How is patient information protected in OpenMRS? How does OpenMRS prevent hackers or false providers?
Hi Lauren,
This is a very broad question, that cannot be answered in isolation.
OpenMRS is a java application, it has certain roles and restrictions. All data goes to a database. Most pages require authentication.
It’s up to the people installing (and implementers) it to add network security, encryption, processes to register new staff/users, backups, and all that comes with hosting a service.
What exactly are you interested here?
1 Like
Which pages require authentication? Also, how do you authenticate providers onboarding onto the EHR? Thanks for helping me out on these crucial questions.
Hi @laurenmy,
There’s almost nothing one can do without authentication in OpenMRS. The login page is accessible without authentication. Perhaps a couple of setup pages as well. Patient data however is not accessible outside of authentication.
OpenMRS comes with its own authentication mechanism by managing users and (hashed) password in its database.
However, in enterprise setups it might be preferable to delegate this to an authentication provider using OAuth2 or OpenID Connect. In that case all pages, even the login page, are filtered out outside of authentication.
Not sure if it’s clear, but by there’s no default way to self sign-up (check OpenMRS reference application demo or Bahmni demo)
So, if your clinic or hospital that uses OpenMRS, during your onboarding someone will create you an user. If it’s a national program, I assume the government has ways to verify doctors before creating users to them.
It’s not we authenticate providers to the EHR, there’s somehow a process for someone with admin access to create user to the trusted provider. If you are using SSO (OAuth2/OpenID), that database is the source of truth and you should know how to ensure users are trusted before being added.
This is currently not done yet (I think), but it would be possible to develop something to achieve self-signup when using OAuth2. So again, the self-signup process would be delegated somewhere else outside of OpenMRS.
For example I’m sure it’s possible to configure Keycloak to handle a self-registration process. And Keycloak can be used as an auth provider through OAuth 2 (see the OAuth 2 Login module.)
@laurenmy is that something your org would like to pursue with OpenMRS?
A self-registration process would be especially necessary if anyone ever wanted to implement giving patients access to their data stored in an OpenMRS system. I know that’s not a pressing demand for most of our implementers, however.
And, yes Keycloak supports user registration, and with a bit of code and configuration, you can make them jump through whatever hoops you want to do so.
That said, self-registration for providers working on an EHR strikes me as generally a bad practice.
1 Like
Thank you, this is incredibly insightful. We are definitely going to look into this type of addition.
Best, Laurenmy