Each healthcare organization has at least one Access Manager who is managing the access rights to the applications of the own organization and is doing so in the HD Entity Access Management (EAM) system. In this process, access requests by healthcare organization employees are analyzed and validated if legitimized. The scope of the accesses granted to healtstat.be may differ, which is reflected in various combinations of user roles and data levels.

Two user roles can be distinguished: Data Provider, which is a user linked to an existing organization, and Sponsor, being the sponsor/coordinator of the data collection. Both are allowed to view reports based on data level. There are two data levels that determine the scope of visibility of the reports: Hospital, i.e. consulted reports contain all data registered by hospital staff, Individual, i.e. consulted reports contain only data that have been registered by that very user.

Data Provider / Hospital:

The Data Provider / Hospital profile can:  

• consult reports of a specific data collection that contain data from the concerned hospital

Data Provider / Individual:

The Data Provider / Individual profile can: 

• consult reports of a specific data collection that only contain data that have been personally registered

Sponsor / Sponsor:

The Sponsor / Sponsor profile can:

• consult all reports that contain data collected at hospital level

Sponsor / Individual:

The Sponsor / Individual profile can: 

• consult all reports that only contain data that have been personally registered

Remarks:

• It is up to the Access manager to change roles from or to Data Provider / Hospital, Data Provider / Individual, Sponsor / Sponsor and Sponsor / Individual. These actions are to be performed in the EAM system.

This option gives the request for access to healthstat.be mainly in the hands of the General Practitioner. The GP first completes the own user profile, then adds an EAM account to it and finally adds the grants, determining the specific registry and the role/data level requested. The General Practitioner then sends the access request for approval to the Access Manager, who fullfils the approving step.

Table of contents

• The General Practitioner actions
  • Completing the user profile and becoming an Authenticated User
  • Adding and provisioning an EAM account
  • Adding grants for a project in healthstat.be
  • Requesting approval of EAM account with access grants for projects in healthstat.be

• The Access Manager actions
  • Approving EAM account with access grants for projects in healthstat.be
  • Performing a push action

The General Practitioner actions

Go back here if you want to know how to navigate to the My Profile page.

Completing the user profile and becoming an Authenticated User

The main My profile page shows the Personal information gathered during the FAS login procedure, and the list of accounts linked to your profile (Linked accounts section).

Attention: When the General Practitioner logs in for the first time, there will be no NIHDI number and the list with linked accounts will be empty too.

Now, click on your name and e-mail address on the top left of the screen to toggle a toolbar with a series of tabs: View profile, Edit profile, My Accounts and Log out. The View profile tab directs you to the My profile screen, which is the screen you are viewing now.

To complete your profile, select the Edit profile tab. The Edit tab contains two subtabs: User settings and Personal information. The red asterisks indicate required fields.

Select the User settings tab.

ATTENTION: When logging in for the first time, the User settings tab will feature a primary e-mail address field with a pre-filled default e-mail address, e.g.:

Replace this address with your professional e-mail address. This e-mail address is used to send necessary notifications to you. Preferably avoid the use of public e-mail addresses such as @gmail.com, @hotmail.com, @yahoo.com etc.

Confirm with the Save button.

The Personal information tab contains pre-populated information such as first name, last name and SSIN in greyed out fields. This information can't be changed. Next to this, you can provide a personal NIHDI number, or more than one, if applicable.

Use the Save button to confirm. You have now completed the fields in both User settings and Personal information tabs, which makes you known to the EAM system as an Authenticated User.

Adding and provisioning an EAM account

Return to the My profile page and select the My accounts tab.

On the My accounts page your personal information is displayed in the blue User details section, followed by a list of accounts you have created.

To add a new account, click on the Add new Account button at the bottom of the page.

The Add a new account window appears.

Complete the fields in the Add a new account window with the e-mail address you use for your organization. Then select the combination of your organization (General Practitioners) and the application (healthstat.be). This is what we call provisioning of an account.

Click on the Save button.

You will be automatically redirected to the My accounts page that has now been updated with your newly created account added at the bottom of the list. The account has received the status "Draft".

Adding grants for a project in healthstat.be

At this point you can start the process of adding grants, i.e. determining roles and data level for a project in Healthstat, adapting the EAM account status and requesting for approval by the Access Manager.

Select "n grants" in the Grants column.

The Account: Manage grants screen appears. To add new grants to an account you need to click on the Add new Grant button.

The Add a new grant window pops up. Select the desired project and the role of Data Provider / Hospital, Data Provider / Individual, Sponsor or Sponsor / Individual.

When you return to the My accounts page, you will see that the accounts list has been updated with the selected grant:

You have now created an account for a project in Healthstat.be with the role of Data Provider / Hospital, Data Provider / Individual, Sponsor / Sponsor or Sponsor / Individual.

Requesting approval of EAM account with access grants for projects in healthstat.be

To request approval of this account you need to click on "n grant(s)" in the Grants column to open the Account: Manage grants page. You either can add a new grant or request for approval. To do so, click on the Request approval button.

The Account state is updated to Approval in the Account details section.

Return to the My accounts page where you notice the changed Account state to Approval.

The Access Manager will be notified of your request via e-mail. You will have to wait now for the Access Manager to take action. This can take multiple hours. After approval by the Access Manager (next step), the Account state will change to Approved.

The Access Manager actions

Approving EAM account with access grants for projects in healthstat.be

Click on Manage to the top left of the screen, so that EAM appears. When hovering over this, the items EAM Users and EAM Accounts become visible.

Select EAM Accounts and Approval successively.

When clicking on Approval you open the page with end-user accounts that are waiting to be approved:

There are two ways to approve these account requests:

• By checking the selection box of the relevant account request and selecting the Approve action. Click on the Apply to selected item button to perform the action.

• By clicking on the Edit button in the Operations column for the relevant account ...

... and subsequently on the Approve button in the Account: Manage grants screen.

The Account state changes to Approved.

After this, a fulfilment process will start to run in the background, finally resulting in an account state change to Published. Credentials are sent to the General Practitioner by e-mail.

Performing a push action

If this change does not take place within a reasonable amount of time - usually between 15 minutes and up to three hours - the account could be updated by means of a "push".

Therefore, return to the accounts overview screen.

First, check the Approved account that needs to be pushed (1). Then, open the Action drop-down menu and select the Update account (push) option (2). Finally, validate this action by clicking on the Apply to selected items button (3).

In case the push action does not trigger the expected result, you need to contact our Support service.

With this option the actions performed by the General Practitioner are restricted to the completion of the own user profile and the creation of an EAM account which is an absolute necessity to be retrieved by the Access Manager via the Users Overview. The Access Manager takes it from there and adds the grants to the EAM accounts of the General Practitioners, sends the access request for approval and finally approves this request.

Table of contents

• The General Practitioner actions
  • Completing the user profile and becoming an Authenticated User
  • Adding and provisioning an EAM account

• The Access Manager actions
  • Retrieving the EAM account of the General Practitioner
  • Adding grants for a project in healthstat.be
  • Requesting approval of EAM account with access grants for projects in healthstat.be
  • Approving EAM account with access grants for projects in healthstat.be
  • Performing push action

The General Practitioner actions

Go back here if you want to know how to navigate to the My Profile page.

Completing the user profile and becoming an Authenticated User

The main My profile page shows the Personal information gathered during the FAS login procedure, and the list of accounts linked to your profile (Linked accounts section).

Attention: When the General Practitioner logs in for the first time, there will be no NIHDI number and the list with linked accounts will be empty too.

Now, click on your name and e-mail address on the top left of the screen to toggle a toolbar with a series of tabs: View profile, Edit profile, My Accounts and Log out. The View profile tab directs you to the My profile screen, which is the screen you are viewing now.

To complete your profile, select the Edit profile tab. The Edit tab contains two subtabs: User settings and Personal information. The red asterisks indicate required fields.

Select the User settings tab.

ATTENTION: When logging in for the first time, the User settings tab will feature a primary e-mail address field with a pre-filled default e-mail address, e.g.:

Replace this address with your professional e-mail address. This e-mail address is used to send necessary notifications to you.

Confirm with the Save button.

The Personal information tab contains pre-populated information such as first name, last name and SSIN in greyed out fields. This information can't be changed. Next to this, you can provide a personal NIHDI number, or more than one, if applicable.

Use the Save button to confirm. You have now completed the fields in both User settings and Personal information tabs, which makes you known to the EAM system as an Authenticated User.

Adding and provisioning an EAM account

Return to the My profile page and select the My accounts tab.

On the My accounts page your personal information is displayed in the blue User details section, followed by a list of accounts you have created.

To add a new account, click on the Add new Account button at the bottom of the page.

The Add a new account window appears.

Complete the fields in the Add a new account window with the e-mail address you use for your organization. Then select the combination of your organization (General Practitioners) and the application (healthstat.be). This is what we call provisioning of an account.

Click on the Save button.

You will be automatically redirected to the My accounts page that has now been updated with your newly created account added at the bottom of the list. The account has received the status "Draft".

Since the General Practitioner is now connected to an organization, he or she can now be found by the Access Manager via the EAM Users Overview. Underneath is explained how that exactly works.

The Access Manager actions

Retrieving the EAM account of the General Practitioner

Click on Manage at the top left of the screen, so that the EAM menu appears. When hovering over this, the menu items EAM Users and EAM Accounts become visible. Select EAM Users.

The following page with an overview of the different General Practitioners appears. Select the GP for whom you want to request access to a project in healthstat.be. Click on the corresponding First name, Last name or SSIN.

ATTENTION: General Practitioners that not yet appear in the list have either to register via the FAS procedure and create an account (see General Practitioner actions above) or have to be added via Bulk upload (Access Manager action, see Option 3) first.

The account that has been added and provisioned by the General Practitioner will be visible now and has the Draft status. Click on the Edit button at the end of the relevant account line.

Adding grants for a project in healthstat.be

Next, click on the Add new Grant button at the bottom of the Manage grants page.

The Add a new grant window with some required fields pops up. Select the Project you want to have access to from the drop-down list. Next, select the Role and the Data level that apply to your situation. Click on the Save button.

When returning to the Account: Manage grants page you will notice that the grant is added to your account, which is still in the Draft state.

Requesting approval of EAM account with access grants for projects in healthstat.be

Next step is to request approval of the newly added account with grants, thus enabling the General Practitioner to access the specified project(s) in healthstat.be. Therefore, click on the Request approval button.

The status immediately changes to Approval.

Since you are Access Manager, you will be able to follow up swiftly and to change the Account state to Approved.

Approving EAM account with access grants for projects in healthstat.be

Click on Manage to the top left of the screen, so that EAM appears. When hovering over this, the items EAM Users and EAM Accounts become visible.

Select EAM Accounts and Approval successively.

When clicking on Approval you open the page with end-user accounts that are waiting to be approved:

There are two ways to approve these account requests:

• By checking the selection box of the relevant account request and selecting the Approve action. Click on the Apply to selected item button to perform the action.

• By clicking on the Edit button in the Operations column for the relevant account ...

... and subsequently on the Approve button in the Account: Manage grants screen.

The Account state changes to Approved.

After this, a fulfilment process will start to run in the background, finally resulting in an account state change to Published.

Performing a push action

If this change does not take place within a reasonable amount of time - usually between 15 minutes and up to three hours - the account could be updated by means of a "push".

Therefore, return to the accounts overview screen.

First, check the Approved account that needs to be pushed (1). Then, open the Action drop-down menu and select the Update account (push) option (2). Finally, validate this action by clicking on the Apply to selected items button (3).

In case the push action does not trigger the expected result, you need to contact our Support service.

When chosing this option, all actions are to be carried out by the Access Manager. First, the Access Manager needs to create the EAM Users (i.e. General Practitioners) by means of a bulk upload using a csv file. After succesful import of this list, the same procedure is repeated for the EAM Accounts, including access grants. Based on the required fields in the csv files, the user and account data are linked, and only need to be approved by the Access Manager.

Table of contents

The General Practitioner actions

• None

The Access Manager actions

• Creating EAM Users in batch
• Creating EAM Accounts in batch awaiting approval using CSV upload
• Approving EAM account with access grants for projects in healthstat.be
• Performing a push action

The General Practitioner actions

No actions to be completed by the General Practitioner

The General Practitioner is an Authenticated User who does not have the rights to perform the necessary actions.

The Access Manager actions

Go back here if you want to know how to navigate to the My Profile page.

Creating EAM Users in batch

Click on Manage to the top left of the screen, so that EAM appears. When hovering over this, the items EAM Users and EAM Accounts become visible. Click on EAM Users and Bulk upload successively.

The Users Batch Creation page appears.

Select a valid .csv file on your system to upload or use the following example file:

Use the schema file to validate the csv example file:

Now, run the batch creation by clicking on the corresponding button.

Return to the EAM Users overview page to verify the bulk uploaded list of General Practitioners.

Following this step, the Access Manager needs to link these Users with EAM accounts, having the access grants in them.

Creating EAM accounts in batch awaiting approval using CSV Upload

Click on Manage to the top left of the screen, so that EAM appears. When hovering over this, the items EAM Users and EAM Accounts become visible. Click on EAM Accounts and Bulk upload successively.

The Accounts Batch Creation page appears.

Select a valid .csv file on your system to upload or use the following example file:

Use the schema file to validate the csv:

Then, make a selection in the Approval State menu shown below.

• Create as awaiting approval: With this option the accounts will receive the status Approval and will be set ready for the Access Manager to be Approved.
  
• Create as pre-approved: With this option the accounts will automatically receive the status Approved and will be uploaded directly without further input from the Access Manager (e.g. confidence in content quality is very high)

Finally, run the batch creation by clicking on the corresponding button.

Approving EAM account with access grants for projects in healthstat.be

When you as Access Manager have chosen to create the EAM accounts as awaiting approval, you need to complete the action with the step described in the following.

Go to the EAM menu as usual.

Select EAM Accounts and then Approval.

When clicking on Approval you open the page with the EAM accounts that are waiting to be approved:

There are two ways to approve these account requests:

• By checking the selection box of the relevant account request and selecting the Approve action. Click on the Apply to selected item button to perform the action.

• By clicking on the Edit button in the Operations column for the relevant account ...

... and subsequently on the Approve button in the Account: Manage grants screen.

The Account state changes to Approved.

After this, a fulfilment process will start to run in the background, finally resulting in an account state change to Published.

Performing a push action

If this change does not take place within a reasonable amount of time - usually between 15 minutes and up to three hours - the account could be updated by means of a "push".

Therefore, return to the accounts overview screen.

First, check the Approved account that needs to be pushed (1). Then, open the Action drop-down menu and select the Update account (push) option (2). Finally, validate this action by clicking on the Apply to selected items button (3).

In case the push action does not trigger the expected result, you need to contact our Support service.

Underpinning the new HD Entity Access Management system, short "EAM", is an architecture purpose-built to give the control of users back into the hands of Access Managers, ensuring an end-to-end management of the lifecycle of a user in the system.

The new architecture and its underlying processes bring along some new concepts. We have listed them for you below, supplemented with familiar concepts.

Access Manager

An Access Manager is an Authenticated User having additional Access Manager rights within the EAM system. These rights are granted by healthdata.be to the first Access Manager of a certain Organization. Any additional access managers are to be appointed by the Organization and rights are to be granted by the existing Access Manager of that Organization.

An Access Manager validates and manages user accounts within the Entity Access Management system, approves and manages the accesses of these EAM users to different applications for any available projects, and has the power to create EAM users and EAM accounts by means of csv bulk upload.

Account (EAM account)

An account in EAM is a combination of an e-mail address and a provision completed with a set of rights (access grants) giving access to a certain registry. An account thus links EAM user to the desired registry within an application.

A user can have more than one account, each with a different e-mail address, e.g. when working in different healthcare organizations (HCOs), and each with another provision.

Account state

The below overview shows the different states of an EAM account throughout the workflow.

The Label column mentions the name of the action button available for the Authenticated User and/or Access Manager in the relevant GUI screens. (Only Create New Draft and Request approval actions are available for an Authenticated User.)

Admin

The Admin or administrator is part of the healthdata.be staff and has all permissions and functionalities within the EAM system. This user type should be used sparingly and only for highly technical or emergency purposes.

Authenticated User

An Authenticated User is a person who is logged in to the HD EAM system via itsme or eID and has a user profile based on First name, Last name and NISS code shared when logging in via the Federal Authentication Service (FAS). An Authenticated User is able to access the EAM application, create accounts and request access grants for projects in applications such as HD4DP2 and healthstat.be. He or she also has access to the own account information in case changes are necessary.

Author group

An Author Group is a group of users with equal editing and reviewing rights to a registration in a certain application of the organisation. The Author Group creation is based on First_name Last_name of the user requesting access. It is thereafter managed in the HD Entity Access Management (EAM) system.

For the HD4DP2 application the Author Group field is automatically populated for user roles 1 (Study Lead) and 2 (Study Associate). The Author Group for role 3 (Study Support) needs to be selected from the relevant drop-down list.

FAS

The Federal Authentication Service (FAS) is a system that authenticates individuals to grant them access to secure online government applications. It ensures the genuineness of users before allowing them to use protected government services in Belgium.

Grants (Access grants)

Grants define a user's access to a registry in an certain application with a specific role. They are added to a provisioned EAM account and need to be approved by the Access Manager of the relevant organization. E.g.:

Legacy requests

The Legacy requests tab retrieves the information shown under the "Requests overview" within the previous EAM version (2.7). The purpose of this overview is to follow-up on pending requests after migration to EAM 3.0.

Manager (HD Manager)

The Manager is a user type in EAM performed by healthdata.be Service Desk staff. Compared to an Access Manager the manager profile has more extensive rights for advanced actions, without the emergency functionalities of an Administrator.

Messages (log)

Messages are created whenever actions are performed on EAM account level, e.g. password reset, request of account approval, approving of grants etc. A message is the representation of something we send to or receive from Service bus. The messages will be logged within EAM for history purposes.

Organization

In full: Healthcare Organization (HCO). A list of all organizations including Name, NIHDI number and the respective list of Access Managers is managed by the HD Manager. An organization that is not active anymore, will receive the status Disabled, without being deleted from the EAM system.

Provision

The provision is the deployment of a certain Application to a certain Organization along with any specific parameters providing extra information on the deployment.

Service Bus

Is a communication layer between our EAM portal and the installations at the DP's side. Whereas the former EAM system mainly managed access requests, it now focusses on complete User management incl. access requests, account creating, feedback loop ... aiming at faster user onboarding, a better user experience and less manual intervention by Support / DevOps.

User (EAM user)

The user is the main entity within the EAM system. Once the user's profile, containing basic information such as Username, Primary e-mail address, First name, Last name, SSIN and professional NIHDI code, has been validated, the user has access to EAM, ready to interact. EAM offers the possibility to add more than one NIHDI code. Each user can be linked to more than one Account.

User matrix

In general, a user matrix is a structured way to organize information about users and their action radius. We have used the user matrix as a starting point of our documentation of the new Entity Access Management system: a cross-table of the different functionalities of the user types Authenticated User and Access Manager. From here, you can reach the exact information.

User roles

User roles determine your access rights in HD applications such as HD4DP2 or healthstat.be for the desired project. The role hierarchy do not necessarily correspond to the staff structure within your organization. More on User roles in HD4DP2 can be found here. The user roles in healhtstat.be are documented here.

User types

User types determine the level of managing rights you have within the EAM system:

• Authenticated user
• Validated user (see below)
• Access manager
• (HD) Manager
• Administrator

Different from User roles which are typical for HD applications.

Validated user

User type. After migration of your healthcare organisation to the current EAM system, the Access Manager might notice the user type of Validated user in the Role(s) column on the EAM Users overview page.

The label "Validated user" is a remnant of EAM version 2.7 where it meant to indicate that a user's profile had been completed and validated by the Access Manager. This migrated user type corresponds to the Authenticated user type in the current EAM system. As such, "Validated user" is not an active role in the current system, nor does it influence the functionality thereof.

Disabling an EAM account

Click on Manage on the top left of the screen in order to reveal the EAM menu. Select EAM Accounts.

Scroll down the displayed list of accounts and tick the selection box of the account(s) you want to disable. Go to the bottom of the page and click on the Action toggle button to select Disable account. Then, click on the Apply to selected items button.

Confirm with the Execute action button

This action triggers an email notification for the Authenticated User to inform about the account being disabled. The user is no longer able to login with the credentials at hand, and needs to contact the Access Manager to have the account enabled again.

Enabling an EAM account

Click on Manage on the top left of the screen in order to reveal the EAM menu. Select EAM Accounts.

Scroll down the displayed list of accounts and tick the selection box of the account(s) you want to enable. Go to the bottom of the page and click on the Action toggle button to select Enable Account.

To complete the action, you need to click on the Execute action button.

This action triggers an email being submitted to the Authenticated User with new credentials. All previously approved accesses will be restored.

Viewing all users within the organization HDGP3333 for healthstat.be using the EAM interface?

Click on Manage to the top left of the screen, so that EAM appears. When hovering over this menu item, the subitems EAM Users and EAM Accounts become visible. Select EAM Accounts.

The page shown gives an overview of all accounts of all users within the organization(s) for the different applications, including the grants.

Filtering accounts for healthstat.be

Use "CTRL+F" and enter "Healthstat" in order to find the accounts for projects in the application healthstat.be.