Privileged access
How EDFlow vendor staff can and cannot reach production: no standing access, audited time-boxed support access, break-glass with approval and session recording, two-person deployments, personnel security, and data return and destruction.
Cette page n'est pas encore offerte en français; elle est affichée en anglais.
| Topic | Control |
|---|---|
| Standing access | None. No vendor staff member has standing access to customer-test or live data, the backend admin key, the dashboard, data exports, the database, S3 archives or key decryption. The admin key and database credentials live in AWS Secrets Manager in the customer's environment account, readable only by the deployment pipeline and the break-glass role |
| Support access to site data | Through the product's audited support access: time-boxed (at most 4 hours), read-only or admin, tied to a ticket, site managers notified in-app and by email, every action audited with the support-access id. See Vendor support access |
| Infrastructure break glass | Just-in-time elevation with phishing-resistant MFA, a ticket, a second person's approval, a 1-hour maximum, session recording to logs in ca-central-1, and an automatic notice to the custodian's privacy office. Every elevation is reviewed within 2 business days and listed in the monthly service report |
| Production environment variables | Readable only through break glass. They contain no organization key material |
| Keys | Per-organization KMS keys; nobody holds standing decrypt rights; a hospital may supply its own KMS key and revoke it to disable its integration secrets |
| Deployments | Only from a controlled pipeline in the Canadian AWS account: built once in CI, signed with provenance, deployed after two-person approval (the author can't approve). Backend deploy credentials are never stored in the web host or source control |
| Change calendar | The maintenance window and notice in Availability and incidents, and each hospital's change-advisory process. Emergency changes notified before deployment when possible, otherwise within 1 hour |
| Personnel security | Background checks for staff eligible for break glass; annual privacy and security training on PHIPA agent duties; signed confidentiality agreements; access removed within 24 hours of a role change or departure; quarterly access review |
| Platform administrators | Can list integration apps across organizations but can't reveal secrets, call the API as an app, approve apps, record PIA attestations or accept vendor affiliations for a hospital, or decrypt organization keys |
| Remote access to the hospital | None needed. Engines connect outbound; webhook receivers are reached through your DMZ or gateway |
| Data return and destruction | On termination, an export of the site's data (JSON and CSV, documented schema) within 30 days; destruction within 60 days after confirmation, including backups as they age out (at most 35 days), with a certificate of destruction |
Related
Dernière mise à jour le