Skip Headers

Oracle® Argus Safety User's Guide Release 7.0 E20623-01 |
| Contents

Previous |

# 13 Multi-Tenancy

This chapter describes Multi-tenancy and the Global Portlets in Argus Safety that are used to manage work across multiple clients in a multi-tenant environment.

## Introduction to Multi-tenancy

Multi-tenancy refers to a principle in software architecture where a single instance of the software runs on a server, serving multiple client organizations (tenants).With a multi-tenant architecture, the software application is designed to virtually partition its data and configuration so that each client organization works with a customized virtual application instance.

### Multi-tenancy in Argus Safety

The Multi-tenancy feature in Argus Safety allows an organization to use a single database for multiple clients. For example, Contract Research Organizations (CROs) offer a range of global safety and pharmacovigilance services, which span from limited case management activities to full clinical trial and post-marketing services.

The multi-tenancy feature allows multiple pharmaceutical clients of a CRO to reside as separate and unique tenants in a single database with their data completely segregated and restricted to authorized users. This enables the CRO to achieve standard configuration across clients while at the same time provides the ability to a CRO to have differentiation in configurations to specific clients as required. It provides the ability to a CRO to quickly set up a new client based on existing configuration and authorize users to the new client. It provides the ability to CRO users who have access across multiple clients to view their work across clients, understand their sum of work across clients and make decisions based on the priority.

Argus Safety assists manufacturers of pharmaceuticals and devices by providing a simple and efficient way to comply with international and domestic regulatory safety reporting requirements. It also facilitates internal company safety surveillance by providing tools for signal detection and for analyzing the overall safety profile of both investigational compounds and marketed products.

Contract Research Organizations (CROs) provide services to pharmaceutical and device manufacturers, that range from case management activities to clinical trials. The multi-tenancy feature allows an organization to provide services to many clients while keeping client data isolated.

Multi-tenancy is enabled during the Argus Safety installation. Policies and rules are centrally administrated and shared, with the option to personalize for each client.

### Data Segregation

Multi-tenancy allows an organization to use a single database for many clients, which reduces the amount of hardware needed for an implementation. Fewer patches and dictionary upgrades are required, which decreases the resources necessary to support an implementation. This also allows administrators to use standard configurations, such as code lists, workflow steps and user/new client setup.

The entire Argus Safety application and all of its components and data are partitioned by Enterprise ID. The Enterprise ID is a unique identifier for a customer's client and contract. The appropriate context of the Enterprise ID selected by the user that the user has access to, is set by the system and operates within the partition of this context.

#### Data Segregation by Module

The following table describes how each module in the Argus Safety suite provides data segregation in a multi-tenant environment.

Note: that you

Table 13-1 Data Segregation by Module

Module | Cross Enterprise? | Accessed Via Portal? | Notes
--- | --- | --- | ---
Global Worklists | Yes | Yes | Displays data from across multiple enterprises
Global User Management | Yes | Yes | Displays data from across multiple enterprises
Global Enterprise Management | Yes | Yes | Displays data from across multiple enterprises.
Applications Access | Yes | Yes | Displays Application Access options from across multiple enterprises
Argus Safety | No | No | Displays data for one enterprise at a time to the logged-in user based on the selected enterprise.
Console | No | No | Displays data only for the enterprise for which Argus Safety was opened by the user.
Affiliate | No | No | Displays data for one enterprise at a time to the logged-in user, based on the selected enterprise.
EOSU Tool | No | No | Displays data for one enterprise at a time to the logged-in user, based on the selected enterprise.
ESM Mapping Utility | No | No | Displays data for one enterprise at a time to the logged-in user, based on the selected enterprise. However, the screens related to ESM Service Configuration display data related to all the active enterprises, irrespective of the user access rights to those enterprises.
ESM Service | Yes | No | ESM Service process data from all the enterprises, as it is a background service.
ESM Service Configuration | Yes | No | As ESM Service is common across all the enterprises, hence its configuration tool is also common.
AG Service | Yes | No | Argus Safety Service processes data from all the enterprises as it is a background service.
AG Service Configuration Tool | Yes | No | As AG Service is common across all the enterprises, hence its configuration tool is also common.
MedDRA Re-code Tool | Yes | No | Allows the option to perform recoding of MedDRA terms across the enterprises.
MedDRA Dictionary Load | Yes | No | Single instance/version of the loaded MedDRA dictionary is available for all the enterprises.
Who Dictionary Load | Yes | No | Single instance/version of the loaded WHO Drug dictionaries (B2 as well as C formats) is available for all the enterprises.
MedDRA/WHO Web Services | Yes | No | These web services remain common to be used across all the enterprises. Their configuration is maintained in a common XML file on the web server(s).
J Drug Dictionary | Yes | No | Single instance/version of the loaded J Drug dictionary are available for all enterprises.
Case Intake | No | No | Case Intake messages for separate enterprises are segregated and loaded into appropriate enterprise partitions.
Literature Intake | No | No | Literature Case Intake data for separate enterprises are segregated and loaded into appropriate enterprise partitions.
New Case from Image | No | No | Scanned Image folder paths for separate enterprises are segregated and loaded into correct enterprise partitions.
PSL | No | No | The PSL interface segregates the incoming requests for each enterprise partition.
DS Navigator | No | No | The DS Navigator interface schema is partitioned by enterprise. However, the DS Navigator job which processes the encoding requests is common for all enterprises.
DLP | No | No | Partitions the case revisions by enterprises.
Reconciliation | No | No | Partitions all data displayed in the Reconciliation module by enterprises.
TMS Integration | No | No | TMS integration for single-pharma installations only.
Dossier | No | No | As this module is linked to Periodic Reports, hence it partitions the periodic reports data by enterprise.

#### Data Segregation impact on system level configuration items

Following table specifies some specific system level configuration items which are configured through Argus Console. It specifies the impact on these configuration items due to data segregation design for multi-tenant installations and also specifies the recommendations for customers on these items.

Table 13-2 Data Segregation and System Level Configuration Items

Configuration Item | Application Design | Recommendation for Customers
--- | --- | ---
Enable/Disable MedDRA/WHO Web Service Encoding | System keeps it segregated for each enterprise. However, the underlying web service used for MedDRA/WHO is common for all the enterprises as their configurations are maintained in common XML file on the web server(s). | None
Lot Number Web Service configuration | System keeps it segregated for each enterprise. | As this is related to the product, it is recommened to keep specific for each enterprise.
Documentum Configuration | System keeps it segregated for each enterprise. | All parameters except for Cabinet Name are expected to be maintained as same for different enterprises.
Enable/Disable DS Navigator Encoding | System keeps it segregated for each enterprise. However, the underlying DS Navigator job which interacts with DS Navigator interface schema is common for all the enterprises. | None
Enable/disable LDAP & LDAP Server configuration | This will be maintained by application as common for all enterprises. | None
Enabled Modules | System shall keep it segregated for each enterprise. | None
Enable/disable SSO & SSO Header Configuration | This will be maintained by application as common for all enterprises. | None
Argus Insight URL | System keeps it segregated for each enterprise. | It is expected to be maintained same for across all enterprises by the customer.
Argus Safety Load Balancer Server | System keeps it segregated for each enterprise. | It is expected to be maintained same for across all enterprises by the customer.
User Information | System keeps it segregated for each enterprise. | For multi-tenant installations, user attributes can be synchronized for all the enterprises through Global User Management. However, user attributes can also be updated for a specific enterprise through Console as well.
Default Enterprise | System keeps it segregated for each enterprise. | This is a new internal common profile switch that marks an enterprise as the Default enterprise. This is set during the time of install. Default enterprise once created during database creation is fixed. This is required to avoid the data synchronization issues that may occur for AG Service users in different enterprises.
SMTP Configuration | System keeps it segregated for each enterprise. | None

#### Dictionaries

All dictionaries are stored in database schema separately outside Argus Safety and Interchange schema. The Argus-supported dictionaries are:

- MedDRA

- MedDRA J

- WHO Drug

- J Drug

Only one copy of each dictionary version is maintained in the database and is not segregated by enterprise. The dictionary version that is applicable for a particular enterprise/client is defined in the common profile switches: Case Form Configuration' Auto Encoding, Dictionary & Central Encoding. Since these switches are segregated for each Enterprise, these dictionaries can be different versions for different enterprises, as required.J Drug dictionary is not configured through Console common profile switches (Case Form Configuration' Auto Encoding, Dictionary & Central Encoding), and is internally maintained as single version, therefore, it remains a common J Drug dictionary for all enterprises.

##### Coding Web Service

The Case Processing Dictionary Browser common profile switches are segregated by enterprises to allow different configurations for different enterprises.

However, the URL and other configuration for WHO Drug and MedDRA web services remain in configuration XML on the Web Servers as per existing design and hence remain common across all enterprises.

In a multi-tenant installation, if the provider chooses to operate using Coding via web service, they should use the same web service across all enterprises.

## Global Worklists

Global Worklists lets you access work items across enterprises where you have access. It also allows you to filter the worklist to a specific enterprise where you have access. When filtered to a specific enterprise, any further operation on the retrieved worklist items are restricted to that enterprise.

For unauthorized users, the Global Worklist is not visible and their access remains restricted based on portal privileges. The context menu on the Global Worklist displays menu items according to rights and permissions of a user in a particular enterprise.

The user preferences of each Global Worklist are saved for the user each time the Worklist is loaded.

### Global Worklist Tabs

- Worklist New: displays the list of new cases across all the enterprises or a specific enterprise, that the user has access, as well as cases assigned to user/ group but not yet accepted.

- Worklist Open: displays the list of new cases across all the enterprises or a specific enterprise, that the user has access, as well as cases assigned to user/ group but not yet accepted.

- Worklist Contacts: Display the list of pending letters and allows you to generate the letters.

- Worklist Action Items: Allows the owner of the action item and workflow managers to view and/or close the selected action item.

#### Link to Argus Safety

- Case number - hyperlink on the case number allows you to open the case in the Argus Safety application, with context set to the enterprise that the case belongs to.

- Enterprise - hyperlink on the Enterprise Short Name allows you to open Worklist-Open in the Argus Safety application, with context set to the enterprise that the case belongs to. The Worklist opens with preferences configured for you in that enterprise.

### Case Actions

- Open Read-only - opens the case in read-only mode in the Argus Safety application, with context set to the enterprise that the case belongs to.

- Accept Case - accepts the case and assigns your user name as responsible for that case

- Un-Accept Case - reverses Accept Case and resets the case assignment set to <Unassigned>

- Adjust Priority - modifies the priority level of the case

- Adjust Assignment - modifies the user assigned to the case, limited by your access to the enterprise and the case

- Adjust Case Owner - modifies the owner of the case, limited by the your access to the enterprise and the case

- Close Case - closes the case after entering the Case Closure details

- Coding Review - opens the exiting Argus Safety Coding Review screen as a dialog and supports all existing actions within this dialog

- Medical Review - opens the Argus Safety Medical Review screen as a dialog and supports all the existing actions within this dialog

- Print/Print List - prints the current Worklist

Note: Multiple case actions are not supported, such as: Close Multiple Cases, Route Multiple Cases, Print Multiple Cases and Assign Multiple Cases

### Search Case

The list of cases displayed in the worklist include active enterprises where you have access. Your view is restricted to the search criteria result set, entered into the Value search field. You may filter the content of this worklist to a specific enterprise. When there is no filtering applied, all cases across enterprises are displayed.

Filter

You can filter your search by the following:

- Case Number

- Workflow State

- Product

- Event Preferred Term

- Event as reported

- Case Report Type

- Product Group

Note: Items that are unavailable will not appear in the filter list.

Value

Once you have selected an item to filter by, the Value field loads the corresponding choices. For example, select Product and the list of Products loads into the Value field. You can also type into the field to search the list.

Only view locked Cases requiring Follow-up

Select the Only view locked Cases requiring Follow-up option to limit your search to these types of cases.

#### View Options

Your view options for Worklist New are Individual, Group or All. Individual is the default selection.

- Select Group to list all cases across authorized enterprises, which are assigned to any other member of groups that you are a member of and that have not yet been accepted by the assigned user.

- Select All to view every open case across all user groups and enterprises (or specific enterprises) where you have access.

##### List Actions

- Sorting - sort by any list header

- Pagination - select page size and number of displaying rows.

### Global Enterprise Management

From the Global Enterprise Management tab, you can:

- Add a new enterprise

- Define new enterprise attributes

- Copy configuration from an existing enterprise

- Associate users to the new enterprise

### Add New Enterprise

1. Click Add New Enterprise.

2. Enter information about your Enterprise. Enterprise Name and Enterprise Short Name are required fields.

3. Click Next.

4. Select an Enterprise to use as a template for your new Enterprise from Copy Configuration Data Source. You can makes changes to the configuration once the enterprise has been set up.

5. Click Setup.

6. Click Finish.

### Global User Management

Global User Management is intended to configure users across multiple enterprises. When user configuration changes need to affect only a specific enterprise, it needs to be done from the Argus Safety Console: User Management screen for that enterprise. Your access is restricted depending on your access to this Portlet at the Portal server level.

See the Oracle Argus Safety Administrator Guide for more information.

Browser

The browser displays a left hand pane that lists the existing users (distinct users based on Login User ID) in the system, in a tree view. The tree displasy users from the enterprise partitions for which the user has access.

#### Associate Enterprise

Associates existing users in one enterprise to other enterprises.

1. Select an enterprise from Copy User Attributes From. The enterprise selected is used to set the attribute values for the user in the new enterprise to which the user is being associated. The attribute values for the already associated enterprises remain the same.

2. Add an Available Enterprise or Add All available enterprises.

3. Select Save.

During Save, all the user attributes are copied from the Enterprise selected in the Copy User Attributes From to all the newly associated Enterprises.

##### Print

Click Print and select Current User or All Users. Based on the selection, you can print the User details of the current User or all Users.

#### Synchronizable User Attributes

The purpose of the Synchronizable User Attibutes section is to allow you to apply updates to user attributes displayed in this section, and keep them in sync across all enterprises.

The users that are listed to be administered in this screen are restricted by the following rules:

1. Admin, System users and the users for which the Service User is checked in Console are not listed.

2. Only the users from the enterprises for which you have access to the Console User management screen, i.e. you should have access to all of the following in those enterprises:

- Console User Management screen ' Application Access field ' Console checkbox is checked.

- Console Group Management screen ' Menus section ' Console, Access Management and User radio options are set to enabled at least for one user group in the respective enterprise partition.

- Is not marked as "Account Disabled"

When you select the Synchronize User Attributes tab, the right hand pane displays a list of enterprises to which the user being administered belongs to. The right hand pane displays a list of Synchronizable user attributes in a grid.

Note: If you make changes to the data on one of these tabs and attempts to move away from this current tab without saving the changes, then the warning message "You have made changes to the existing item, if you press OK, changes will be lost." dispalys. Click OK to ignore changes. Click Cancel to stay on the current tab.

#### Configure Synchronizable Attributes

Configure Synchronizable Attributes appears in the bottom of the left hand pane of the Global User Management Portlet. Configure Synchronizable Attributes allows the Portlet user to configure a list of user attributes as synchronizable fields. When configured, these user attributes appear in the "Synchronize User Attributes" section.

When selected, the user attribute value specified in the Synchronized Value column is applied across enterprises. If unselected, the user attribute is not saved. Selecting the header of this column selects all the attributes listed.

The following user attributes are available for the Portlet user to add or remove from the Synchronizable Attributes list in the following order which is in sync with the ordering of these fields on Console ' User Management screen.

These user attributes are available as out-of-the-box Synchronizable fields in the following order:

- User Name

- Email Address

- Enable LDAP Login

- LDAP Server Alias

- Application Access

- Default Application

- Account disabled

- User Roles

- Allow unblinding of cases

- Protect from unblinded information

- Protect from printing unblinded information

- Allow locking of cases

- Allow closing of cases

- Route on close case

- Enable Checklist on Route

Any changes to these fields are applied across all the enterprises for which you are restricted to based on the above points.

Tip: Maintain administrative users with these privileges for all enterprises in the system, in-order to apply the updates to these fields across all the enterprises. This prevents some enterprises from becoming out-of-sync for some users for these attributes.

#### Modifying User Attributes

The value of the Synchronizable fields can be modified for a specific enterprise using Argus Console>User Management>Access Management so that these attributes can be different for that enterprise as compared other enterprises.

If User Name and Email address fields are updated in Argus Safety Console for a user which belongs to multiple enterprises, an error displays.

### Application Access

Applications Access allows you to launch Argus Applications for any enterprise where you have access.

that you

#### Enterprise

Select Enterprise to display a list of active Enterprises to which the you have access and is not marked as Account Disabled. The list is alphabetically sorted by Enterprise Short Names. This first Enterprise in your list is selected by default.

#### Application

Application lists the Argus appications that you can launch from the Application Access tab. Application lists only those options, which are enabled in the selected enterprise in Argus Safety Console>User Management>Application Access.

- Argus Safety - Opens the Argus Safety application homepage with the context set to the selected Enterprise.

  Tip: For an Affiliate user, this opens as Argus Affiliate application for the selected enterprise. This action will not open the Insight application, even if it is configured as the Default Application in Argus Console.

- Argus Safety Case Book-In - Opens the Case Book-in screen within the Argus Safety application, with the context set to the selected enterprise. This action does not launch the Argus Insight application, even if your Default Application in Argus Safety Console.

  Argus Safety allows new Case Book-In to be done aided by an image file where an image file can be selected from a pre-defined folder and allows you to fill-in the case book-in parameters manually using the details available on the image file.

  In multi-tenant installations, the common profile switch defined as Case Processing - Default Network directory for scanned images is partitioned by enterprise/client, allowing you to define separate image folders to accept company-specific image files for New Case from Image functionality.

  Tip: For an Affiliate user, this opens the New LAM Event Entry screen within Argus Affiliate application for the selected Enterprise.

Note: