[Uganda project - Technoforte team] - Restrict Health Facility Administrator Access Based on Assigned Hospital

[Abhay-Dev-Gautam]

Summary

Restrict Health Facility Administrator Access Based on Assigned Hospital

---

Current Observation

Currently, when two Health Facility Administrator users are created for different hospitals but belong to the same administrative location, applications created by one hospital administrator are visible to the other hospital administrator.

Example:

• Hospital Administrator A → Assigned to Hospital A
• Hospital Administrator B → Assigned to Hospital B
• Both belong to the same location hierarchy

If Administrator A creates an application for Hospital A, Administrator B is also able to view the same application, even though they belong to a different hospital.

---

Expected Behaviour

Applications created under a specific hospital should only be accessible to users assigned to that hospital.

• A Hospital Administrator should only:

  • View applications related to their assigned hospital
  • Process applications belonging to their assigned hospital

• Applications created for one hospital should not be visible to administrators of another hospital, even if both hospitals belong to the same administrative location.

[euanmillar]

@Abhay-Dev-Gautam thanks for raising this. @Zangetsu101 can you investigate and let us know if you can reproduce and what the issue may be please? Thanks. :-)

[euanmillar]

@Abhay-Dev-Gautam if I remember what we achieved in the fork, it was that users are still located in a crvs office as far as the internal workings of OpenCRVS are concerned. They are just additionally marked as linked to a health facility. So we cant stop them from viewing records created in the same crvs office. Only 2.0 treats health facilities like individual offices. FYI @prinzab .

[euanmillar]

In our fork, we can stop users from one health facility from selecting another place of birth. We should check in 1.9 that health facility users can only view records created from another hospital, not make any edit to them. FYI @prinzab @Zangetsu101

[euanmillar]

@Abhay-Dev-Gautam These users do not have edit scope. There is no operational problem of a user editing a record from another hospital.