Ces informations ne sont disponibles qu'en anglais. Pour des raisons de cohérence linguistique au sein de la navigation du projet, les titres des composants respectifs ont été traduits en néerlandais et en français. Veuillez sélectionner le bouton de langue EN dans le coin supérieur droit de votre écran, lorsque vous êtes encore dans l'environnement NL ou FR.

Before starting a new data collection based on stable data of another data collection, you need to finalize the data collection which serves as the starting point of your new data collection cf. article "Finalize the data collection"

To start the new data collection select the new version in the Data collection section. In this case v3. 

Click the button "Go to the participation page":

• Click on ‘Participate’:

• The Start date in the Participation status will be updated and access to the new version is completed and the user can return to the Data Collection section:

• Once the previous data collection is finalized and the new one has been started, you can download data from the first version and add those to the next version. 

• Go to the Registrations tab:

• Download the data by using the Download button "CSV Download All (Stable Data)":

When everything is downloaded, you can start uploading by Using the upload center.

To give access to the applications of healthdata.be (like HD4DP v2 and healthstat.be), you need to click on GIVE ACCESS in the white text box on the EAM portal page.

You can give access to

• a single user
• multiple users in batch

Give access to a single user

After selection of GIVE ACCESS on the EAM portal page, an ACCESS REQUEST form is shown.

Completing this form is similar to the process on the Request Access page for standard end-users. In the capacity of a SPOC, however, you will now fill in an Access Request form for a user within your organization.

Please fill in all required fields (indicated with a red asterisk *), make a selection in the mandatory drop-down lists and, optionally, tick the check boxes for additional help and/or information.

Organization NIHDI number

The NIHDI number of the organization is already provided, since your account is connected to this organization.

Role in project

When selecting Local Study Support, you will be asked to make a selection in the drop-down list of Author groups. These author groups are specified for the organization in question.

HD4DP2.0 field

Click in the field under HD4DP2.0 if you want to access the application to make registrations for the selected project:

Healthstat.be field

Click in the field under healthstat.be if you want to access the reporting of the selected project:

Once you have completed the access request form, click on the Submit button. When the submisson was successful, you will receive a confirmation message.

If you now return to My profile, the User profile is extended with the Organization name and code. And an extra tab Batch create requests has been added.

Continue to Give access to multiple users in batch in order to give access to multiple users in one operation.

Give access to multiple users in batch

The person whom has been assigned the SPOC role for the healthcare organization (HCO) is able to give access to multiple users in batch. The SPOC therefore needs to return to the User profile page and select the tab Batch create requests.

In the tab Batch create requests a CSV file can be selected via the file selection button.

Upload the CSV file and click on the Run the batch creation button. An example of a CSV file structure is available here:

By doing so, a master request per line will be automatically generated, and then the information will be split into sub-requests (one per application or project) and saved in the healthdata.be DB2 for further processing.

A table schema (https://specs.frictionlessdata.io//table-schema/) to validate CSV looks as follows. An example file is available here: eam_csv_batch_requests_schema.json

User roles and corresponding values

To complete the “role”, 3 different choices are possible:

• 1= Local Study Lead: Only 1 Local Study Lead can be created by healthdata.be (Sciensano) for each registry within each organization.
• 2= Local Study Associate (= author). This will be the default role a user will receive, the reason why it was prefilled with “2”.
• 3= Local Study Support (= co-author). This role can be given if it is more suitable for the user. A Support will always need an Associate to which he/she will be assigned.

When selecting role 3 (= Local Study Support), the name of the ‘Local Study Associate’ is expected in the field “author_group”. To be filled in in the format <first_name last_name> of the Associate, with just 1 space (tab) between the two names).

When selecting role 2 (= Local Study Associate), the field author_group must be left empty.

After submission of the requests for access and receipt of the confirmation message, you are able to consult the validation process and other features of the requests via the tab Requests overview on the My Profile page.

Based on the scope of the requests overview, we can distinguish between

• end-user, and
• IT SPOC (single point-of-contact).

Overview of the requests for end-users

In order to view their own requests, end-users can open the My Profile page and click on the tab Requests overview.

The overview shown can be searched and sorted in the top row as needed (see figure below). End-users will only see a list of requests they have created for themselves.

Request UUID field

This field contains the unique ID’s of the requests. The occurence of the same unique ID in several rows indicates that this master request consists of several subrequests, each one per project and per application that has been selected in the request form. These subrequests are than saved in the healthdata.be DB2 for further processing.

Status field

The Status field indicates whether the request has been created (value “created”; meaning to be approved by the SPOC) or approved (value “approved_rae”; meaning the request was approved by the SPOC and will be ready for sharing credentials).

Role in project field

The values in this field are Local Study Lead, Local Study Associate, Local Study Support. More detailed information about these roles can be found in User roles in HD4DP v2.

Application field

This field contains the application you have selected in the Request Access (End-User) or Access Request form to access the public health projects: HD4DP2.0 or Healthstat.be.

Project code field

The value in this field is the Healthdata.be business project code. Entering this code in the publically accessible FAIR portal (fair.healthdata.be) results in the dataset for this project.

Or you can enter this code in the Advanced search field on the Healthdata.be docs pages to find the respective project’s documentation.

Overview of the requests for IT single points-of-contact (IT SPOC)

SPOCs have the capacity to view all requests for their organization.

To view the Status of the request of the users of their affiliation, the SPOC needs to select the My Profile page and to click on the tab Requests overview (see screenshot below). Requests in this overview can be searched and sorted as needed.

New: Actions field

This field describes the extra actions a SPOC can take, i.e. approve or reject requests. This functionality is explained in SPOC actions upon a request in more detail.

Request UUID field

This field contains the unique ID’s of the requests. The occurence of the same unique ID in several rows indicates that this master request consists of several subrequests, each one per project and per application that has been selected in the request form. These subrequests are than saved in the healthdata.be DB2 for further processing.

Status field

The Status field can only receive the status “approved_rae” since the request was made by the SPOC.

Role in project field

The values in this field are Local Study Lead, Local Study Associate, Local Study Support. More detailed information about these roles can be found in User roles in HD4DP v2.

Application field

This field contains the application you have selected in the Request Access (End-User) or Access Request form to access the public health projects: HD4DP2.0 or Healthstat.be.

Project code field

The value in this field is the Healthdata.be business project code. Entering this code in the publically accessible FAIR portal (fair.healthdata.be) results in the dataset for this project.

Or you can enter this code in the Advanced search field on the Healthdata.be docs pages to find the respective project’s documentation.

In this article, we cover the different actions of a SPOC in more detail.

SPOC actions upon a request

SPOCs will be notified in case a request for access was made by a colleague, allowing them to review the overview table to manage all requests for their organization.

To open the overview table, the SPOC needs to navigate to "My Profile" followed by selection of the "Requests" tab. The overview of the requests appears (see below).

In the Actions field an Approve/Reject selection button is displayed next to each request with the status created or approval_requested (framed in blue). Two actions are possible now: the SPOC can either approve or reject the user's request.

When selecting Approve, and after confirmation of this action, the status of the request changes to "approved_rae" and the dates in both fields Updated and Completed are updated accordingly as demonstrated in the screenshots below. Once the registry goes in production the account will be created automatically and the credentials will be shared to the user by e-mail.

Approve action:

Pop-up confirmation query:

Approved:

When returning to the overview, you will notice that the status of the request has changed to "approved_rae". The Approve/Reject button in the Actions field has disappeared.

When selecting Reject, and after confirmation of this action, the request receives the status "rejected", the dates in the fields Updated and Completed are updated accordingly. A rejected request remains in the overview for information purposes. Compare following screens:

Reject action:

Pop-up confirmation query:

Rejected:

The requester will also be notified of the rejected request by e-mail:

Introduction

This document is written for IT staff / system engineers of data providers and therefore assumes technical knowledge. It acts as a guide through the on-boarding process of HD4DP v2 and covers installation of the server, user configuration, network configuration and remote access.

The order of steps in this document should be respected during execution.

Overview

HD4DP v2 consists of a modular application stack, which allows healthdata.be to seamlessly upgrade individual elements.

An HD4DP v2 deployment comprises of following components:

• Form.io component
• MongoDB
• PostgreSQL
• Nextgen Connect

As it is the case in HD4DP 1.0, an Encryption Module with a connection to the eHealthBox is still required for HD4DP v2 and must be provided by the data provider.

Network configuration

IP

The HD4DP server needs to be accessible via domain names in DNS, and must have a static IP in your private network.

DNS

The application stack of HD4DP v2 requires four domain names pointing to the IP of the locally installed HD4DP v2 server. Use the following names in your DNS:

• nextgenconnect.hd4dp.<yourdomain.be>
• hd4dp.<yourdomain.be>
• metabase.hd4dp.<yourdomain.be>
• admin.hd4dp.<yourdomain.be>

Firewall

The following connections should be possible in the firewall flow:

• To and from (a) machine(s) in your IT department on port 22 for initial configuration and local support.
• To and from the Encryption Module server. The protocol and ports depend on your local EM implementation. Contact your EM vendor if more information is necessary.
• Reachable by your staff who uses HD4DP, on ports 80 and 443 for HTTP(s) traffic.
• To and from the LDAP server (this is not mandatory if you are not using LDAP to authenticate) (port 389 by default)

The healthdata.be proxy server is used as a gateway to the internet for the security of HD4DP servers. The configuration of this proxy server will be provided to you by healthdata.be at a later date.

Server installation

To install the application stack of HD4DP v2, healthdata.be requires a fresh installed operating system, specifically Ubuntu Server 18.04 LTS.

Please use these instructions even if you have previous experience with installing this operating system, as its configuration is specific for healthdata.be.

These instructions assume that the network configuration described in the previous section is completed.

Instructions

HD4DP v2 requires a (virtual) machine running Ubuntu Server 18.04 LTS.

We assume knowledge of loading a .iso file onto a (virtual) machine. Healthdata.be can’t provide instructions for this, as the environment of your center is unknown. Should you have any trouble, however, please contact Healthdata.be support so that we can help out.

Please find the installation steps below.

Installation steps

1. Download the .iso file from the link below.
   Download Ubuntu Server 18.04 LTS
2. Create a new (virtual) machine with Linux Ubuntu 64 bit as the OS family
3. When prompted, select the .iso file downloaded in step 1.
4. After some time, you will be prompted to select a system language. Select English.
5. “Keyboard configuration”
   Select your preferred keyboard layout and press enter
6. “Network Connections”
   Highlight the network interface and press enter. Navigate as follows:
   Edit IPv4 -> Manual -> enter the network details -> save -> Done
7. Proxy IP -> Leave default/empty.
8. “Configure Ubuntu Archive Mirror” -> leave default
9. “File system Setup” -> Use An Entire Disk
10. Proceed until “Confirm destructive action” -> press continue. The installation process starts, this can take several minutes.
11. In the meantime, create the user for Healthdata.
    username = healthdata,
    Password = choose a secure password and communicate it to healthdata.be.
12. Mark “Install OpenSSH server”. This will be used for remote access. “Import SSH Identity” -> no -> done
13. “Featured Server Snaps” -> Select nothing and press Done.
14. Wait until installation is finished.

Configuration steps

Connecting to the server

Log into the machine with the healthdata.be user created in the previous section.

Instructions (from a Windows machine):

1. Install the tool Putty and open the application.
2. On the configuration screen, enter the following (replace cursive text with the appropriate values)
   • Host Name: healthdata@server_private_ip
   • Port: 22
   • Connection type: SSH
3. Click Open. Enter the password (you will not see text as you type, you can paste into putty by right-clicking in the terminal).
4. You should now be logged in and see a prompt  “healthdata@server_name:~$”

Administrator account for internal use

An administrator account for internal use can be created on the HD4DP v2 server.

The configuration of remote access (described below) should not happen on this account, but on the Healthdata.be account.

The internal account can later be used to install and configure OS monitoring software and antivirus software by the internal IT team. For more information, see the section on Antivirus and Monitoring.

(Text with a gray background should be entered as a command in the terminal of the server)

Create the user:

            sudo adduser <username>

Add the user to the sudo group

            sudo usermod -aG sudo <username>

Installation and configuration of the software stack

Healthdata.be support will instruct you when to execute the next step, which is to enable remote access so that Healthdata.be can execute the software installation and configuration.

Backups

The configuration of the HD4DP v2 server is administered by healthdata.be and does not require backups.

HD4DP v2 regularly dumps its databases automatically to the /backup directory on the server. A network storage should be mounted at this location.

Please fill out the infrastructure sheet with the required credentials, domain name/url, protocol… to connect to the network drive. The connection will then be configured by healthdata.be.

Patching and Updates

Healthdata.be configures HD4DP v2 servers to automatically receive recommended security updates. The choice for Ubuntu 18.04 is motivated by the long-term support for this version. Security flaws are rare in this distribution, and security updates are quick and often don’t require a system reboot.

If the IT department of your organization prefers to manage patches, this is possible but not encouraged. Please use the account for internal use created in Section 3 for this purpose.

Antivirus and Monitoring

Most data providers will want to manage their own antivirus and OS monitoring on all machines in their network. Installation of such software on the HD4DP v2 server is allowed, but healthdata.be should be informed about all extra software installed on the server. Additionally, healthdata.be will not provide support for the installation of this software.

Contact information

The HD4DP v2 Infrastructure Sheet contains information that healthdata.be needs in order to start the installation of the HD4DP 2.0 Software at your organization.

Below you can find the description of the necessary information:

SERVER CONNECTION

Healthdata.be performs its installation and support tasks remotely (using VPN or remote port forwarding via SSH). Please provide the required credentials.

• Type of connection (VPN / Remote port forwarding via SSH)
• Link (IF VPN)
• Username, token, other (if VPN)
• Password (if VPN)³
• Public SSH Key (if remote port forwarding)

³ For security reasons, we advise to communicate passwords to us either by phone, or via a link using a secret-sharing service such as onetimesecret.com.

SERVER MACHINE

• Server Name
• Internal IP-Address
• Ram (in GB)
• CPU (number of CPU's and number of cores)
• Disk space (in GB)
• Username: Healthdata
• Password ³

³ For security reasons, we advise to communicate passwords to us either by phone, or via a link using a secret-sharing service such as onetimesecret.com.

ATTACHED DRIVE FOR BACKUPS

HD4DP 2.0 regularly performs data dumps for backup purposes. Please provide connection information to a network share volume.

• Link / IP address
• Path
• Username
• Password ³

³ For security reasons, we advise to communicate passwords to us either by phone, or via a link using a secret-sharing service such as onetimesecret.com.

USER MANAGEMENT

HD4DP can either connect to a LDAP server or use its own application database for performing user authentication and management. Please check the user management mechanism you want to use.

• LDAP user management : Yes / No
• Application user management : Yes / No

LDAP configuration (Optional)

If you chose ‘LDAP user management’ as user management mechanism, please provide the following information that allows us to connect to your LDAP system.

• Connection URL
• Username
• Password³

³ For security reasons, we advise to communicate passwords to us either by phone, or via a link using a secret-sharing service such as onetimesecret.com.

SOFTWARE CONFIGURATION

Encryption Module interface

HD4DP communicates with the Encryption Module (EM) either using the file system interface or by calling a REST web service. Please choose which interface HD4DP should use for its communication with the Encryption Module.

Note: if the encryption module is not yet purchased (or developed), HD4DP can already be installed; the EM can then be configured in HD4DP once it is available. Please note that HD4DP 1.x and HD4DP 2.0 cannot use the same EM.

• REST web service
• File system

REST web service interface

If you chose to communicate with the Encryption Module using a REST interface, please provide the web service URLs that should be used by HD4DP for its communication with EM.

• "Outgoing flow URL: Example: http://host:8080/encryptionmodule/send"
• "Incoming flow URL : Example: http://host:8080/encryptionmodule/receive"

File system interface

• "Incoming directory: Directory where HD4DP checks for incoming files"
• "Incoming directory: Directory where HD4DP writes outgoing files"
• "Incoming directory: Directory to which HD4DP moves successfully processed files"
• "Incoming directory: Directory to which HD4DP moves unsuccessfully processed files"