Testing Product Configuration PDF

2 3 User Provisioning Link End Users Write It Down...

2 3 User Provisioning Link End Users Write It Down Who are your Link end users, or who might they be? Answers vary for each class, but some examples include: Detention clinicians, school nurses, billers, requesters, researchers, attorneys, or care managers. EpicCare Link is a web‐based application with service‐oriented features, such as procedure order entry and appointment scheduling. You can configure EpicCare Link to better facilitate business with external organizations. An end user's experience of EpicCare Link at various Epic organizations can be quite different due to the flexibility of the EpicCare Link portal and the varied use cases that dictate whether functionality is turned on or off. Your community users can include people outside of your organization who need to review the clinical and administrative information of patients seen within your healthcare system. Depending on your business model, community users could include both clinical and non‐clinical users. By rolling out EpicCare Link to these different sites and offering potential providers customized user accounts that are tailored to their specific role in patient care, your organization can reach a greater array of specialized users, extend your network of care, and improve patient care in your community. Let's take a look at a few examples: Detention Clinician ‐ Detention clinicians monitor and care for the health of incarcerated people. Their healthcare is not confined to the detention center and often expands to healthcare organizations nearby, especially for specialized care, tests, or procedures. EpicCare Link provides detention clinicians with read‐only access to an incarcerated person's chart and allows the clinicians to make informed decisions about the next steps in care, whether that is ordering labs, procedures, or referrals. School Nurse ‐ Many school nurses operate with little information about the children they are treating, which can lead to dangerous outcomes if a student has a severe condition, allergy, or important medication that the school does not have documented. EpicCare Link gives the school nurses the ability to view a student's chart and provide care with a more complete picture of the child's health. Biller ‐ All of the charges your clinicians file every day need to go through a biller before being sent out on claims. Billers who don't work at an Epic organization can use EpicCare Link to access patient data for billing, reimbursement, or eligibility purposes. Requesters ‐ Medical record departments receive requests for reports summarizing patient clinical EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 22 ECL500v EpicCare Link  User Provisioning 2 4 information every day. These requests come from a variety of sources, including legal entities, insurance agencies, physicians' offices, auditors, and patients themselves. Requesters specify the type of information they are seeking and provide authorization to receive the data, if necessary. Requesters might be interested in all the information from all encounters the patient had over the past year, a discharge summary from the patient's last inpatient stay, or simply the patient's demographic information. For all of these cases, the medical records department is the central hub from which all information is released. EpicCare Link gives these requesters the ability to view released patient information electronically, eliminating the paper that is generated when printing or faxing a release and creating a safer audit trail. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 ECL500v EpicCare Link 23  2 5 User Provisioning Review of Configuring the Epic End User Class This training assumes prior knowledge of user ﴾EMP﴿, user template ﴾EMP﴿, provider/resource ﴾SER﴿, role ﴾E2R﴿, and security class ﴾ECL﴿ records. For a refresher on these records, review the corresponding chapters in the CLN251‐252 Configuring the Epic End User Clinical/Shared training companion. User ﴾EMP﴿ Records User ﴾EMP﴿ records determine login IDs, passwords, default login departments, security ﴾access to functionality﴿, and many other settings. Write It Down Who needs a user record in EpicCare Link? Anyone that needs to... Log in! Anyone who needs to log in to Hyperspace needs their own user record. User records determine how and where a user logs in, as well as what access they have within Hyperspace. Similar to your Hyperspace end users, if an affiliate user wants to log in to EpicCare Link, they will also need a user record. Because they are affiliate users, and not associated with your organization, you do not want them to be able to log in to Hyperspace. We will configure user records to both allow access to the EpicCare Link secure web portal and prevent inappropriate access to patient data. In this class, we may refer to affiliate users as EpicCare Link users, Link end users, Link users, or simply end users. Provider ﴾SER﴿ Records The provider/resource ﴾SER﴿ master file ﴾often called simply the provider master file or the SER master file﴿ contains demographic, scheduling, billing, ordering, admitting, attending, and other information relevant to a clinical user or resource. Any people, devices, or modalities that meet certain criteria need a record in the provider/resource master file. In EpicCare Link, there are certain settings configured in the provider master file that will impact what Link users can do in the system. The ability to authorize orders or be referred to are important functions in many Link rollouts. You will explore these details in an after‐class exercise. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 24 ECL500v EpicCare Link  User Provisioning 2 6 Write It Down Who needs a provider record in EpicCare Link? Anyone or anything who: Can give or receive referrals Can be scheduled with patients Can authorize orders Should be granted access to patient records in EpicCare Link In some cases, you might have Link users ﴾i.e., clinical support staff﴿ who have user records but do not have provider records. These Link users are delegates of users who have provider records. Delegates need to log in to EpicCare Link but do not need to complete provider‐specific tasks, such as being scheduled with patients or receive referrals. There are also cases where individuals ﴾or resources﴿ have provider records but do not have user records. These community providers do not log in to EpicCare Link but can be the recipient of referrals from the Link site or be listed as the authorizing provider for orders, for example. Unlike clinical support staff in Hyperspace who might be credentialed or needs to complete clinical documentation, delegates and clinical support staff in EpicCare Link do not need provider records. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 ECL500v EpicCare Link 25  2 7 User Provisioning Follow Along: Configure a User Record You have been tasked with configuring Dr. Randy's user record. He is a new physician working at a Link site, so he needs to be able to log in to EpicCare Link but not in Hyperspace. Since he works at only one Link site, he wants to be able to log in to his site's department, TRN## Badger Clinic, by default. In addition, he should be able to give or receive referrals, be scheduled with patients, authorize orders, and be granted access to patient records. 1. Log in to Classic as your Tony builder ﴾2014##﴿. 2. Click User Security on the top toolbar. 3. With Edit single user selected, search for and open your Randy physician's user record by using his ID "2011##." 4. Accept the most recent contact. 5. Expand the Hyperspace/Shared form to open the Login Settings subform. 6. Change the Default login department to your "TRN## Badger Clinic" [911099##]. By making this change, Dr. Randy's correct department will always be prepopulated whenever he logs in to EpicCare Link. 7. Expand the EpicCare form to open the Provider/Hot‐Keys subform. 8. Add your Randy physician's pre‐built provider ﴾SER﴿ record in the Link to provider field by using the ID "2011##." This links the provider record to the user record. It is Epic's recommendation that linked provider and user records have the same ID number. 9. Confirm that the Provider at login option is set to "Lock to linked provider." This setting ensures that when Dr. Randy logs in to EpicCare Link, his provider record is defaulted for all of his clinical documentation. Write It Down Why is the Provider at login option field grayed out? Because this is a setting configured in the user template (EMP) record. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 26 ECL500v EpicCare Link  User Provisioning 2 8 You can use Site Wizard to manually link new provider users to existing provider records or automatically create new provider records. See Decide What Records to Create Along with New User and Site Accounts topic of the New Account Request and Site Wizard Setup and Support Guide. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 ECL500v EpicCare Link 27  2 9 User Provisioning Follow Along: Apply a User Template for Shared Settings Other settings, such as linked role and security classifications, can be shared across multiple users. To efficiently maintain those shared settings for multiple user records, create a user template ﴾EMP﴿ record to assign to a particular group of users ﴾for example, Link physicians﴿. If you change a setting in the user template, all of the linked user records are automatically updated to reflect the change. This makes it much easier to maintain user records. In training, you will learn the following shared settings to create the appropriate EpicCare Link experience: enabling access to activities, preventing Link users from logging in to Hyperspace, and assigning the appropriate security classifications. 1. Open the Linked Templates form. 2. Replace the current linked template with your "TRN## Link Physician Template" [911000##] and make it the default. The default template determines the maximum password age, minimum password age, and authentication configuration. If a user record has only one linkable template linked to it, that template is automatically set as the default template. 3. Set the template Login Type to "Web Suite" and Apply Template. Link users with multiple templates can log into EpicCare Link even without the Web Suite login type. However, it is best practice to still include it as there could potentially be problems if there are multiple templates that are valid for EpicCare Link. 4. Open Template and Accept the most recent contact of the record. If you'd like to learn more about provisioning multiple linkable templates, read the Provision Linkable Templates to Users topic of the Using Templates to Create and Maintain User Records Setup and Support Guide. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 28 ECL500v EpicCare Link  User Provisioning 2 10 Follow Along: Configure a User Template Record Enable Access to Hyperspace Web Embedded Activities Certain activities in web applications have been migrated to Hyperspace Web. For Link users to be able to access Hyperspace‐based activities, you need to give them a role ﴾E2R﴿ record. You can assign any user role to Link users because none of the user role settings affect what Link users can do in EpicCare Link. The purpose of the user role for Link users is to ensure that they can access Hyperspace‐based activities. Epic created user role 1100000001‐Link Dashboard User in the Foundation System for this purpose. 1. Open the User Roles form. 2. In the Default user roles field, add the "Link Dashboard User" role record. Prevent Link Users from Logging into Hyperspace 1. Open the Web Suite form. You may have to scroll down on the left navigation pane. 2. Set the Healthy Planet Link, EpicCare Link, and Tapestry Link access type to "Managed". Managed access means that the user will have a limited, time‐sensitive list of patients to choose from. We will configure managed access in the next chapter. 3. Use the CTRL+CLICK keystroke to read the help text for the Community‐only user? field. Write It Down For Link users, what is the appropriate value for this field? 1‐Yes 4. Set Community‐only user? field to "Yes". The Community‐only user? ﴾EMP 40040﴿ item determines whether a user can log in to Hyperspace. If set to Yes, a user will not be able to log in to Hyperspace. If set to No, a user can log in to all applications allowed by build. You cannot leave this field blank. It must be set to either 1‐Yes or 0‐No in order for the user to log into EpicCare Link. 5. Set the User license type to "Affiliate". This field enables you to track the type of user accessing the chart – an affiliate user or a EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 ECL500v EpicCare Link 29  2 11 User Provisioning test user. Enter Affiliate unless this is a test user. Assign Web Suite and EpicCare Security Classes EpicCare Link has a dual‐layer system that consists of both Web Suite and EpicCare security classes. The combination of these two records works to define the specific activities that users in your facility can access in your web application. While many of the Web Suite security points overlap in function with the EpicCare security points, the numbers for these keys are different, and not all keys are available for both security types. Also, a few EpicCare security points, such as 1‐Patient Search/Select, are necessary for EpicCare Link but not for EpicCare Ambulatory. Depending on the security points in the Web Suite security class, a user might or might not be allowed to access certain functionality. You can define a Web Suite security class unique to each user, assign all users with a similar role to one Web Suite security class via the user template, or any other scheme. In this exercise, we will assign the Web Suite and EpicCare security classes in the user template. Once the access type is set to managed, you can now assign an appropriate Web Suite security class to the user template. 1. Enter "TRN## Link Physician" [911000##] in the Security class field in the Web Suite form. This will allow Dr. Randy to access all the activities appropriate for his role in EpicCare Link. Starting in November 2023, users lacking a web suite security class are treated as if they lack all web suite security options. In August 2023 and earlier versions, a user who is not assigned to a web suite user class can perform all of the actions available in the web application that her other application security classes allow. The "TRN## Link Physician" Web Suite security class we use in training is a duplicate of the Foundation System record "Link Physician " Web Suite security class. For a list of Foundation System security classifications, the security points they contain, and details about individual user and template records, refer to the Users and Security Matrix on Galaxy. 2. Open the EpicCare form. You may have to scroll up on the left navigation pane. 3. Enter "Link Staff with Edit" in the Default security class field. This is a Foundation System EpicCare security class that will be filtered by the "TRN## Link Physician" Web Suite security class. 4. Click Finish twice to close all open records. When you are prompted, click Save to accept the changes. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 30 ECL500v EpicCare Link  User Provisioning 2 12 You can learn more about the dual‐layer system in the Set Up Web Suite User Classes topic of the EpicCare Link and Tapestry Link Users Setup and Support Guide. Beyond the Basics: Additional Security Classifications for Link Users Security classes grant users access to functionality in EpicCare Link. In addition to the Web Suite and EpicCare security classes, users might need other security classes specified for certain features. These security classes might include ﴾but are not limited to﴿ the following: In Basket security Cadence security Referrals security Identity security Shared security Care Everywhere security Inpatient ﴾less common﴿ To view a list of security points for each of the above‐listed security types, view the Epic Security Point Dictionary on Galaxy. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 ECL500v EpicCare Link 31  2 13 User Provisioning Exercise 1: Troubleshoot a Web Suite Security Class Part 1: Adjust the Security Class While testing the required build for Dr. Randy's user record, you noticed that he has no access to the Patient List activity, and he cannot search for patients. Upon consulting the Epic Security Point Dictionary on Galaxy, you find that you need to add Web Suite security points 38, 42, and 172. 1. Still logged in to Classic as your Tony builder ﴾2014##﴿, click Web Suite > Web Suite Security on the top toolbar. 2. Open the Web Suite security class assigned to Dr. Randy's user template record: "TRN## Link Physician" [911000##]. The changes made in TRN## Link Physician Web Suite security class will affect all users assigned with this record. 3. Search for security points "42" and "172" using the key phrase "patient list." 4. Toggle these security points to Yes by clicking the No button. 5. Search for security point "38" using the number. 6. Toggle this security point to Yes by clicking the No button. 7. Accept the changes. Part 2: Test Your Changes For security changes to take effect, a user needs to log out and log back in again. 1. If you are currently logged in to an active EpicCare Link session, click Log Out on the top right corner of your screen. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 32 ECL500v EpicCare Link  User Provisioning 2 14 2. Log in to EpicCare Link as your Randy Link physician ﴾2011##﴿. 3. You should be able to see the Patient List activity at the top of your screen. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 ECL500v EpicCare Link 33  2 15 User Provisioning After‐Class Exercise 2: Review Provider Record Settings In this exercise, you will review some of the key items that can be configured for providers working in EpicCare Link. A Link user will need a provider record if they give or receive referrals, are scheduled with patients, can authorize orders, and should be granted access to patient records. In this exercise, you will review how you can ensure that Link providers can authorize orders. 1. Log in to Text as your Tony builder ﴾2014##﴿. 2. Open the most recent contact of Dr. Randy's provider ﴾SER﴿ record ﴾2011##﴿. Follow this path: EpicCare Link > Clinical Admin Menu > Users, Providers > Providers 3. The Provider Information screen stores demographic information about this provider and the type of provider this user is. 4. Use the SHIFT+F5 help text keystroke to explore these three items and take notes on what they control: Item Purpose Scheduling Type Determines the record type of the SER record Ref Src Type Determines the referral source type of the provider Internal/External? Determines whether the provider/resource is internal or external to the facility 5. PAGE DOWN to the Credentials and Certifications screen. Write It Down If you want Dr. Randy's credentials to display when he documents in a patient chart, where should you define that setting? In the License for display field EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 34 ECL500v EpicCare Link  User Provisioning 2 16 6. Take a few minutes to review the following screenshot: Write It Down If you need to allow a Link provider to authorize orders, what setting should be set to Yes? Procs Authorizing Provider (I SER 8220) only. Medication orders are not supported in EpicCare Link, so Meds Authorizing Provider? should be set to "No" or left blank since the default value for this item is "No". If you need to allow a Link provider to be entered as an ordering provider for outpatient orders, what setting should be set to Yes? Outpatient Ordering Provider (I SER 34921). Depending on your specific use cases for EpicCare Link, you may find that providers need different settings in their SER record. Consider building a Provider Blueprint to quickly apply pre‐determined values to provider records. Reference the Provider/Resource ﴾SER﴿ Master File Setup and Support Guide on Galaxy for instructions on making a provider blueprint. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 ECL500v EpicCare Link 35  2 17 User Provisioning Two‐Factor Authentication ﴾2FA﴿ To implement an additional layer of security when logging in, EpicCare Link can utilize two‐factor authentication ﴾2FA﴿. If your organization is using 2FA, that means Link users need to enter their ID and password to log in, in addition to a one‐time randomly generated passcode. Each time a Link user logs in, they will be sent a new randomly generated code to the activation method of their choosing. This means that even if a malicious user got a hold of someone's login ID and password, they still could not access EpicCare Link without the authentication code. EpicCare Link currently supports authentication via mobile app, third‐party SMS vendor, and email. When users log in for the first time after two‐factor authentication is enabled, they are prompted to choose their preferred authentication method. After setting up their authentication method, they will be prompted to enter the passcode sent to them. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 36 ECL500v EpicCare Link  User Provisioning 2 18 They will also receive a one‐time reset code that they can use only if they need to change how they receive passcodes. This is NOT the code they will enter the next time they attempt to log in to EpicCare Link. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 ECL500v EpicCare Link 37  2 19 User Provisioning If they lose their reset code, an administrator with the appropriate security can reset two‐factor authentication settings from the Auth Settings form in the User Security activity in Classic. Administrators can also see the user's phone number or email address used for two‐factor authentication. This information might be helpful in troubleshooting why a user isn't receiving passcodes. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 38 ECL500v EpicCare Link  User Provisioning 2 20 Two‐Factor Authentication settings can be made in EpicCare Link/Tapestry Link System Definitions ﴾WSD﴿ on the Two Factor Authentication screen. Starting on November 2023, item 54000 in WSD will be automatically set to Yes to enable 2FA for EpicCare Link. Read the Use Two‐Factor Authentication in Web Applications topic in the EpicCare Link and Tapestry Link Users Setup and Support Guide for more information. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 ECL500v EpicCare Link 39  2 21 User Provisioning Reviewing the Chapter Review Questions 1. True or False: Web Suite security points can filter the access provided to a user through the EpicCare security class. 2. A builder opens the Web Suite form of the User Template but finds that some fields cannot be edited. List one reason why the fields are not editable. 3. What access type do you enter in a user template to give users access only to patients with whom a relationship has been established? a. Full b. Restricted c. Secure d. Managed 4. True or False: You should intentionally leave an EpicCare Link user's role record blank to prevent them from logging in to Hyperspace. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 40 ECL500v EpicCare Link  User Provisioning 2 22 Review Key 1. True or False: Web Suite security points can filter the access provided to a user through the EpicCare security class. True. 2. A builder opens the Web Suite form of the User Template but finds that some fields cannot be edited. List one reason why the fields are not editable. The builder must first assign an Access type before they can edit the Web Suite form. 3. What access type do you enter in a user template to give users access only to patients with whom a relationship has been established? a. Full b. Restricted c. Secure d. Managed D. Managed. 4. True or False: You should intentionally leave an EpicCare Link user's role record blank to prevent them from logging in to Hyperspace. False. If the user needs access to Hyperspace web embedded activities ‐ like Patient Search and Event Settings ‐ that user will need a role record. To prevent a user from logging in to Hyperspace, enter "Yes" in the Community‐Only User field of the Web Suite form. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 ECL500v EpicCare Link 41  2 23 User Provisioning Study Checklist Make sure you can define the following key terms: ☐ User ﴾EMP﴿ record ☐ User Template ﴾EMP﴿ record ☐ Provider ﴾SER﴿ record ☐ Role ﴾E2R﴿ record ☐ EpicCare security class ﴾ECL﴿ record ☐ EpicCare security points ☐ Web Suite security class ﴾ECL﴿ record ☐ Web Suite security points ☐ Managed access Make sure you can perform the following tasks: ☐ Configure unique settings in the user record ☐ Assign a Web Suite security class to the user template record ☐ Assign an EpicCare security class to the user template record Make sure you fully understand and can explain the following concepts: ☐ How to enable access to Hyperspace web embedded activities in EpicCare Link ☐ How to prevent Link users from logging into Hyperspace ☐ How dual classification system works in web applications like EpicCare Link ☐ How to configure provider ﴾SER﴿ records so that Link providers can be authorizing providers EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 42 ECL500v EpicCare Link  Managed Access 3 1 Managed Access Full vs. Managed Access 3 4 Overview of Managed Access 3 5 Managed Access Record Structure Diagram 3 6 Create User Context Value, Provider Group, and 3 7 Patient Group Instructor Demo: Create a New User Context Value 3 7 Follow Along: Build a Provider Group 3 9 Follow Along: Build a Patient Group 3 10 Follow Along: Connect Patient and Provider Groups to a User Record 3 11 Test Your Build 3 11 Exercise 1: Enable Delegate Users Managed Access to 3 12 Patient Records View Reports to Troubleshoot Managed Access 3 13 Setup New Account Request and Site Wizard Workflow 3 14 Follow Along: Submit New Account Request in EpicCare Link as Link 3 14 Site Administrator Follow Along: Approve Request in Classic as Hyperspace Administrator 3 15 Follow Along: Review Settings in the User Record Generated by Site 3 17 Wizard EpicCare Link and Tapestry Link System Definitions 3 18 ﴾WSD﴿ Instructor Demo: Access WSD and Explore New Account Request 1 3 18 Screen EpicCare Link Facility Structure 3 19 EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 ECL500v EpicCare Link 43  3 2 Managed Access Self‐Study: Strategies for Granting Managed Access 3 21 to Patient Charts Reviewing the Chapter 3 22 EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 44 ECL500v EpicCare Link 3 3 45 ECL500v EpicCare Link Managed Access EpicUUID: 3F9F131A-D327-4D88-B530-782891619639  3 4 Managed Access Full vs. Managed Access EpicCare Link is one of Epic's many interoperability platforms, because it allows you to share patient data with affiliate organizations and clinics. Your Epic organization can manage the data that affiliate users have access to through the secure web portal by defining an access type ﴾I EMP 22000﴿ in a user record. If you want your user to have unrestricted access to all patients within your Epic organization, set the access type to "Full". For most Link users, however, they only need to access the charts of patients with whom they or one of their associated providers have a relationship. To protect the rest of your Epic organization's patients' charts from unauthorized access, set the Link user's access type to "Managed". After you give Link users managed access, there are various ways to gain access to patients' charts: Manually add patient records to patient groups ﴾will be covered in this chapter﴿ Automatically add patient records to patient groups via events that trigger a grant access extension ﴾will be covered in Chapter 5 Grant Access﴿ One example of an event that triggers grant access is first access – accessing a patient record for the first time ﴾will be covered in Chapter 6 First Access﴿ In this chapter, we will explore the records you need to configure the managed access framework. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 46 ECL500v EpicCare Link  Managed Access 3 5 Overview of Managed Access This training assumes prior knowledge of a category list, a standard list of values for a specific item. If you need a refresher on what category lists are used for, watch the Category Lists [GEN605] e‐learning lesson and review the Homework: Data Types and Category Lists chapter of CLN251‐252 Configuring the Epic End User Clinical/Shared training companion. Defining managed access is the process of defining relationships in your system. In order to know what patient chart access would be appropriate for a given user, we need to understand the relationships that a user may have with patients in the system. To configure managed access, you need the following: User ﴾EMP﴿ Patient group ﴾PGP﴿ A list of patients that you can associate with users at your organization. When a user is associated with a patient group, they can access the record of each patient in that group. In a clinical setting, note that users are not necessarily providers. Nurses, technicians, and front desk staff, for example, can also be set up as users and can then gain access to patients through patient groups. Provider group ﴾PGP﴿ A group of providers who are related to each other. For example, all providers who practice in one affiliated clinic can be in one provider group. When a provider group is linked to a shared patient group, patients are added to the patient group through automatic grant access when an event occurs with a provider in the linked provider group. User context value The user context value listed in the user context category list connects all three records to one another and helps identify which groups need the same managed access to patient charts. The user context category list is category‐data‐type item 22210 in the PGP master file ﴾I PGP 22210﴿ and can be opened via Category List Maintenance activity. Here is how the system determines which patient charts to display to a Link user: 1. The user logs in to EpicCare Link. 2. The system checks the user record for the user context. 3. The system creates a list of all of the patient groups that also have that user context. 4. The system loads all of the patients in those patient groups to the user's patient list. 5. The user accesses the patient charts in the Patient List activity. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 ECL500v EpicCare Link 47  3 6 Managed Access Managed Access Record Structure Diagram EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 48 ECL500v EpicCare Link  Managed Access 3 7 Create User Context Value, Provider Group, and Patient Group Building the provider and patient group records and connecting them to a user record will allow a Link user to view their list of managed access patients. Dr. Randy is a physician who works at your TRN## Badger Clinic, and therefore should have access to all of the patients being seen there. Rather than maintaining this list manually, you will give Dr. Randy the appropriate access using patient groups. For managed access to work correctly, all three records — provider group, patient group, and user records — must have the same user context value listed. Instructor Demo: Create a New User Context Value Watch as your instructor opens up the user context category list ﴾I PGP 22210﴿. Since only one person can access this list at a time, copies of user context values have already been created for your use in class. 1. In Classic, your instructor will go to the Category List Maintenance activity to open up the user context category list. Database: PGP Item: 22210 If you wanted to add a value in this category list item, you would... 1. Click Add New Category. 2. Fill out the required fields and click Pend. Be sure to use the same naming conventions for your user context, provider group, and patient group so that the records are easier to find later. Click Accept to finalize all pending changes to the category list. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 ECL500v EpicCare Link 49  3 8 Managed Access 2. Watch as your instructor closes the Category List Maintenance activity. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 50 ECL500v EpicCare Link  Managed Access 3 9 Follow Along: Build a Provider Group 1. Still logged in to Classic as your Tony builder ﴾2014##﴿, click Web Suite > Provider Group on the top toolbar. 2. On the Create tab, name your group "TRN## Badger Clinic ‐ Provider". 3. Give your provider group a user‐friendly display name. For training purposes, simply copy the record name. End users like site administrators will see this name. 4. Enter your "TRN## Badger Clinic" user context value in the User contexts field. This user context value connects user records to this provider group. 5. On the Providers tab, use the Add Provider button to list your Randy Link physician ﴾2011##﴿. 6. Confirm that the Restricted? item is set to "No". For grant access to work in the following chapter, the provider must have "No" listed in the Restricted? column. 7. Save your provider group to keep the Web Suite Admin workspace open. Write It Down What happens when you try adding Rae Link nurse's user record ﴾2015##﴿? The system will not find a matching provider/resource record. User records cannot be linked to a provider group. You can learn more about features of EpicCare Link where provider groups are used in the Group Related Providers to Grant Access topic of the Managed Access Setup and Support Guide. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 ECL500v EpicCare Link 51  3 10 Managed Access Follow Along: Build a Patient Group Shared patient groups are based on relationships in the system, and it can be populated automatically by a process called grant access. We will explore the grant access process in the next chapter. For now, we will manually populate our patient group for testing. 1. Open the Patient Group editor from the Web Suite Admin workspace ﴾labeled A in the screenshot below﴿. You can also open the Patient Group editor from the Web Suite menu on the top toolbar ﴾labeled B﴿. 2. Create a new patient group: "TRN## Badger Clinic ‐ Patient." 3. Give your patient group a user‐friendly display name. For training purposes, simply copy the record name. 4. Enter your "TRN## Badger Clinic" user context value in the User contexts field. 5. On the Tags tab, specify your provider group: "TRN## Badger Clinic ‐ Provider". The user context value connects user records to this patient group. 6. Open the Patients tab and use the Add Patient button to list the following patient ﴾EPT﴿ records in your patient group: Nepal, Michelle , Leroy Refer to your assigned class information for your training last name. 7. Click Accept twice to save your build and to close your patient and provider group records. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 52 ECL500v EpicCare Link  Managed Access 3 11 Write It Down If we log in to EpicCare Link now as Dr. Randy, will we have access to Michelle's chart? No, because the user context value is not listed in Dr. Randy's user record yet. Follow Along: Connect Patient and Provider Groups to a User Record If you do not list a user context value in a user record with managed access to EpicCare Link, they will not be able to view patient charts. A user can have one or multiple patient groups depending on the patients they need access to, so you can list multiple user context values in a single user record. 1. On the top toolbar, click User Security and open your Randy Link physician's user record ﴾2011##﴿. 2. Accept the most recent contact. 3. Expand the Web Suite form and select the Managed Access subform. 4. Enter "TRN## Badger Clinic" in the User contexts field. 5. Click Finish to save your changes. Test Your Build 1. Log in to EpicCare Link as your Randy Link physician ﴾2011##﴿. 2. Go to the Patient List activity. You should see Michelle Nepal and your Leroy patient on your list of available patients. 3. Log Out of EpicCare Link. To fully configure managed access, confirm that your users have the Web Suite security point 82 ‐ Managed Access. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 ECL500v EpicCare Link 53  3 12 Managed Access Exercise 1: Enable Delegate Users Managed Access to Patient Records Rae is a nurse in your TRN## Badger Clinic. She works closely with Dr. Randy to provide patient care, so she needs access to patients seen at this Link site. However, Nurse Rae does not have any patients in her Patient List activity. After investigating her user record, you discover that her user record is missing the same user context value as the patient group connected to Dr. Randy's user record. 1. Still logged in to Classic as your Tony builder ﴾2014##﴿, click User Security on the top toolbar. 2. Open your Rae Link nurse's user record ﴾2015##﴿ and Accept the most recent contact. 3. Expand the Web Suite form and select the Managed Access subform. 4. Enter "TRN## Badger Clinic" in the User contexts field. By listing the same user context value in this field, Nurse Rae can access the same patients available to Dr. Randy. 5. Click Finish to save your changes. 6. Log in to EpicCare Link as your Rae Link nurse ﴾2015##﴿. 7. Go to the Patient List activity and confirm that Michelle and Leroy are on your list of available patients. 8. Log Out of EpicCare Link. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 54 ECL500v EpicCare Link  Managed Access 3 13 View Reports to Troubleshoot Managed Access Setup You can See Which Patient Groups a Patient Belongs To using the Patient Report. This report shows collapsible sections for each patient group. Within each group, you can see information for current, expired, and future access to the patient. You can also See Which Provider Groups a Provider Belongs To using the Provider Report. A community provider who works at multiple sites might stop working at one of those sites. You can use this report to see every provider group that the provider is a part of to verify that it's appropriate for them to still be a part of all those groups. You can learn more information about other types of reports in the View Reports of Managed Access Setup topic of the Managed Access Setup and Support Guide. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 ECL500v EpicCare Link 55  3 14 Managed Access New Account Request and Site Wizard Workflow As your network of community organizations using EpicCare Link grows, you will need to create accounts for new sites and users requesting access to your web application. To help you manage those requests and create those accounts efficiently, you can utilize the New Account Request and Site Wizard workflow. Typically, you will create a new site first before you create multiple new user records for that Link site. For training purposes, we will skip the new site creation process, and you will use the existing TRN## Badger Clinic department as your Link site. 1. New account request is submitted by a Link site administrator on someone else's behalf. New Link users can also directly request a new account without logging in to EpicCare Link. 2. In Basket message containing the request is sent to the appropriate pool ﴾of Hyperspace administrators﴿ for triage. 3. Using Site Wizard, the request is approved or denied by the Hyperspace administrator. Follow Along: Submit New Account Request in EpicCare Link as Link Site Administrator Kelsey is the Link site administrator for your TRN## Badger Clinic. She knows that a new nurse, Christine, is going to start work in a few weeks. To prepare for the arrival of this new user, Kelsey wants to make sure Christine can log in to EpicCare Link, so she submits a new account request. 1. Log in to EpicCare Link as your Kelsey Link site administrator ﴾2013##﴿. 2. In the Admin tab, select Account Requests and then click on Request New Account. 3. Choose Clinical Staff to request access for a new clinical staff member with the following details: First Name: "Christine" Last Name: Refer to your assigned class information for your training last name. Work email: "[email protected]" User group: "TRN## Badger Clinic" Selecting a User group associates the new Link user, Christine, with all PGP groups that contain the TRN## Badger Clinic user context value. Only user context values connected to the Link site administrator's ﴾Kelsey's﴿ user record will be available in the drop‐down list of the User group field. Address: "1979 Milky Way" EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 56 ECL500v EpicCare Link  Managed Access 3 15 City ﴾or ZIP﴿: "53593" Notice that the State, ZIP, County, and Country fields are automatically filled in. Provider name: "Randy " This Provider name field does not actually link to a provider ﴾SER﴿ or user ﴾EMP﴿ record. It is a free text field that will be visible to Hyperspace administrators in the Site Wizard and helps determine which groups the new user should be included in. Don't forget to click Add. Comment: "New nurse at the clinic" 4. Submit Request and click OK to return to Account Requests activity. Refer to the New Account Request and Site Wizard Setup and Support Guide to learn more about other settings, such as determining required and recommended fields, as well as including questionnaires and allowing file attachments. Follow Along: Approve Request in Classic as Hyperspace Administrator Tony is a Hyperspace administrator who is part of the Link New User Request Pool. After reading the New Account Request In Basket message from Kelsey, the Link site administrator for TRN## Badger Clinic, Tony decides to approve the request using Site Wizard to automatically generate a user record with the appropriate settings for the new nurse, Christine. 1. Still logged in to Classic as your Tony builder ﴾2014##﴿, find your request in the New Account Request folder of In Basket. In Basket should be your default startup activity. Tip: Don't see your message? Refresh In Basket ﴾ALT+E﴿. Tip: Click the Sent By column header to sort the messages by the name of your Kelsey Link site administrator. 2. Once you have located your message, select it and launch the Site Wizard. 3. Confirm the details of the Existing Department. The Default login department should be "TRN## BADGER CLINIC." 4. Go to the Users tab and confirm that New User is selected under User Information section. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 ECL500v EpicCare Link 57  3 16 Managed Access The Provider Information section is where you can link a provider ﴾SER﴿ record for an existing provider or link a provider template blueprint for a new provider. Since Christine does not need an SER record as a delegate user, this section is grayed out. 5. Approve the request. 6. Go to the Groups tab. Notice that your new user is already connected to your TRN## Badger Clinic PGP records for managed access. Because the Link site administrator selected an existing user group in the new account request process, the system looked for PGPs with a matching user context and associated the new user with those groups. User context value and PGP records are automatically connected to a user record for managed access. 7. Go to the Summary tab. Notice the Site Wizard Processing Instructions report on the right. This report can be customized with instructions, hyperlinks, and SmartTexts to provide your analysts with further instructions on how to complete the Site Wizard workflow. 8. Generate Records and click Yes then OK to confirm record generation. You don't have to manually mark the message as Done. You can set up a nightly batch job to automate this process. Steps to configure a batch job to mark In Basket messages as done, generate passwords, and print activation letters for new users can be found in the Automate New Account Communication topic of the New Account Request and Site Wizard Setup and Support Guide. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 58 ECL500v EpicCare Link  Managed Access 3 17 Follow Along: Review Settings in the User Record Generated by Site Wizard 1. Click the User ID link to open the user ﴾EMP﴿ record you just created. 2. Under the Template Linking Information section in Snapshot, notice that the appropriate user template "Link Clinical Support Staff Template" is assigned to Christine's user record. To change the user template in a user record, go to the Linked Templates form. 3. Scroll down to the Web Suite Security section in Snapshot, verify that the appropriate user context value "TRN## Badger Clinic" is listed in your Christine's EMP record. To change the user context value in a user record, expand the Web Suite form and open the Managed Access subform. 4. Click Finish to close Christine's user record and click X to close the Site Wizard workspace. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 ECL500v EpicCare Link 59  3 18 Managed Access EpicCare Link and Tapestry Link System Definitions ﴾WSD﴿ The system was able to automatically create Christine's user record assigned with the appropriate user template ﴾which contains shared settings like role and security classifications﴿ because of settings that the instructor will show you in EpicCare Link and Tapestry Link System Definitions ﴾WSD﴿. Any organization‐ wide EpicCare Link settings you need to configure will be defined in WSD. Only one person can access WSD at a time, so please do not complete any instructor demos during class. To avoid interfering with other trainees' work, DO NOT change any settings in WSD in any training environments. If the settings in WSD do not match what you expect, email [email protected] with the name of your environment. Instructor Demo: Access WSD and Explore New Account Request 1 Screen To set up New Account Request in EpicCare Link, you must specify the user template that you want to assign to each user request type. This enables the Site Wizard to automatically create new user records with the appropriate settings when the Hyperspace administrator approves the request. These user templates must be defined in the New Account Request 1 screen of EpicCare Link and Tapestry Link System Definitions ﴾WSD﴿. In the New Account Request 1 screen, you can list the user templates you want to use for each corresponding account request type ﴾Req Type column in the screenshot﴿ under the User Request Options table. To open this screen in a study environment, follow this path in Text: EpicCare Link > EpicCare Link and Tapestry Link > New Account Request 1 (fast forward to screen 31050 to get there faster) EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 60 ECL500v EpicCare Link  Managed Access 3 19 User Request Options table in the New Account Request 1 screen in WSD Note that the LINK SITE ADMINISTRATOR TEMPLATE in the Admin Template column in the screenshot is also applied to a user record if the person submitting the request selects the Make this user a site administrator check box in the New Account Request form in EpicCare Link. Make this user a site administrator check box EpicCare Link Facility Structure Epic strongly recommends that each community site has its own login department ﴾DEP﴿ linked to a patient group ﴾PGP﴿, place of service ﴾EAF﴿, and user context ﴾I EMP 22210﴿ in a 1:1:1:1 ratio. The benefits of this setup include: Easier provisioning and maintenance of community sites and users. Avoiding duplicate site records, which is especially important for maintaining appropriate Managed Access to patient charts. Easier sending of referrals to EpicCare Link sites. Access to reporting on each of your sites with department‐level reporting. More ordering customization, including department‐level preference lists and the ability to associate orders with a specific department. EpicUUID: 3F9F131A-D327-4D88-B530-782891619639 ECL500v EpicCare Link