What are my permissions and what do they mean?

To find out your permissions for itBioPath, click Profile on the right of the itBioPath menu.

The User Protocol/Project Permissions window will appear displaying your current permissions within itBioPath.

itBioPath users are granted permissions in itBioPath relative to their site assignment, relative to specimens collected under specific protocols, and relative to specimens that are registered with or disbursed to specific projects. What you are able to see and do with a specimen record depends on which protocol the specimen was collected under and which projects it has been associated with and your own permissions relative to those specific protocols and projects.

As long as you are granted a permission site-level, protocol-level or project-level you will be able to do what that permission allows you to do relative to every specimen that matches up with that permission. If you do not have View Identity permissions relative to the protocol that a specimen was collected under, but you do have View Identity permission relative to one of the projects the specimen has been disbursed to, you will be able to see identifying information for the patient the specimen was collected from.

Project-level Permissions

There are four project-level permissions that can be granted to a user.

• View Identity gives the user permission to view PHI information for patients who have had a specimen collected that has been associated with that project. (It does not give the user permission to view PHI information for specimens not associated with the specific project in question.)
• View Limited allows the user to see limited information about specimens that are registered with the project. This limited view does not include PHI information.
• The Modify Specimen permission allows the user to make changes to the specimen record for specimens associated with that project.
• The Manage Users permission allows the user to grant project-level permissions to other users for that specific project.

Protocol-level Permissions

There are seven protocol-level permissions that can be granted to a user.

• The View Identity and View Limited permissions at the protocol level mean the same thing as their project-level counterpart, except this permission is relative to specimens collected under the protocol in question.
• The Manage Consent permission allows a user to record and upload patient consents relative to the protocol, which then are linked to all specimens collected from that patient under that protocol.
• The Manage Specimens permission allows the user to add specimen records to the database (and to edit those records) for specimens that were collected under that protocol.
• The Distribute Specimens permission allows a user to disburse specimens (or portions of specimens) collected under that protocol to projects.
• The Manage Users permission, similar to its project-level counterpart, allows a user to grant permissions to other users relative to that protocol.
• The Project Only designation gives a user permission to add specimens under that protocol if the specimen is also registered with a project for which the user has "Modify Specimen" permissions at the same time. (The first page of the Add Specimen Wizard allows the user to indicate both the protocol the specimen was collected under and any project the specimen should be registered with.)

Site

Users are assigned to a site when they are granted access to itBioPath and may only view data associated with that site.

User Roles

Relative to the application itself, users may be assigned one or more of five possible roles. Most of these roles allow the user to perform certain kinds of tasks in the database — although in some cases the results of these tasks may still be limited by protocol and project permissions.

• Most itBioPath users are simply granted the "User" role. This allows that person to access the database and interact with the data depending on their protocol and project permissions. It does not grant any special access to data or activities beyond those specifically granted at the protocol or project level.
• Users who are designated as Admins are typically program administrators (such as the programmers in Research Informatics). It is a role that is reserved for administrative use only. The Admin role grants full access to all records (specimens, patients, consents, etc.) in itBioPath.
• The Site Admin role is like the Admin role, except that it is limited to just the records associated with the user's assigned site.
• Dictionary Editors have the right to access and edit itBioPaths dictionaries, which are essentially lists which control the values that are available to select in the various drop-down fields in the database. This role is granted to very few people because of the need to take great care when dealing with this dictionaries so that the data is consistent and useful. See Managing itBioPath's Dictionaries.
• iQ Users have access to the iQ tool, which can be used to create and run simple queries and reports on the data in the database. What is included in and displayed in as the results of any query will, of course, be limited by that user's protocol and project permissions relative to the specimens involved in the query.

What do permissions do I need in order to _____________?

Below is a table that attempts to summarize various common tasks in itBioPath and the roles that grant permission to perform those tasks.

FunctionPermissions Granting AccessSee de-identified information on a specimen.Protocol-level: Either the user must have been granted access to the protocol the specimen was collected under, or if it is a shared protocol, then the user's site must be the same as the protocol's site.Project-level: The user must have been granted access to a project the specimen has been registered with or disbursed to.See all PHI related to a specimen.Protocol-level: The user must have been granted the View Identity permission in the protocol the specimen was collected under.Project-level: The user must have been granted the View Identity permission in a project the specimen has been registered with or disbursed to.View Limited PHI related to a specimen — All itBioPath PHI is scrubbed except for dates related to the patient diagnosis and the SP Number.Protocol-level: The user must have been granted the View Limited permission in the protocol the specimen was collected under.Project-level: The user must have been granted the View Limited permission in a project the specimen has been registered with or disbursed to.View UUMC RecordProtocol-level: The user must have been granted the View Identity permission in the protocol the specimen was collected under, that protocol must be ITS approved and the user must belong to a site that can access ITS.Project-level: The user must have been granted the View Identity permission in a project the specimen has been registered with or disbursed to, the protocol the specimen was collected under must be ITS approved and the user must belong to a site that can access ITS.See information about an aliquot.Protocol-level: Either the user must have been granted access to the protocol the specimen was collected under, or if it is a shared protocol, then the user's site must be the same as the protocol's site.Project-level: The user must have been granted access to a project the specimen has been registered with or disbursed to. If the specimen is located at a different site the storage location is scrubbed.Add a specimen to the databaseProtocol-level: The user must have been granted the Manage Specimen permission in the protocol the specimen was collected under.Project-level: The user must have been granted the Project Only permission in the protocol the specimen was collected under and must have been granted the Modify Specimen permission in the project the specimen will be registered with. The user must register the new specimen with that project during the adding process.Transform a specimen aliquotProtocol-level: The user must have been granted the Manage Specimen permission in the protocol the specimen was collected under.Project-level: The user must have been granted the Project Only permission in the protocol the specimen was collected under and must have been granted the Modify Specimen permission in a project the specimen is registered with or has been disbursed to.Register an existing specimen with a projectProtocol-level: The user must have been granted the Manage Specimen permission in the protocol the specimen was collected under.Disburse a specimen aliquotProtocol-level: The user must have been granted the Manage Specimen permission in the protocol the specimen was collected under.Project-level: The user must have been granted the Distribute Specimen permission in the protocol the specimen was collected under and must have been granted the Modify Specimen permission in the project the project will be registered with. With these permissions, the user can only disburse to projects the specimen has already been registered with.Modify a specimen recordProtocol-level: The user must have been granted the Manage Specimen permission in the protocol the specimen was collected under.Project-level: The user must have been granted the Modify Specimen permission in a project the specimen is registered with or has been disbursed to.Add or modify a patient consentProtocol-level: The user must have been granted both the Manage Consents permission and the View Identity permission in the protocol the specimen was collected under.Add or modify a path reportProtocol-level: The user must have been granted the Manage Specimen permission in the protocol the specimen was collected under.Project-level: The user must have been granted the Modify Specimen permission in a project the specimen is registered with or has been disbursed to.Add or modify a medical recordProtocol-level: The user must have been granted the Manage Specimen permission in the protocol the specimen was collected under.Project-level: The user must have been granted the Modify Specimen permission in a project the specimen is registered with or has been disbursed to.Import placeholder specimens from ITSProtocol-level: The user must have been granted both the Manage Consents permission and the View Identity permission in the protocol the specimen was collected under, that protocol must be ITS approved and the user must belong to a site that can access ITS.Modify itBioPath dictionariesApplication-level: The user must have been granted a Dictionary Editor role in itBioPath.Update freezersApplication-level: The user must have been granted a Dictionary Editor role in itBioPath.Modify a patient recordProtocol-level: The user must have been granted the Manage Specimen permission in the protocol a specimen collected from the patient was collected under.Project-level: The user must have been granted the Modify Specimen permission in a project a specimen collected from the patient is registered with or has been disbursed to.Modify a collection recordProtocol-level: The user must have been granted the Manage Specimen permission in the protocol the specimens from the collection were collected under.Project-level: The user must have been granted the Modify Specimen permission in a project a specimen from the collection is registered with or has been disbursed to. The user is limited to adding collection aliases.Create and/or run iQ reportsApplication-level: The user must have been granted an iQ User role in itBioPath. The data actually displayed on the report will be impacted by the user's protocol and project-level permissions (specifically regarding what information can be viewed).