Managing access. Access to confidential data is secured by the SSO service. The way in which this service allows or blocks an action on an OpenTox web service is specified by the policy for the underlying resource. A policy over a 47 HTTP Status code 401 – Unauthorized: xxxx://xxx.x0.xxx/Protocols/rfc2616/rfc2616- sec10.html#sec10.4.2 resource (identified by its URI) defines to whom access is granted (Figure 22). The authorization policies for the central SSO server are defined by the creator of each resource. SSO policies specify restrictions on the REST level48 and with respect to some HTTP method. These restrictions apply either on individual users or on groups. From a programmatic point of view, a policy here is implemented as an XML file specifying explicitly to whom access is allowed and under which conditions. This way a policy defines rules that specify who or what can access these protected resources. The rules are, in effect, permissions describing when and how a user can perform an action on a given protected resource. A user can be an individual or a group. In general, the permissions define what a user can do to which resource and under what conditions. For OpenTox, we provide a Policy Configuration Service (PCS) to define such preferences and manage the policies. The service allows any registered user to define, modify, and revoke permissions on specific resources (URIs). After creation, only the resource owner (the user who created it) can alter the policy.
Managing access a. Outside Entity shall notify CCHS of the identity of and contact information for Outside Entity’s Privacy Officer and shall update such information as soon as practicable in the event of any change. Outside Entity shall also designate and provide contact information for a liaison to coordinate addition or removal of Authorized Users. The liaison is responsible for managing the addition, modification and termination of ccLink Provider Portal access by employees and agents of Outside Entity.
b. Before accessing ccLink Provider Portal for the first time, each Authorized User must acknowledge agreement with the ccLink Provider Portal Terms and Conditions as in effect at the time of first access. Such Terms and Conditions are subject to change at any time in the sole discretion of CCHS. By accessing ccLink Provider Portal, each Authorized User agrees to be bound by the Terms and Conditions as amended. Outside Entity agrees to ensure that each Authorized User approved for access under this Agreement adheres to the requirements of this Agreement, the Terms and Conditions and any applicable policies and procedures and agrees that a breach thereof by any Authorized User shall constitute a breach of this Agreement by Outside Entity. Outside Entity shall cause each Authorized User to complete appropriate training on the use of ccLInk Provider Portal and the proper use and disclosure of patient information obtained through ccLink Provider Portal.
c. Access to ccLink Provider Portal shall be provided to those contractors, agents and members of the Workforce of Outside Entity who require access to patient information of the type which may be obtained through ccLInk Provider Portal to perform their duties to the Outside Entity and its patients. A complete list of Authorized Users through Outside Entity is attached hereto as Exhibit A, which list shall be updated as necessary to add or delete Authorized Users upon written notice by Outside Entity. Outside Entity shall notify CCHS in writing as soon as practicable, but no later than seventy-two (72) hours in advance of any Authorized User’s separation from Outside Entity or change in job functions such that he or she no longer requires access to ccLink Portal to perform his or her duties for or on behalf of Outside Entity. In the event that Outside Entity elects to terminate the employment, contract, or other arrangement with a contractor, agent, or member of its Workforce who is an Authorized User, Outside Entity shall ...
