date of birth, address, telephone number, or social security number; names of children or spouses; favorite band, sports team, or automobile; or other personal attributes).

• Share passwords/IDs with anyone or accept the use of another’s password/ID, even if offered.

• Reuse passwords. A new password must contain no more than five characters per eight characters from the previous password.

• Post passwords.

• Keep a password list in an obvious place, such as under keyboards, in desk drawers, or in any other location where it might be disclosed.

December 2013

• Give a password out over the phone.

A.1.8 Backups RPMS users shall

• Plan for contingencies such as physical disasters, loss of processing, and disclosure of information by preparing alternate work strategies and system recovery mechanisms.

• Make backups of systems and files on a regular, defined basis.

• If possible, store backups away from the system in a secure environment.

A.1.9 Reporting RPMS users shall

• Contact and inform their ISSO that they have identified an IT security incident and begin the reporting process by providing an IT Incident Reporting Form regarding this incident.

• Report security incidents as detailed in the IHS Incident Handling Guide (SOP 05-03).

RPMS users shall not

• Assume that someone else has already reported an incident. The risk of an incident going unreported far outweighs the possibility that an incident gets reported more than once.

A.1.10 Session Timeouts RPMS system implements system-based timeouts that back users out of a prompt after no more than 5 minutes of inactivity.

RPMS users shall

• Utilize a screen saver with password protection set to suspend operations at no greater than 10 minutes of inactivity. This will prevent inappropriate access and viewing of any material displayed on the screen after some period of inactivity.

A.1.11 Hardware RPMS users shall

• Avoid placing system equipment near obvious environmental hazards (e.g., water pipes).

• Keep an inventory of all system equipment.

December 2013

• Keep records of maintenance/repairs performed on system equipment.

RPMS users shall not

• Eat or drink near system equipment.

A.1.12 Awareness RPMS users shall

• Participate in organization-wide security training as required.

• Read and adhere to security information pertaining to system hardware and software.

• Take the annual information security awareness.

• Read all applicable RPMS manuals for the applications used in their jobs.

A.1.13 Remote Access Each subscriber organization establishes its own policies for determining which employees may work at home or in other remote workplace locations. Any remote work arrangement should include policies that

• Are in writing.

• Provide authentication of the remote user through the use of ID and password or other acceptable technical means.

• Outline the work requirements and the security safeguards and procedures the employee is expected to follow.

• Ensure adequate storage of files, removal, and nonrecovery of temporary files created in processing sensitive data, virus protection, and intrusion detection, and provide physical security for government equipment and sensitive data.

• Establish mechanisms to back up data created and/or stored at alternate work locations.

Remote RPMS users shall

• Remotely access RPMS through a virtual private network (VPN) whenever possible. Use of direct dial in access must be justified and approved in writing and its use secured in accordance with industry best practices or government procedures.

Remote RPMS users shall not

• Disable any encryption established for network, internet, and Web browser communications.

December 2013

A.2 RPMS Developers RPMS developers shall

• Always be mindful of protecting the confidentiality, availability, and integrity of RPMS when writing or revising code.

• Always follow the IHS RPMS Programming Standards and Conventions (SAC) when developing for RPMS.

• Only access information or code within the namespaces for which they have been assigned as part of their duties.

• Remember that all RPMS code is the property of the U.S. Government, not the developer.

• Not access live production systems without obtaining appropriate written access, and shall only retain that access for the shortest period possible to accomplish the task that requires the access.

• Observe separation of duties policies and procedures to the fullest extent possible.

• Document or comment all changes to any RPMS software at the time the change or update is made. Documentation shall include the programmer’s initials, date of change, and reason for the change.

• Use checksums or other integrity mechanism when releasing their certified applications to assure the integrity of the routines within their RPMS applications.

• Follow industry best standards for systems they are assigned to develop or maintain, and abide by all Department and Agency policies and procedures.

• Document and implement security processes whenever available.

RPMS developers shall not

• Write any code that adversely impacts RPMS, such as backdoor access, “Easter eggs,” time bombs, or any other malicious code or make inappropriate comments within the code, manuals, or help frames.

• Grant any user or system administrator access to RPMS unless proper documentation is provided.

• Release any sensitive agency or patient information.

December 2013

A.3 Privileged Users Personnel who have significant access to processes and data in RPMS, such as, system security administrators, systems administrators, and database administrators, have added responsibilities to ensure the secure operation of RPMS.

Privileged RPMS users shall

• Verify that any user requesting access to any RPMS system has completed the appropriate access request forms.

• Ensure that government personnel and contractor personnel understand and comply with license requirements. End users, supervisors, and functional managers are ultimately responsible for this compliance.

• Advise the system owner on matters concerning information technology security.

• Assist the system owner in developing security plans, risk assessments, and supporting documentation for the certification and accreditation process.

• Ensure that any changes to RPMS that affect contingency and disaster recovery plans are conveyed to the person responsible for maintaining continuity of operations plans.

• Ensure that adequate physical and administrative safeguards are operational within their areas of responsibility and that access to information and data is restricted to authorized personnel on a need-to-know basis.

• Verify that users have received appropriate security training before allowing access to RPMS.

• Implement applicable security access procedures and mechanisms, incorporate appropriate levels of system auditing, and review audit logs.

• Document and investigate known or suspected security incidents or violations and report them to the ISSO, Chief Information Security Officer (CISO), and systems owner.

• Protect the supervisor, superuser, or system administrator passwords.

• Avoid instances where the same individual has responsibility for several functions (i.e., transaction entry and transaction approval).

• Watch for unscheduled, unusual, and unauthorized programs.

• Help train system users on the appropriate use and security of the system.

• Establish protective controls to ensure the accountability, integrity, confidentiality, and availability of the system.

• Replace passwords when a compromise is suspected. Delete user accounts as quickly as possible from the time that the user is no longer authorized system.

Passwords forgotten by their owner should be replaced, not reissued.

December 2013

• Terminate user accounts when a user transfers or has been terminated. If the user has authority to grant authorizations to others, review these other authorizations.

Retrieve any devices used to gain access to the system or equipment. Cancel logon IDs and passwords, and delete or reassign related active and backup files.

• Use a suspend program to prevent an unauthorized user from logging on with the current user’s ID if the system is left on and unattended.

• Verify the identity of the user when resetting passwords. This can be done either in person or having the user answer a question that can be compared to one in the administrator’s database.

• Shall follow industry best standards for systems they are assigned to, and abide by all Department and Agency policies and procedures.

Privileged RPMS users shall not

• Access any files, records, systems, etc., that are not explicitly needed to perform their duties

• Grant any user or system administrator access to RPMS unless proper documentation is provided.

• Release any sensitive agency or patient information.

User Manual Glossary December 2013

Glossary

Directory Download Reference to both the process and the file that is downloaded daily from Surescripts containing pharmacy listings.

NewRx The term Surescripts uses in reference to a new electronic prescription message.

Surescripts® Provider Identifier The Provider is identified by the Surescripts Provider Identifier (SPI) after the site Credentialing Officer has confirmed and submitted the appropriate information to Surescripts. The SPI is a unique 13 digit number. A root 10 digits are assigned to the Provider with an additional 3 digits delineating the location.

User Manual Acronym List December 2013

Acronym List

IHS Indian Health Service

RPMS Resource and Patient Management System

EIE Ensemble Interface Engine

SMP System Management Portal

SPI Surescripts® Provider Identifier

User Manual Contact Information December 2013

Contact Information

If you have any questions or comments regarding this distribution, please contact the OIT Help Desk (IHS).

Phone: (505) 248-4371 or (888) 830-7280 (toll free)

Fax: (505) 248-4363

Web: http://www.ihs.gov/GeneralWeb/HelpCenter/Helpdesk/index.cfm

Email: support@ihs.gov http://www.ihs.gov/GeneralWeb/HelpCenter/Helpdesk/index.cfm mailto:support@ihs.gov