Real world data collection on the efficacy and drug usage of Raxone 150 mg 180 film-coated tablets for treatment of reduced vision in adolescent and adult patients with Leber’s hereditary optic neuropathy

Welcome at the technical documentation pages for the project "Real world data collection on the efficacy and drug usage of Raxone 150 mg 180 film-coated tablets for treatment of reduced vision in adolescent and adult patients with Leber’s hereditary optic neuropathy", provided by the service healthdata.be (Sciensano).

These pages provide information about the technical processes of the project. The following sections are (will be) provided:

General project information
The data collection
The data transfer (documentation in progress)
The data validation (documentation in progress)
The data analysis (documentation in progress)
The data reporting and visualisation (documentation in progress)

For scientific information of the project, please contact the primary organization that oversees implementation of project (see section "General project information").

manager Mon, 01/16/2023 - 08:02

General RAXONE project information

Project name

Project abbreviation

Raxone MEA

Project code

HDP0239

Primary organization that oversees implementation of project

Chiesi Pharmaceuticals

Partner organization participating in project

Not applicable

Organization that commissioned this project

National Institute for Health and Disability Insurance (RIZIV-INAMI)

Organization providing monetary or material support

Chiesi Pharmaceuticals

Brief project description

"Leber’s hereditary optic neuropathy (LHON) is a genetic disease that leads to sudden vision loss during young adult life. LHON is a disorder caused by mutations in the genetic code of the mitochondria, which are small subunits that reside within the cell. Mitochondria constantly convert energy locked in our food into energy that the cell can use.

Brain cells, including the optic nerves, which are particularly energy-demanding, are therefore, more prone to damage if the mitochondria are not able to produce energy properly. A lack of energy production can lead to degeneration and death of retinal ganglion cells (RGCs), which are the nerve cells that communicate visual information to the brain. Loss of these cells leads to subsequent degeneration of the optic nerve and visual loss.

An agreement with Chiesi for the temporary registration of a proprietary medicinal product on the list of reimbursable proprietary medicinal products, in accordance with the provisions of articles 112 to 117 inclusive of the royal decree of 1 February 2018 has been established with the working group for agreements (RIZIV/INAMI) and the Minister of Social Affairs. During the temporary reimbursement of 2 years, the company has to answer 6 questions (included in the agreement) to give an answer to the uncertainties that there are today."

Regulatory framework of this project

Consult the regulatory framework information published on the fair.healthdata.be pages.

manager Thu, 08/31/2023 - 15:56

The RAXONE data collection

Organizations and/or individuals that provide data

Text organizations and/or individuals that provide data

Start date of the data collection

dd/mm/yyyy

End date of the data collection

dd/mm/yyyy

Periodicity of the data collection

Text periodicity of the data collection

manager Thu, 09/07/2023 - 16:59

The RAXONE Data Collection Definition (HDBP0239)

...

Explanation of DCD specifications

The above Data Collection Definition (DCD) specifications are published in an MS Excel file using a slightly modified XLSForm format. XLSForm is a form standard created to simplify the creation of forms. The creation is done in a human readable format. XLSForms are a convenient standard for sharing and collaborating on form creation. For a detailed guide to the XLSForm standard, we refer you to https://xlsform.org/en/.

Each DCD Excel workbook has three worksheets: "settings", "survey" and "choices". Sometimes a project is composed of several DCDs. In this case, a "survey" worksheet is created for each DCD. The lists of values for all DCDs are listed in a single "choice" worksheet.

While not all survey and choice characteristics are used by healthdata.be to describe the data collection definitions, all standard XLSForm columns are present in the MS Excel file.

Note: healthdata.be itself does not use the XLSForm standard to create its DCD in its own applications (HD4DP, HD4Patient). The XLSForm standard (used by popular electronic data capture systems such as OpenClinica, LibreClinica, ODK,…) is chosen to describe the DCD only because it is a human readable format.

The "Survey" worksheet

This worksheet gives the general structure of the DCD and contains most of the content. It contains the complete list of variables and information on how they should appear in the form. Each row usually represents one variable.

The following columns are primarily used in the survey worksheet to describe DCD:

type: Defines the type of question/variable
name: Unique ID (name) of the question / variable
label::[English]: Question / variable in English, appears on the screen
label::[French]: Question / variable in French, appears on the screen
label::[Dutch]: Question / variable in Dutch, appears on the screen
label::[German]: Question / variable in German, appears on the screen
hint::[English]: Hint or explanatory text for a question, in English
hint::[French]: Hint or explanatory text for a question, in French
hint::[Dutch]: Hint or explanatory text for a question, in Dutch
hint::[German]: Hint or explanatory text for a question, in German
constraint_javascript: Constraint on the allowed values for a response defined in javascript
constraint_message::[English]: The message displayed to the user if the answer is not valid, in English
constraint_message::[French]: The message displayed to the user if the answer is not valid, in French
constraint_message::[Dutch]: The message displayed to the user if the answer is not valid, in Dutch
constraint_message::[German]: The message displayed to the user if the answer is not valid, in German
required: If a question or variable must be completed for the form to continue or be submitted
relevant_javascript: Skip logic condition (the relevant condition that must be met for this question to be displayed)
read_only: If a variable question/answer can be changed
calculation
repeat_count: Number of repetitions for a group of repetitions
hidden: Hidden fields in the HD4DP application

The "Choices" worksheet

This worksheet is used to specify answer choices for multiple choice questions. Each row represents an answer choice. Answer choices with the same list name are considered part of a set of related choices and appear together for a question/variable. This also allows a choice set to be reused for multiple questions/variables (for example, yes/no questions).

The following columns are primarily used in the choices worksheet to describe the DCD:

list_name: A unique name for each choice set
name: ID (name or code) of the specific choice
label::[English]: The choice label, in English, appears on the screen
label::[French]: The choice label, in French, appears on the screen
label::[Dutch]: The choice label, in Dutch, appears on the screen
label::[German]: The choice label, in German, appears on the screen

The "Settings" worksheet

form_title: Title displayed at beginning of form, in form list
public_key: Key required for encrypted forms
submission_url: Specific URL for uploading data
default_language: If form uses multiple languages, this one sets which to use by default
style: Separate questions groups into pages. Switch to a different theme.
instance_name: Allows user to create a dynamic naming convention for each submitted instance
status: status of the form: options are "final" and "draft"
start_date: date start form in production
end_date: date end form in production

manager Wed, 04/13/2022 - 16:46

The RAXONE Dataflow description

Below we describe (high level) the RAXONE dataflow between the data provider and the healthdata.be platform.

Stap 1. Automatische gegevensexport van de systemen van de gegevensverstrekker naar HD4DP v2 en vooraf invullen van formulieren indien niet volledig.

Stap 2. Handmatige registratie (de novo of aanvulling) van gegevens in de formuliercomponent van HD4DP v2.

Stap 3. Directe overdracht in real time van registervariabelen en technische ID van record vanaf HD4DP v2 naar HD.

Stap 4. Overdracht van patiëntenidentificatoren en technische ID uit het dossier van de HD4DP v2 naar de eHBox messaging client van de gezondheidszorginstelling (HCO UM/EM).

Stap 5. Overdracht van patiëntenidentificatoren en technische ID uit het dossier van de eHBox messaging client van de gezondheidszorginstelling (HCO UM/EM) naar de TTP-service van eHealth.

Stap 6. Overdracht van gepseudonimiseerde patiëntenidentificatoren en technische ID uit het dossier van de TTP-service van eHealth naar de eHBox messaging client van HD (HD UM/EM).

Stap 7. Overdracht van gepseudonimiseerde patiëntenidentificatoren en technische ID uit het dossier van de eHBox messaging client van HD (HD UM/EM) naar de HD-integratiemotor.

Stap 8. Samenvoeging van gepseudonomiseerde patiënt-ID's, registervariabelen op basis van de technische ID's en overdracht van data van de HD-integratiemotor naar de gegevensvalidatieomgeving op DHW.

manager Tue, 04/12/2022 - 16:20

HD4DP v2

In the following sections, we will provide you with information on how to proceed with the application HD4DP v2.

manager Tue, 01/04/2022 - 13:30

Request access to an HD application for a specific project

Healthdata.be applications such as HD4DP v2 and healthstat.be process sensitive personal information. Therefore, strictly controlled processes are used to grant access to these applications. The Entity Access Management (EAM) portal of healthdata.be facilitates these processes.

Due to the migration from EAM version 2.7 to EAM version 3.0 both systems will exist parallel during the transition period. Make sure that you always use the version currently available for your organization.

Below you will find the links to the user manuals to the different EAM systems. When selecting the desired version, the manual will appear in a separate tab.

When requesting access via the EAM portal version 2.7, go here.

When requesting access via the EAM portal version 3.0, go here.

This documentation is being updated regularly. We try to provide as correct, complete and clear as possible information on these pages. Nevertheless, if you see anything in the documentation that is not correct, does not match your experience or requires further clarification, please create a request (type : request for information) via our portal (https://sciensano.service-now.com/sp) or send us an e-mail via support.healthdata@sciensano.be to report this documentation issue. Please, do not forget to mention the URL or web address of the page with the documentation issue. We will then adjust the documentation as soon as possible. Thank you!

manager Fri, 11/10/2023 - 10:27

User roles in HD4DP v2

Each healthcare organisation has at least one Access Manager who is watching over the access rights to the applications of the own organisation and is managing them in the HD Entity Access Management (EAM) system. In this process, access requests by healthcare organisation employees are analysed and validated if legitimised. The scope of the accesses granted to HD4DP2 may differ, which is reflected in various user roles. Based on access rights, following three user roles can be distinguished:

Local Study Lead (author):

The Local Study Lead can:

edit and review all peer registrations (regardless of role) for the study or project;
make registrations in HD4DP v2

This role might be but should not be limited to the responsible for the study or project within the participating healthcare institution.

Local Study Associate (author):

The Local Study Associate can:

edit and review the own registrations, not those of other colleagues from the same healthcare organisation participating in the same study or project. The indicated registrations are limited to the patients treated by the Local Study Associate;
make registrations in HD4DP v2.

The Local Study Associate is a healthcare provider participating in the study or project. This is reflected in the registration form.

Local Study Support (co-author):

The Local Study Support can:

edit and review registrations belonging to the author group they are linked to;
make registrations in HD4DP v2.

A Local Study Associate and Local Study Lead can delegate registration tasks to a Local Study Support. This might be but should not be limited to an administrative assistant or staff from a medical coding department. The Local Study Associate and Local Study Lead are still considered the author of the registration; the Local Study Support is considered the co-author. The Local Study Associate and Local Study Lead can view and modify Local Study Support entries.

By default, only 1 Local Study Lead is intended by healthdata.be (Sciensano) for each project within each organisation. The idea is that only one person is meant to see all submissions for that project within that organisation. This policy prevents users of HD4DP v2 from seeing personal and sensitive information from individuals with whom they do not have a therapeutic relationship. For policy deviations on this, healthcare organisation staff should contact their Data Protection Officer (DPO).

Remarks:

The scope of the access rights does not necessarily reflect the hierarchy within your healthcare organisation.
It is up to the Access manager to change roles from/to Local Study Lead, Local Study Associate and Local Study Support. These requests are carried out in the EAM system.

Bart.Servaes Thu, 11/09/2023 - 14:40

Access the HD4DP v2 application

Access the HD4DP v2 application manager Fri, 12/09/2022 - 16:37

Navigate to the RAXONE project

When logged in, you will see the Welcome page. In the left dark blue menu you can see all the study programs and projects you have access to.

When you select the study program Chiesi Managed Entry Agreement, you can see the study project MEA Raxone.

Select the study project MEA Raxone.

You will see that the study project MEA Raxone consists of only one part: MEA Raxone.

manager Tue, 04/12/2022 - 16:20

Create a RAXONE registration

To create a registration for the study project Raxone MEA, select "Raxone MEA" in the dark blue left menu.

You will see the number of versions of this study section. In this case, there is only one version.

When you select the highest version of this study section for the first time, you will see an empty overview table in the main part of your screen. The table contains, among others, the following items: Registration ID, Progress, Author, Co-author, Unique ID, Business key, Registration code, National registry ID of the patient...

In the top right corner of the screen you can find a green button "+ New registration". Press this button.

After pressing the button "+ New registration", the main screen will now be replaced with 2 sections: a study form (in the middle of the screen) and a Table of contents (on the right side of the screen).

By completing the study form, you will create a "Primo-implantation" registration for the study project Endobronchial valve.

The Table of contents indicates which sections you must complete. You can also use the table of contents to navigate through the study form: pressing a section in the table of contents will take you to this section in the study form.

By pressing the tab "Progress" on the right side of the screen , the Table of contents will be replaced by a progress bar and a list of open validation errors.

You can use the list of open validation errors to navigate through the study form: pressing a validation error in the list will take you to this section in the study form.

When the study form is completed and there are no validation errors, you can Save or Submit this registration. Notice that the Submit button is in clear green.

When the study form is completed but there are validation errors, you can Save but not Submit this registration. Notice that the Submit button is in dim green.

When the study form is saved or submitted, the screen switches to the overview table. Now, this table is not empty anymore but shows the saved or submitted registration.

manager Tue, 04/12/2022 - 16:20

Find a RAXONE registration

To find a registration for the study project Raxone MEA, select "Raxone MEA" in the dark blue left menu.

When you select a version of this study section, you will see the summary table in the main part of your screen. This table contains, among other things: Registration ID, Progress, Author, Co-author, Unique ID, Business Key, Registration Code, National Patient Registry Number…

In the header of the summary table, you can use the filter below each column label. In the example below, the last name "Khan" has been entered in the filter (text field), so only the record with "Khan" is displayed.

manager Tue, 04/12/2022 - 16:21

Update a RAXONE registration

A "Raxone MEA" registration can be updated as long as the registration has not yet been submitted. If the status of a registration is "Saved" , the registration can still be updated.

To update a registration for the study project Raxone MEA, select "Raxone MEA" in the dark blue left menu.

When you select a version of this study, you will see the summary table in the main body of your screen. The table includes the following items: Registration ID, Progress, Author, Co-author, Unique ID, Business Key, Registration Code, National registry number of the patient.…

Use the filters in the header of the table to find the registration you want to update.

Once you have found the registration, you can open the registration's study form by clicking on the corresponding row in the summary table.

You can complete missing fields and/or change previously completed fields in the survey form.

At the end of the survey form, you can Save or Submit the registration.

A registration can be updated as long as it has the status "Saved" and as long as the registration not has been submitted. A submitted registration cannot be updated or deleted again.

manager Tue, 04/12/2022 - 16:21

Delete a RAXONE registration

A "Raxone MEA" registration can be deleted as long as the registration has not yet been submitted. If the status of a registration is "Open" , the registration can still be deleted.

To delete a registration for the study project Raxone MEA, select "Raxone MEA" in the dark blue left menu.

When you select a version of this course of study, you will see the summary table in the main body of your screen. The table includes the following items: Registration ID, Progress, Author, Co-author, Unique ID, Business Key, Registration Code, National registry number of the patient...

Use the filters in the header of the table to find the registration you want to delete.

Once you have found the registration you want to delete, you must select the registration by checking the checkbox at the beginning of the row in the summary table.

Then you need to press the "Actions" button at the top right of the summary table.

There are now two options, "Submit" and "Delete". Now press "Delete".

After you press "Delete," a pop-up message will appear asking you to confirm the deletion of the selected registration(s). If you are sure about this action, press "Confirm." If not, press "Cancel."

If you delete the registration, you cannot change its status or content.

The deleted registration will not be removed from the summary table. It remains present, but the status has changed from "Open" to "Deleted".

If you want to see only Open and Sent registrations, you can adjust the filter on the "Status" item in the summary table.

A registration can be deleted as long as the registration has not yet been submitted. If the status of a registration is "Open", the registration can still be deleted.

manager Tue, 04/12/2022 - 16:21

Submit a RAXONE registration

A "Raxone MEA" registration can be submitted at the end of the creation process using the study form (see: Create a Raxone MEA registration).

When the registration was completed using the study form, saved and there are no more validation errors, the registration can also be submitted via the overview table. This method can be useful to submit multiple registrations in the same action.

To submit a registration for the study project Raxone MEA using the overview table, select "Raxone MEA in the dark blue left menu.

Use the filters in the header of the table to find the registration(s) you want to submit. For example, you can use the filters "Status" (set to "Open") and "Validation Errors" (set to "0") to find the registrations that are eligible for submission.

Once you have found the registration(s) you want to submit, you must select the registration(s) by checking the checkbox at the beginning of the row in the summary table.

Then you need to press the "Actions" button at the top right of the summary table.

There are now two options, "Submit" and "Delete". Now press "Submit".

After you press "Submit," a pop-up message will appear asking you to confirm the submission of the selected registration(s). If you are sure about this action, press "Confirm." If not, press "Cancel."

Once you confirm the submission, you cannot change the content of the registration(s). Sent registrations can also no longer be deleted.

The sent registration remains present in the summary table, but the status has changed from "Open" to "Submitted".

If you want to see only "Open" registrations, you can adjust the filter on the "Status" item in the summary table.

A registration can be submitted at the end of the creation process using the study form (see: Create a [project] registration).

manager Tue, 04/12/2022 - 16:21

HD4DP v2 csv upload

Introduction

This page explains the functioning of the CSVUploader feature. The CSVUploader feature is aimed to do a bulk upload of records : by filling a csv file, one record per row represents one submission so a user can fill as much records as needed.

Architecture

The CSVUploader is located under hd-connect/csvuploader. It uses both hd-connect-csvuploader and hd-connect-proxy modules.

The general architecture of the CSVUploader is explained in the sequence diagram below.

Third-party libraries and frameworks

Apache Camel: https://camel.apache.org/
Spring Boot

Testing and working

The CSVUploader creates a folder at root level (SFTP for end-user, or hd-all for developer) that contains a subfolder per existing organisation.
The CSVUploader will poll with a delay of 1 min, process the csv file and then create 3 folders:
- ARCHIVE folder: contains the source csv file.
- RESULTS folder: contains the results of processing the csv file. This file contains the specified data, and the final status of the processing: Success or Error. If an error occurred, the error message is displayed. For multiple uploads, the result is added to the end of the result file each time.
- ERROR folder: this folder is created if the csv test file was not processed, due to an I/O error (file corrupted, not found etc.). So for now, only technical errors are caught and the source csv file is moved to that folder instead of the ARCHIVE folder. In principle, this folder should contain any result that is an error. The RESULT folder should only contain results that end with a SUCCESS status.

Formats

Some formats are specific:

Dates: should be dd/mm/yyyy
Boolean: true / false
Codes: the value of the code (not the translation)
Multi codes: there is only one column per field. So when a select box is set as multiple, values have to be separated by a "|". e.g.: 68452|68453|68454
Repeatable blocks: in some DCDs, a complete block of fields is repeatable. In that case, value have to be separated by a ";"
- e.g.: A block is containing 3 fields: A (Lob), B (Type klep) and C (Aantal kleppen)

Examples:

In case of a multiple choice:

Example of a multiple choice as presented in the DCD:

Uploading the csv file into the correct DCD folder

The main folder structure of the csv upload folder will look as such:

Each folder consists of sub folders which contains the DCD.

Find below an overview of the DCD's that can be uploaded.

Orthopridetotalfemur-9:
- Primo-implantation
- Revision
- Resection

The csv files will be placed in the folders of the DCD which we want to upload. We double click on the folder of the dcd and the structure will be either empty, whether filled with folders containing the following names:

ARCHIVE (after a csv file has been processed, the original csv file will be saved in this folder)
RESULT (when the csv file has been processed, a file will be created or append with the result of the upload of the csv file)
ERROR (when the csv file contains erroneous formatting, the csv file won't get processed and an error file will be created or append with the errors and reason why the csv file couldn't be processed)

I want to upload an Orthopride Knee Primo-Implantation DCD, so I will place the csv file into the dcd-21-v-1-kneePrimoImplantation folder:

Open the dcd-21-v-1-kneePrimoImplantation folder

Put the orthopride knee primo implantation csv file into the folder

Wait until the file has been processed (the file will disappear from this folder if it has been processed - don't forget to click on the refresh button)

Go into the RESULT folder and refresh the folder to update the file with the latest changes

Double click the file to open it and to read the result of the upload process

The status is the most important line that indicates whether the upload was a success or not.

Verification of the upload process is also possible in the application HD4DP2.

After login to HD4DP2 go to relevant DCD and check the processed data.

manager Tue, 07/05/2022 - 09:21

csv upload for RAXONE

csv upload for RAXONE manager Tue, 04/12/2022 - 16:22

HD4DP v2 API

HD4DP v2 API manager Tue, 01/04/2022 - 13:33

API for RAXONE

API for RAXONE manager Wed, 01/25/2023 - 13:59

HD4DP v2 Support Services

HD4DP v2 Support Services manager Wed, 01/12/2022 - 17:19

How to report an incident

The healthdata.be service (Sciensano) processes each incident report according to a Standard Operating Procedure (SOP). A public version of this SOP "HD Incident Management Process" is also available on this portal docs.healthdata.be.

To submit an incident related to projects and applications in production and facilitated or managed by Sciensano's healthdata.be service, you must first log into the HD Service and Support portal: https://sciensano.service-now.com/sp.

After the login step, you will arrive at the main page of the portal.

On the main page, you must select "Get Help".

A new page with the title "Create an incident" will appear.

You can now document your incident or problem by providing the following information:

Please indicate the urgency of resolving your issue based on its criticality to the business.

Please indicate the type of problem you are experiencing.

When the problem type "Application" is selected, two additional fields appear: "Project Name" and "Application".

Please select the appropriate information.

Please describe clearly and briefly (1 sentence) the subject of your problem.

Please describe the problem in detail. The following aspects are important for us to understand and solve the problem:

a description of the actions you want to perform but fail to perform (e.g. provide us with a field name, a validation rule, a button, etc.)
a description (if possible) of the sequential steps you follow to use the service or the application of healthdata.be for which you need support;
a brief description of the technical problem you are experiencing (e.g. error messages)

We strongly recommend that you add a screenshot describing the problem (IMPORTANT: do not provide us with patient data!).

You can add the screenshot by clicking on "Add attachments".

On the right side of the form, the mandatory information items of the incident form are listed. When these fields are completed, their names disappear from the "required information" box.

The form can only be submitted if all required fields are filled in, by pressing the green "Submit" button.

If all required fields have not been completed, a warning message will appear at the top of the form.

In addition, missing mandatory fields will be highlighted in green.

When the incident form has been successfully submitted, a preview of your submission appears in a new screen.

On the right side of the screen you will find the details, including the incident number.

On the left side of the screen, you will find a chronology of your incident processing, starting with your creation.

manager Wed, 01/12/2022 - 17:20

Support services

The Service Desk of healthdata.be (Sciensano) helps users of our applications and services and deals with requests and problems when they arise.

The Service Desk focuses on those services run by our IT Services (HD4DP, HD4RES, healthstat.be,...) and helps you with accounts and passwords. For questions about the content and objective(s) of the projects, we kindly refer to the managing research organizations.

For most efficient processing of your request, we advise you to use our service portal: https://sciensano.service-now.com/sp.

Please find below our support window hours:

manager Thu, 08/11/2022 - 19:04

How to report an incident

After the login step, you will arrive at the main page of the portal.

On the main page, you must select "Get Help".

A new page with the title "Create an incident" will appear.

You can now document your incident or problem by providing the following information:

Please indicate the urgency of resolving your issue based on its criticality to the business.

Please indicate the type of problem you are experiencing.

When the problem type "Application" is selected, two additional fields appear: "Project Name" and "Application".

Please select the appropriate information.

Please describe clearly and briefly (1 sentence) the subject of your problem.

Please describe the problem in detail. The following aspects are important for us to understand and solve the problem:

a description of the actions you want to perform but fail to perform (e.g. provide us with a field name, a validation rule, a button, etc.)
a description (if possible) of the sequential steps you follow to use the service or the application of healthdata.be for which you need support;
a brief description of the technical problem you are experiencing (e.g. error messages)

We strongly recommend that you add a screenshot describing the problem (IMPORTANT: do not provide us with patient data!).

You can add the screenshot by clicking on "Add attachments".

On the right side of the form, the mandatory information items of the incident form are listed. When these fields are completed, their names disappear from the "required information" box.

The form can only be submitted if all required fields are filled in, by pressing the green "Submit" button.

If all required fields have not been completed, a warning message will appear at the top of the form.

In addition, missing mandatory fields will be highlighted in green.

When the incident form has been successfully submitted, a preview of your submission appears in a new screen.

On the right side of the screen you will find the details, including the incident number.

On the left side of the screen, you will find a chronology of your incident processing, starting with your creation.

johanvanbussel Sun, 04/10/2022 - 19:40

Submit a request for information about HD

To request information about the healthdata.be platform, you first need to log in to the HD Service and Support portal: https://sciensano.service-now.com/sp.

Om informatie op te vragen over het healthdata.be platform, moet u eerst inloggen op het HD Service- en Supportportaal.

Jonas.VanBussel Tue, 08/08/2023 - 09:58

Email security policy

WHAT IS THE PROBLEM?

Sciensano blocks e-mails from organizations if the configuration of their e-mail and/or DNS services allow potential abuse by spammers/attackers. More specifically, if the configuration enables other senders to impersonate your organisation by allowing them to mimic your organization’s e-mail “Header From”.

In other words, they can send phishing and spam mails that cannot be distinguished from genuine mails from your organization.

If you’re responsible for managing your ICT infrastructure, keep reading. If not, pass this message on to your ICT department or to the ICT service that’s managing your ICT infrastructure.

HOW TO SOLVE IT?

You’ll have to verify that your configuration complies with “Sender Alignment” security requirements.
More specifically, your mail services and DNS will have to be configured according to ICT standards.

These configurations are common, well-documented and supported by hosting companies. Some useful links:

We’ve noticed that this issue frequently occurs in organizations which moved their ICT infrastructure to cloud services such as Microsoft (O365), Amazon, Google, and MS Azure without properly configuring the ICT infrastructure which is not managed by these providers.

The configurations and recommendations need to be implemented on the customer’s ICT infrastructure, either internally or externally. DNS and Mail services are the main ICT platforms for these actions.

THE USE OF DIFFERENT DOMAINS IN THE MAIL SENDING PROCESS

E-mails contain an “Envelope From” and a “Header From”. Both need to match to avoid that the mail is blocked.

Some examples:

A public service is using its new domain name in the “Header From” and its old domain name in the “Envelope From”.

Envelope From = noreply@publicservice.fgov.be
Header From = noreply@publicservice.belgium.be

➔ These e-mails will be blocked.

Remark: Because it’s a noreply address, the sender will not even be aware of us rejecting the e-mail …

2. An organization is using a cloud service (Freshservice) for its helpdesk tool and the “Envelope From” has not been customised.

• EnvelopeFrom = bounces+us.3.52773-helpdesk=organisation.be@emailus.freshservice.com
• Header From = helpdesk@organisation.be

➔ These e-mails will be blocked.

3. A company uses a cloud service (Amazon SES) to send the delivery notification and the “Envelope From” has not been customized.

Envelope From = 01020188573f374-96de6437-9134-45f4-8aa6-3e9ac18d5848-000000@euwest-1.amazonses.com
Header From = noreply@company.be

➔ These e-mails will be blocked.

Jonas.VanBussel Fri, 08/04/2023 - 09:19