Compliance Evaluation: openIMIS

Content

Tool Description

openIMIS is a digital public good which powers versatile solutions for the management of health financing and social protection programs. Designed to be interoperable with other information systems, openIMIS draws upon and contributes to Digital Public Infrastructure.

Evaluation Status

Status

CandIDATE

Date

2024-09-30

Reviewer

@Uwe Wahser @Dragos Dobre

Version

Release 2024-10

Tool Attributes

Logo

Name

openIMIS

Web

Home Page | openIMIS

Docs

Documentation

Download

Sources

BBs

Digital Registries

Email

contact@openimis.org

Installation Guide

Installation Guide

Container

GitHub - openimis/openimis-dist_dkr: The "all in one" packaged openIMIS (docker-compose)

 

 

BB Compliance

Functional Requirements Digital Registries

Key Digital Functionalities Requirements

Requirement

Comment

Fulfillment

Requirement

Comment

Fulfillment

1

(REQUIRED) Create a new register/database (via API or Web user interface);

Go to requirement

feature is on the roadmap for next project phase

2

(REQUIRED) Create and configure the schema of the register (API or Web user interface);

Go to requirement

 

3

(REQUIRED) Change schema configuration and publish the new version of the database and API services (API or Web user interface);

Go to requirement

 

4

(REQUIRED) Enter data to the register (API or Web user interface);

Go to requirement

 

5

(REQUIRED) View data records in the register (API or Web user interface);

Go to requirement

 

6

(REQUIRED) Update data in the register (API or Web user interface);

Go to requirement

 

7

(REQUIRED) Import/export data from/to external files;

Go to requirement

 

8

(REQUIRED) Import/export registry database schema;

Go to requirement

 

9

(REQUIRED) Create API services;

Go to requirement

 

10

(REQUIRED) View statistics (API or Web user interface);

Go to requirement

 

11

(REQUIRED) Inspect transaction log of registry data operations (API or Web user interface);

Go to requirement

To validate

12

(REQUIRED) Manage access to registry data. Authorize users to see and edit registry records or data fields (Attribute-Based Access Control management);

Go to requirement

 

13

(REQUIRED) Share data with other users via e-mail, or via a unique and secure Uniform Resource Locator (URL) sharing can be field level or record level.

Go to requirement

 

14

(REQUIRED) Search data from the register;

Go to requirement

 

15

(REQUIRED) Read data from the register;

Go to requirement

 

16

(REQUIRED) Create data in the register;

Go to requirement

 

17

(REQUIRED) Update data in the register;

Go to requirement

 

18

(REQUIRED) Delete data in the register;

Go to requirement

 

19

(REQUIRED) Validate if given content exists in specified register;

Go to requirement

To validate

20

(REQUIRED) Read statistics.

Go to requirement

To validate

 

Cross-Cutting Requirements

Requirement

Comment

Fulfillment

Requirement

Comment

Fulfillment

1

(RECOMMENDED) Open Cancel mandatory requirement: "Cloud-native, i.e. Docker and Kubernetes". Digital Registries must have also an on-site installation option.

Go to requirement

 

2

(RECOMMENDED) Robust Operates in low-resource environments Cancel mandatory requirement: "Occasional power". In Digital Registries not possible, thus should be optional. This can be solved with backup power resources (UPS) and a generator that keeps the systems running without interruptions. Cancel mandatory requirement: "Low-reliability connectivity". Client-server systems are not reliable in this situation, instead additional hand held connection-less data capturing devices should be used and data reentered/uploaded to the servers when connection is restored (not covered in this version scope).

Go to requirement

 

3

(RECOMMENDED) Databases must not include business logic Cancel mandatory requirement. "no triggers/stored procedures shall be used". Some stored procedures may be needed for database record ID generation.

Go to requirement

 

4

(REQUIRED) Privacy and protection of user data Add mandatory requirement. The following requirement should be added to other Building Blocks' cross-cutting requirements: Each owner of the personal data (e.g. citizen) must be able to see who has looked at their personal data in the registry. All captured personal user data must be marked as “personal data”. Users can make requests to see the information/logs of accessing personal information. API must be available for authenticated users to see their own personal data audit logs.

Go to requirement

 

 

OLD Integration Readiness

This is an evaluation according to the levels of integration that were defined for the last wire frame proof of concept. (compare attached slide-deck)

Level

Criterion

Status

Comments

Level

Criterion

Status

Comments

I

Authentication, e.g. SAML <-> JWT in HTTP headers

 

Filtering and aggregation logic

 

Adapter must publish static OpenAPI spec to Information Mediator, including JSON Schemas

II

Packaged as a container (Docker/Docker Compose/OCI)

GitHub - openimis/openimis-dist_dkr: The "all in one" packaged openIMIS (docker-compose)