Users and data access
Access to the data in your Network instance is determined through your user profile settings. Administrators can provide or restrict access to objects, fields, and inbox tasks using Network features that are assigned to your user profile.
User profiles
Each Network user has a profile that includes details like the user role (such as administrator or data steward), timezone, and language. Permissions for some Network features can be granted directly on the user profile; for example, access to the Network reporting, API, and FTP servers.
The following features are assigned to user profiles to determine the objects, fields, and tasks that users can access in the Network UI.
Data visibility profiles
A data visibility profile (DVP) determines the access users have to records based on country and object type. For example, a data visibility profile for France can give a user access to all health care organizations but restrict their access to specific types of health care professionals. It also specifies additional permissions for features like Ad Hoc Match, search, and the ability to view specific types of records (for example, candidate records and opted out records).
Profile layouts
Profile layouts determine the fields that are included on records and where the fields display on the profile page. Profile layouts are assigned to data visibility profiles and then user profiles to determine how records display to the assigned users.
Inbox task groups
Inbox task groups define the task routing behavior for change requests
A request to change data from Veeva CRM, Vault CRM, the Network API, or from within the Network user interface. Change requests are processed by either customer or Veeva data stewards, depending on ownership of the data being changed. (DCRs) based on country and record type. They are assigned to data stewards and data managers to determine the DCRs that can be managed from their inbox. For example, you might want specific data stewards to process only STUDY custom objects, while other data stewards should process only Animal Health HCPs.
Inbox task groups are not assigned to standard users and integration users.
Dynamic access control
(Custom objects only). Dynamic access control provides granular access to a custom object by using rules that are assigned to specific users. If dynamic access control is enabled on a custom object, users cannot view the object unless they are assigned to a rule that meets the permission condition and have access to the object through their data visibility profile.
Examples for providing or restricting access to data
Administrators can govern how much or how little access users have to data in the Network instance.
Review the examples to understand how data can be restricted using one or more of these Network features: data visibility profiles, profile layouts, inbox task groups, and dynamic access control.
Example 1 - Restrict record access to specific HCOs and HCPs
Scenario: A data steward is responsible for processing records only for dentists and dental clinics in France.
Requirement: Provide access to dental-related records in France and restrict all other records in your Network instance.
To meet this requirement, you need to configure the following features:
- data visibility profiles
- inbox task groups
- user profile
Data visibility profile
Clone your existing DVP for France and filter it to include dentists and dental clinics only.
- Clone your DVP for France. This will give the user the same permissions and profile layout (EUStandard) as other users have for France.
- Save the cloned DVP as EU Data - FR - Dental Only.
-
In the Permissions section, filter the Health Care Professional Visibility and Health Care Organization Visibility sections to Include only the HCP Type for Dentist and HCO Type for Dentistry. Filtering the records by type will exclude all of the other HCP and HCO records in France that the user does not need access to.
Inbox Task Group
Create a new inbox task group to route DCRs for dental-related records in France.
- Create a new inbox task group: Data Steward - France - Dental Only.
-
In the Routing of Add/Change Requests section, filter the HCP Routing and HCO Routing sections to include only the HCP Type for Dentist and HCO Type for Dentistry.
User Profile
Update the user profile for the data steward.
Assign the following configurations to the user:
- Inbox Task Groups - Select the Data Steward - France - Dental Only group that you created.
- Data Visibility Profile - Select France(Country) and EU Data - FR - Dental Only (Profile).
Result
When this data steward logs into Network they will be able to search for and view records for dentists and dental clinics for France only. Any data change requests that are submitted for dentists and dental clinics for France will be routed to this data steward's inbox.
- Profile layout - HCP and HCO records for France use the EUStandard profile layout. Use this existing profile layout.
-
Data visibility profile - Clone your existing DVP for France. This will give the user the same permissions and profile layout (EUStandard) as other users have for France.
Save the cloned DVP as EU Data - FR - Dental Only. Edit the cloned DVP so you can filter the Health Care Professional Visibility and Health Care Organization Visibility sections to include only the HCP Type for Dentist and HCO Type for Dentistry. This will filter out all of the other HCP and HCO records in France that the user does not need access to.
-
Inbox Task Group - Create a new inbox task group for this specific use case: Data Steward - France - Dental Only.
In the Routing of Add/Change Requests section, filter the HCP Routing and HCO Routing sections for dentists and dentistry
-
User Profile - Create or update the user profile for the data steward.
Assign the following configurations to the user:
- Inbox Task Group - Select the Data Steward - France - Dental Only group that you created.
- Data Visibility Profile - Select France(Country) and EU Data - FR - Dental Only (Profile).
Result
When this data steward logs into Network they will be able to search for and view records for dentists and dental clinics for France only. Any data change requests that are submitted for dentists and dental clinics for France will be routed to this data steward's inbox.
Example 2 - Restrict field access
For many business users, the full Network record profile can include too much information. For example, business users in the United States might need to view only limited demographic information about HCPs.
Requirement: Restrict the fields that standard user types can view on record profiles for the United States.
To meet this requirement, configure the following features:
-
Profile layout - Clone the existing NAStandard profile layout for HCPs.
Save the cloned profile layout as US Limited HCP Data. Edit the cloned profile layout to remove fields that users do not need access to; for example, remove the entire External Identifiers and Record Information sections because they contain non-essential fields for business users. In the Primary Information section, you might remove fields like Specialty Rank 1 and Major Professional Activity.
-
Data visibility profile - Clone your existing DVP for the United States so you can assign the new profile layout to it. We'll call the new DVP, US Limited HCP Data.
In the Permissions section, you can include All HCPs unless you want to filter out specific records.
In the Profile Layout section, select the cloned profile layout that you created with the removed fields.
-
User profile - Update the user profiles for users that only need this limited view of HCP records.
Assign the following configuration to the user profile:
- Data Visibility Profile - Select United States (Country) and US Limited HCP Data (Profile)
Note: Inbox task groups do not apply to standard users.
Result
When the users that are assigned to this data visibility profile log into Network and search for records, the record profiles that display for HCPs will have much fewer fields than standard HCP profiles.