Facility Configuration, RBAC & System Administration

This section provides an exhaustive guide to Facility Configuration, RBAC & System Administration in MOANA EHR, covering the five core administrative pillars: Facility Profile & Operational Tier Gating, Department & Ward Hierarchy, Granular Role-Based Access Control (RBAC), Transactional Email & Alert Relays, and the Immutable Security Audit Log Engine.

---

1. Module Overview & Administrative Architecture

The System Administration console serves as the master command center for Hospital Administrators and IT Superusers to govern facility metadata, security policies, and regulatory audit compliance.

graph TD
    A[Facility Profile & Tier Gating] --> B[Department & Ward Hierarchy]
    B --> C[Staff Access Control & RBAC Matrix]
    C --> D[System Operational Modules: OPD, IPD, LIS, PACS, Pharmacy, Billing]
    D --> E[Email Notification Relay Engine]
    D --> F[Immutable Security & Clinical Audit Trails]

The 5 Core Administrative Management Consoles:

Administrative Console	Purpose & Scope	Core Capabilities
1. Facility Settings	Facility Metadata & Tier Gating	Configure hospital name, currency, tax rates, operational modes (Hospital vs. Clinic), and linked internal pharmacy/laboratory services.
2. Departments	Organizational Hierarchy	Manage clinical and operational departments, assign department heads, and configure cost centers.
3. Access Control (RBAC)	Role & Permission Governance	Two-level security matrix controlling full menu visibility and granular clinical action permissions per staff role.
4. Email Settings	Transactional Notification Relays	Master email switch and category-specific triggers for critical results, appointment alerts, and password handovers.
5. Audit Logs	Compliance & Activity Tracking	Immutable chronological audit trail recording all user access, Breakglass views, CDS overrides, and clinical modifications.

---

2. Facility Profile & Operational Tier Gating

The Facility Settings console allows administrators to adapt the MOANA application to the exact operational tier of their healthcare institution.

Facility Operational Settings, Tier Gating, and Linked Service Configuration🔍 Click to enlarge

Facility Operational Settings, Tier Gating, and Linked Service Configuration🔍 Click to enlarge

Configuration Capabilities:

1. Facility Metadata & Legal Identity:
   • Facility Legal Name: Displayed on all official tax invoices, medical certificates, discharge summaries, and prescription slips.
   • National Facility Identifier (NFI): Formal ministry/provincial health registry code.
   • Financial Parameters: Default operational Billing Currency and Standard Facility Tax Rate (%).
2. Operational Tier Feature Gating:
   • Hospital Mode: Activates the full inpatient suite (Inpatient Wards, Bed Registry, eMAR Nursing, Operating Theatres, Mortuary, and ICU).
   • Clinic Mode: Streamlines the interface for ambulatory health centers, focusing on OPD triage, outpatient consultations, and vaccination tracking.
   • Maternal & Neonatal Tracking Opt-In: Enables birth registration and neonatal growth charts for rural clinics without inpatient wards.
3. Linked Diagnostic & Pharmacy Services:
   • Default Internal Pharmacy Link: Links the hospital's central pharmacy dispensary for automated CPOE order routing.
   • Default Diagnostic Laboratory Link: Links the internal Moana-LIS laboratory instance for specimen accessioning and telemetry.
   • Credential-Verification Safeguard: Linking a service requires entering the administrative credentials of the target facility to verify authority.

---

3. Department & Ward Hierarchy Management

The Departments console manages the hospital's clinical and administrative departmental tree.

Hospital Department Directory and Head Doctor Assignment Console🔍 Click to enlarge

Hospital Department Directory and Head Doctor Assignment Console🔍 Click to enlarge

Managing Departments:

1. Click + Add new Department.
2. Department Name: Specify the official title (Emergency, Internal Medicine, General Surgery, Pediatrics, Obstetrics & Gynecology, ICU, Laboratory, Radiology, Pharmacy, Administration, Mortuary).
3. Head Doctor / Department Lead: Select the supervising physician or department sister from the doctor registry.
4. Location & Description: Enter physical building/wing coordinates and operational scope.
5. Staff Allocation: The department directory displays the active staff headcount, associated clinical queues, and operational status.

---

4. Granular Role-Based Access Control (RBAC)

The Access Control console provides a two-level security governance matrix enforcing strict least-privilege access across all clinical, administrative, and diagnostic domains.

Two-Level Access Architecture:

Level 1: Screen & Navigation Visibility

Controls which top-level dashboards and sidebar menu items are accessible to each role (Doctor, Nurse, Pharmacist, Lab Technician, Radiologist, Receptionist, Administrator). Inaccessible modules are completely hidden from the user interface.

Level 2: Granular Action & Resource Matrix

Defines exact CRUD and clinical permissions across 15 resource groups:

Resource Group	Managed Resources	Configurable Actions
Patient Management	Patients, Inpatients, Outpatients	Create, View, Edit, Delete
Appointments	Clinic Appointments, Theatre Bookings	Create, View, Edit, Delete, Reschedule
Beds & Wards	Wards, Beds, Inpatient Admissions	View, Allocate Bed, Transfer, Discharge
Medications	Prescription Orders, eMAR Administration, Dispense	Prescribe, Verify, Administer, Dispense
Laboratory	Lab Requests, Samples, Results	Order, Collect Sample, Enter Results, Verify
Imaging & PACS	Imaging Orders, DICOM Studies, Reports	Order, View DICOM, Write Report, Release
Emergency & Triage	Emergency Intake, MEWS Vitals, Triage Level	Intake, Triage, Escalate, Admit
Clinical Documentation	SOAP Notes, Vitals, Care Plans, Clinical Tasks	Create, View, Edit, Sign Note, Assign Task
Billing & Finance	Invoices, Charges, Credit Notes, Write-Offs	Create Invoice, Record Payment, Approve Write-Off
Registry	Birth Registry, Death Registry, Morgue	Register Birth, Certify Death, Release Body
Vaccinations & EIR	Vaccine Stock, Immunization Records	Administer Vaccine, Log Batch, View History
System Administration	Users, Roles, Permissions, Facility Config	Manage Staff, Modify RBAC, Export Logs

---

5. Transactional Email & Alert Relays

The Email Settings console manages outbound system notifications, clinical alerts, and operational event triggers.

Transactional Email Settings and Event Notification Trigger Configuration🔍 Click to enlarge

Transactional Email Settings and Event Notification Trigger Configuration🔍 Click to enlarge

Configurable Notification Categories:

1. Master Switch: Global toggle to enable or disable all outgoing facility email traffic.
2. Appointments: Triggers automated patient and clinician notifications for bookings, reschedules, and cancellations.
3. Laboratory: Dispatches high-priority alerts for critical abnormal lab results and sample rejections.
4. Pharmacy: Sends alerts for low medication inventory thresholds, cold-chain temperature excursions, and controlled substance movements.
5. Hospital Administration: Dispatches new staff welcome credentials, emergency roster notices, and system security alerts.

---

6. Immutable Security & Clinical Audit Trails

The Audit Logs console provides a tamper-proof, chronological record of every electronic interaction within the hospital network.

Immutable Security and Clinical Activity Audit Trail Console🔍 Click to enlarge

Immutable Security and Clinical Activity Audit Trail Console🔍 Click to enlarge

Tracked Security Events:

• Medical Record Access: Every patient chart view, demographic edit, clinical note modification, and data export.
• Breakglass Emergency Access: Dedicated audit tracking for out-of-scope patient chart openings, capturing the accessing clinician, exact timestamp, patient ID, and mandatory clinical justification.
• Clinical Decision Support (CDS) Overrides: Every override of a Contraindicated or Major drug interaction with the entered justification text.
• Financial Mutations: Invoice voids, discount applications, credit notes, and supervisor-authorized bad-debt write-offs.
• Authentication & Access: Successful logins, 2FA verifications, failed login attempts, password resets, and RBAC matrix modifications.

Compliance & Investigation Tools:

1. Multi-Parameter Search: Filter audit events by Actor Name / User ID, Resource ID (Patient Moana ID, Order ID, Invoice ID), Action Type, or Date & Time Window.
2. Breakglass Filter: One-click filter to isolate all emergency cross-cover access events for clinical governance review.
3. Export Audit Trail: Export signed audit reports in CSV or PDF format for legal, HIPAA, and ministry regulatory compliance reviews.