Release Notes for Oracle Health Insurance Authorizations Patch 4.25.1.0.4

This document contains the release notes for Oracle Health Insurance Authorizations Patch 4.25.1.0.4.

Version compatibility: Oracle Health Insurance Authorizations Release 4.25.1.x is only compatible with other Oracle Health Insurance applications release version 4.25.1.x unless explicitly stated otherwise.

In accordance with the OHI error correction policy (Document 1494031.1 on My Oracle Support), error correction support will be provided for this release and the previous two releases.

Enhancements

ID Summary Patch

ID	Summary	Patch
CPN-4206	Introduced additional attributes in security logs for enhancing log auditing and parsing capabilities Introduced the following new attributes in security logs: eventCategory: All security events are categorized into distinct categories. This attribute holds the category assigned to the security event being logged. eventType: Brief summary of the security event being logged. eventOutcome: Outcome of the event. Possible values: Success or Failure. eventSeverity: Describes the severity of the event. Possible values: INFO, WARN or ERROR. httpStatusCode: Http response code of the request for which the event is being logged. This will be null whenever the code is not deterministic at the time of event. failureReason: Briefly describes the reason of failure. This attribute will be non-null only where relevant. apiEndpoint: Holds the API endpoint to which the request was sent. session ID: Identifies the session provided by the caller. Applicable to SaaS and UI requests. access token ID: Identifies the access token associated with the request. Applicable to SaaS and non-UI requests Documentation Links: Administration Guide - Application - Security Logs Generated in Oracle Health Insurance Administration Guide - Fetch Security Logs through API
CPN-4207	Enhanced PHI access logs to include access scope, session ID and access token ID Enhanced PHI access logs to include three new attributes: access scope: Indicates whether a single record or multiple records are accessed within a transaction. session ID: Identifies the session provided by the caller. Applicable to SaaS and UI requests. access token ID: Identifies the access token associated with the request. Applicable to SaaS and non-UI requests. Documentation Links: Security Guide - User Access - Resource Auditing
NXT-26542	Exposed generic API for deployment metadata and extended User Preferences to support switching between customer and browser timezones A generic deployment metadata API is now available to retrieve the customer time zone. The User Preferences API includes a new `browserTimeZone` flag, which defaults to `false`. When set to `true`, timestamps are displayed in the end user’s browser time zone. When set to `false`, timestamps are displayed in the configured customer time zone.
NXT-31594	JET: Save user preferences for table displays This enhancement enables you to save your table column selections and column widths on supported pages. After you adjust a table, select Save Preferences to save your settings for that page. Where it applies System- or floorplan-driven pages that use following templates when the `flexColumn` property is `true` (Note: Default setting is `true`): View/Edit List Search Object Table Supported pages and tables Product Definition Product Service Definition table in products and across products page Claims Draft provider pricing clause table within worksheet and across worksheet page Fee Schedule lines Provider Pricing Clause Claim lines table within claims page Common Reference Sheets Documentation Links: Security Guide - User Access - Functional Access Restriction (JET)
NXT-32464	Non-Unique Provider Identifiers This enhancement enables the configuration setting that controls whether a provider identifier is unique across providers. Documentation Links: Configuration Guide - Provider Identifiers
NXT-32471	Improve handling of HTTP error: 401 UnAuthorized in JET UI With this enhancement, OHI uses system property OHI_DEPLOYMENT_TYPE to handle HTTP 401 error. When this property value is set to "CLOUD", this will force a "401" response to re-direct the OHI JET login page when the IDCS OpenID session cookie is missing/expired.
NXT-33659	Disable user location based time conversion JET UI no longer relies only on the user’s browser timezone for datetime display. This helps prevent incorrect time conversion for customers operating across different geographic locations. The customerTimeZone, configured in the deployment metadata table during application installation, is used by default by JET UI. Users can override this through the "Use Browser Timezone?" option in the Preferences dialog, after which the UI will use the browser timezone. If customerTimeZone is not configured or is invalid/unsupported by JET, the UI falls back to the browser timezone. Documentation Links: Developer Guide - JET UI - References - Properties - Properties Security Guide - User Access - Function Access Restriction (JET)
NXT-33697	UI: European date/number formatting for English Language With this enhancement, support is added to keep the UI in English language while using European date and number formats (e.g., dd/MM/yyyy and 1.234.567,00), when user sets 'en‑EU' in the existing ohi.ui.default.locale system property. If the property is not set, date and number formats continue to follow the user’s selected locale (language + region), with no change in behaviour.
NXT-33718	Extended user preference - Reorder and Auto-commit With this enhancement it is now possible to reorder table columns as per user’s preference. Also, the save button to store preference is replaced by auto commit feature. This feature is available for all pages based on the following floor plan template: View and Edit List Table List View - Table This feature is also available for selected pages which are not floorplan based: Common Pages like Reference sheets. Claims page claim line tab. In Policies application, pages like Premium schedule lines, Adjustment lines, and Fee schedule lines. Documentation Links: Developer Guide - JET UI - References - Components - Table

CPN-4206

Introduced additional attributes in security logs for enhancing log auditing and parsing capabilities

Introduced the following new attributes in security logs:

eventCategory: All security events are categorized into distinct categories. This attribute holds the category assigned to the security event being logged.
eventType: Brief summary of the security event being logged.
eventOutcome: Outcome of the event. Possible values: Success or Failure.
eventSeverity: Describes the severity of the event. Possible values: INFO, WARN or ERROR.
httpStatusCode: Http response code of the request for which the event is being logged. This will be null whenever the code is not deterministic at the time of event.
failureReason: Briefly describes the reason of failure. This attribute will be non-null only where relevant.
apiEndpoint: Holds the API endpoint to which the request was sent.
session ID: Identifies the session provided by the caller. Applicable to SaaS and UI requests.
access token ID: Identifies the access token associated with the request. Applicable to SaaS and non-UI requests

Documentation Links:
Administration Guide - Application - Security Logs Generated in Oracle Health Insurance
Administration Guide - Fetch Security Logs through API

CPN-4207

Enhanced PHI access logs to include access scope, session ID and access token ID

Enhanced PHI access logs to include three new attributes:

access scope: Indicates whether a single record or multiple records are accessed within a transaction.
session ID: Identifies the session provided by the caller. Applicable to SaaS and UI requests.
access token ID: Identifies the access token associated with the request. Applicable to SaaS and non-UI requests.

Documentation Links:
Security Guide - User Access - Resource Auditing

NXT-26542

Exposed generic API for deployment metadata and extended User Preferences to support switching between customer and browser timezones

A generic deployment metadata API is now available to retrieve the customer time zone. The User Preferences API includes a new browserTimeZone flag, which defaults to false. When set to true, timestamps are displayed in the end user’s browser time zone. When set to false, timestamps are displayed in the configured customer time zone.

NXT-31594

JET: Save user preferences for table displays

This enhancement enables you to save your table column selections and column widths on supported pages. After you adjust a table, select Save Preferences to save your settings for that page.

Where it applies

System- or floorplan-driven pages that use following templates when the flexColumn property is true (Note: Default setting is true):
- View/Edit List
- Search Object Table

Supported pages and tables

Product Definition
- Product Service Definition table in products and across products page
Claims
- Draft provider pricing clause table within worksheet and across worksheet page
- Fee Schedule lines
- Provider Pricing Clause
- Claim lines table within claims page
Common
- Reference Sheets

Documentation Links:
Security Guide - User Access - Functional Access Restriction (JET)

NXT-32464

Non-Unique Provider Identifiers

This enhancement enables the configuration setting that controls whether a provider identifier is unique across providers.

Documentation Links:
Configuration Guide - Provider Identifiers

NXT-32471

Improve handling of HTTP error: 401 UnAuthorized in JET UI

With this enhancement, OHI uses system property OHI_DEPLOYMENT_TYPE to handle HTTP 401 error. When this property value is set to "CLOUD", this will force a "401" response to re-direct the OHI JET login page when the IDCS OpenID session cookie is missing/expired.

NXT-33659

Disable user location based time conversion

JET UI no longer relies only on the user’s browser timezone for datetime display. This helps prevent incorrect time conversion for customers operating across different geographic locations. The customerTimeZone, configured in the deployment metadata table during application installation, is used by default by JET UI. Users can override this through the "Use Browser Timezone?" option in the Preferences dialog, after which the UI will use the browser timezone. If customerTimeZone is not configured or is invalid/unsupported by JET, the UI falls back to the browser timezone.

Documentation Links:
Developer Guide - JET UI - References - Properties - Properties
Security Guide - User Access - Function Access Restriction (JET)

NXT-33697

UI: European date/number formatting for English Language

With this enhancement, support is added to keep the UI in English language while using European date and number formats (e.g., dd/MM/yyyy and 1.234.567,00), when user sets 'en‑EU' in the existing ohi.ui.default.locale system property. If the property is not set, date and number formats continue to follow the user’s selected locale (language + region), with no change in behaviour.

NXT-33718

Extended user preference - Reorder and Auto-commit

With this enhancement it is now possible to reorder table columns as per user’s preference. Also, the save button to store preference is replaced by auto commit feature.

This feature is available for all pages based on the following floor plan template:

View and Edit List Table
List View - Table

This feature is also available for selected pages which are not floorplan based:

Common Pages like Reference sheets.
Claims page claim line tab.
In Policies application, pages like Premium schedule lines, Adjustment lines, and Fee schedule lines.

Documentation Links:
Developer Guide - JET UI - References - Components - Table

Upgrade Steps for Installation

To perform the upgrade, perform the following steps:

Perform any pre-upgrade steps.
Stop all the managed nodes running the existing version of the application.
Perform any pre-undeploy steps.
Undeploy the existing version of the application.
Back up the database.
Perform any post-undeploy steps.
Unpack the release bundle into a directory that we refer to as OHI_ROOT from now on.
Change Installation Configuration: In <OHI_ROOT>/util/install, make a copy of ohi_install.cfg.template and name it ohi_install.cfg.
Edit ohi_install.cfg to contain your specific database connection data and other configuration settings. The settings are explained in the file itself.
Make sure NO connections are present to the database using the OHI_xxx_USER account (where xxx is the abbreviation of the application)
Run the Upgrade script:
1. Open a command window and browse to <OHI_ROOT>/util/install.
2. Run the upgrade by executing ./ohi-update.sh .
Make the required changes to the ohi properties file
Perform any post-upgrade steps
Start WebLogic application server
Deploy the Application
Perform any post-deploy steps

Configuration Properties

This section intentionally left blank.

Web Services

Ref Action Description

Ref	Action	Description
CPN-4206	Modified	logsecurityevents Added eight new attributes: `eventCategory`, `eventType`, `eventOutcome`, `eventSeverity`, `httpStatusCode`, `failureReason`, `apiEndpoint`, `sessionId`, `accessTokenId`.
CPN-4207	Modified	logphievents Added three new attributes: `accessScope`, `sessionId`, and `accessTokenId`.
NXT-26542	Added	deploymentmetadata API New read-only generic API is added.
NXT-26542	Modified	userpreferences API Added a new attribute browserTimeZone to the user preferences API.
NXT-32464	Modified	Provider IP If more than 1 provider is matched to an identifier, then an error message is thrown

CPN-4206

Modified

logsecurityevents

Added eight new attributes: eventCategory, eventType, eventOutcome, eventSeverity, httpStatusCode, failureReason, apiEndpoint, sessionId, accessTokenId.

CPN-4207

Modified

logphievents

Added three new attributes: accessScope, sessionId, and accessTokenId.

NXT-26542

Added

deploymentmetadata API

New read-only generic API is added.

NXT-26542

Modified

userpreferences API

Added a new attribute browserTimeZone to the user preferences API.

NXT-32464

Modified

Provider IP

If more than 1 provider is matched to an identifier, then an error message is thrown

Data Conversion

Ref	Action	Description
NXT-32464	Removed	Provider Identifiers Unique constraint on identifier and identifier type is dropped in all the applications.

Ref

Action

Description

NXT-32464

Removed

Provider Identifiers

Unique constraint on identifier and identifier type is dropped in all the applications.

Dynamic Logic

This section intentionally left blank.

UI Changes

Ref	Action	Description
NXT-33659	Modified	Preferences Dialog A new checkbox - "Use Browser Timezone?" has been introduced in Preferences which can be used to override the customer’s configured timezone.

Ref

Action

Description

NXT-33659

Modified

Preferences Dialog

A new checkbox - "Use Browser Timezone?" has been introduced in Preferences which can be used to override the customer’s configured timezone.

Breaking Changes

Ref Action Description

Ref	Action	Description
AUT-4724	Modified	The Authorization IP Status API now returns HTTP 200 OK instead of 409 Conflict Authorizations IP status operation for authorizations that are still in a submittable status will now return a successful `200 OK` response with a structured status payload with progress: `notStarted` instead of a `409 Conflict`. Sample response body: `{ "progress": "notStarted", "completed": false, "links": [ { "href": "http://[hostName]:[portNumber]/[api-context-root]/authorizations/{id}/status", "rel": "self" }, { "href": "http://[hostName]:[portNumber]/[api-context-root]/generic/authorizations/{id}", "rel": "related" } ] }`

AUT-4724

Modified

The Authorization IP Status API now returns HTTP 200 OK instead of 409 Conflict

Authorizations IP status operation for authorizations that are still in a submittable status will now return a successful 200 OK response with a structured status payload with progress: notStarted instead of a 409 Conflict.

Sample response body:

{
    "progress": "notStarted",
    "completed": false,
    "links": [
    {
      "href": "http://[hostName]:[portNumber]/[api-context-root]/authorizations/{id}/status",
      "rel": "self"
    },
    {
      "href": "http://[hostName]:[portNumber]/[api-context-root]/generic/authorizations/{id}",
      "rel": "related"
    }
  ]
}

Access Restrictions

Ref	Action	Description
NXT-33659	Modified	CO0019 The 'deploymentmetadata API' access restriction has been added to function code CO0019.

Ref

Action

Description

NXT-33659

Modified

CO0019

The 'deploymentmetadata API' access restriction has been added to function code CO0019.

Bug Fixes

BugDB SR Internal Summary

BugDB	SR	Internal	Summary
39573197		AUT-4848	Translation errors are seen while running the JET UI in Virtual Machines
Description:	The JET UI was not fully compatible with virtualized environments, causing translation-related errors during application use.
Resolution	Updated the JET UI configuration and handling to ensure translations load and function correctly when the application runs in a Virtual Machine.
39187589		AUT-4724	Authorizations IP status operation returned 409 conflict for an authorization in a submittable status
Description:	Authorizations IP status operation for an authorization in a submittable status (Entry, Change, Pended) resulted in an unexpected HTTP 409 Conflict response. This prevented clients from reliably polling or querying the processing status of newly created or not-yet-submitted authorizations.
Resolution:	Authorizations IP status operation for authorizations that are still in a submittable status will now return a successful `200 OK` response with a structured status payload with progress: `notStarted` instead of a `409 Conflict`.
39181940		AUT-4717	Operational reports should allow users to enable usage of full view to display data grid
Description:	In operational report page data-grid is not utilizing the full available space on the page, resulting in white space below the data grid.
Resolution:	The pageSize configuration has been removed, as the data grid will now display at full height based on the available screen height.
39526137		AUT-4833	PHI logging includes unmatched 'left joins' rows
Description:	When a query selects a PHI column from the right side of a LEFT JOIN, PHI logging is created for all rows from the left-side table, including rows where the joined row does not exist. In those cases the PHI column is effectively null, but a PHI log event is still written. This leads to incorrect PHI audit entries for rows that did not actually expose PHI.
Resolution:	When the joined column is marked as PHI but there is no match, no PHI Event is logged for that missing column.
39526240		AUT-4834	PHI audit logs corrected for aliased base views in data transfer payloads
Description:	In specific data transfer scenarios, when a base view is queried through an alias and the Base View is outside of the Relation context, PHI logging was not generated correctly.
Resolution:	The system now generates the PHI audit logs correctly for these aliased base view scenarios.
38791851		AUT-4531	ohiHttpRequest is not accessible from dynamic logic within Authorizations
Description:	Outbound HTTP requests could not be initiated from dynamic logic within Authorizations because ohiHttpRequest was unavailable in that context.
Resolution:	Support has been restored for invoking ohiHttpRequest from Authorizations dynamic logic, enabling the OHI-specific outbound HTTP request implementation.

39573197

AUT-4848

Translation errors are seen while running the JET UI in Virtual Machines

Description:

The JET UI was not fully compatible with virtualized environments, causing translation-related errors during application use.

Resolution

Updated the JET UI configuration and handling to ensure translations load and function correctly when the application runs in a Virtual Machine.

39187589

AUT-4724

Authorizations IP status operation returned 409 conflict for an authorization in a submittable status

Description:

Authorizations IP status operation for an authorization in a submittable status (Entry, Change, Pended) resulted in an unexpected HTTP 409 Conflict response. This prevented clients from reliably polling or querying the processing status of newly created or not-yet-submitted authorizations.

Resolution:

39181940

AUT-4717

Operational reports should allow users to enable usage of full view to display data grid

Description:

In operational report page data-grid is not utilizing the full available space on the page, resulting in white space below the data grid.

Resolution:

The pageSize configuration has been removed, as the data grid will now display at full height based on the available screen height.

39526137

AUT-4833

PHI logging includes unmatched 'left joins' rows

Description:

When a query selects a PHI column from the right side of a LEFT JOIN, PHI logging is created for all rows from the left-side table, including rows where the joined row does not exist. In those cases the PHI column is effectively null, but a PHI log event is still written. This leads to incorrect PHI audit entries for rows that did not actually expose PHI.

Resolution:

When the joined column is marked as PHI but there is no match, no PHI Event is logged for that missing column.

39526240

AUT-4834

PHI audit logs corrected for aliased base views in data transfer payloads

Description:

In specific data transfer scenarios, when a base view is queried through an alias and the Base View is outside of the Relation context, PHI logging was not generated correctly.

Resolution:

The system now generates the PHI audit logs correctly for these aliased base view scenarios.

38791851

AUT-4531

ohiHttpRequest is not accessible from dynamic logic within Authorizations

Description:

Outbound HTTP requests could not be initiated from dynamic logic within Authorizations because ohiHttpRequest was unavailable in that context.

Resolution:

Support has been restored for invoking ohiHttpRequest from Authorizations dynamic logic, enabling the OHI-specific outbound HTTP request implementation.

Issues that were backported in previous Release / Patch

No backports.