Reserved for administrators: menu Users & access > Restricted data domains.
Some modules declare restricted domains: categories of data (a health record, medical results…) that only designated people can read. For each domain, you designate the groups involved here. You configure without reading: being an administrator does not give access to the data of a domain.
Reader groups
Enter the codes of the groups whose members read the domain, separated by commas. A domain without a reader group can be read by nobody. Administrators are not readers unless they belong to one of these groups.
Groups allowed to break the glass
The members of these groups can open an emergency access to the domain: for a limited time, with a reason, and under the control of the readers. See the Emergency access page.
Groups that cannot be designated
- an administration group (ADMINS, or a group that grants administration rights): an administrator does not designate themselves as a reader;
- a group that does not exist;
- a group synchronized from a directory: its members join it without going through the two-person approval.
Two-person approval
A change to the groups of a domain is not applied right away: it becomes a request, which a second administrator approves. Likewise, adding an account to a reader group or a group allowed to break the glass (from the group page) creates a request: the account joins the group only once it is approved. You cannot add yourself to one of these groups.
The Requests to approve link opens the list of requests. The approver is neither the requester nor the account added; any administrator can reject, with a comment. A request expires after 72 hours.
On an instance with a single administrator, the host can set the "alert only" mode: the change is then immediate, still recorded and alerted.
What is recorded
Every request, approval, rejection and change to the groups of a domain is recorded in the audit log with your name, and raises a security alert.