Release Notes for Oracle Health Insurance Value-Based Payments Patch 4.25.1.0.2

This document contains the release notes for Oracle Health Insurance Value-Based Payments Patch 4.25.1.0.2.

Version compatibility: Oracle Health Insurance Value-Based Payments Release 4.25.1.x is only compatible with other Oracle Health Insurance applications release version 4.25.1.x unless explicitly stated otherwise.

In accordance with the OHI error correction policy (Document 1494031.1 on My Oracle Support), error correction support will be provided for this release and the previous two releases.

Enhancements

ID Summary Patch

ID	Summary	Patch
CPN-4206	Introduced additional attributes in security logs for enhancing log auditing and parsing capabilities Introduced the following new attributes in security logs: eventCategory: All security events are categorized into distinct categories. This attribute holds the category assigned to the security event being logged. eventType: Brief summary of the security event being logged. eventOutcome: Outcome of the event. Possible values: Success or Failure. eventSeverity: Describes the severity of the event. Possible values: INFO, WARN or ERROR. httpStatusCode: Http response code of the request for which the event is being logged. This will be null whenever the code is not deterministic at the time of event. failureReason: Briefly describes the reason of failure. This attribute will be non-null only where relevant. apiEndpoint: Holds the API endpoint to which the request was sent. session ID: Identifies the session provided by the caller. Applicable to SaaS and UI requests. access token ID: Identifies the access token associated with the request. Applicable to SaaS and non-UI requests Documentation Links: Administration Guide - Application - Security Logs Generated in Oracle Health Insurance Administration Guide - Fetch Security Logs through API
CPN-4207	Enhanced PHI access logs to include access scope, session ID and access token ID Enhanced PHI access logs to include three new attributes: access scope: Indicates whether a single record or multiple records are accessed within a transaction. session ID: Identifies the session provided by the caller. Applicable to SaaS and UI requests. access token ID: Identifies the access token associated with the request. Applicable to SaaS and non-UI requests. Documentation Links: Security Guide - User Access - Resource Auditing
NXT-26542	Exposed generic API for deployment metadata and extended User Preferences to support switching between customer and browser timezones Exposed generic API for deployment metadata to retrieve the customer timezone information. Introduced a new browserTimeZone flag in the User Preferences API, with a default value of false. When browserTimeZone is set to true, timestamps are displayed in the end user’s browser timezone. When browserTimeZone is set to false, timestamps are displayed in the configured customer timezone.
NXT-31594	JET: Save user preferences for table displays This enhancement enables you to save your table column selections and column widths on supported pages. After you adjust a table, select Save Preferences to save your settings for that page. Where it applies System- or floorplan-driven pages that use following templates when the `flexColumn` property is `true` (Note: Default setting is `true`): View/Edit List Search Object Table Supported pages and tables Product Definition Product Service Definition table in products and across products page Claims Draft provider pricing clause table within worksheet and across worksheet page Fee Schedule lines Provider Pricing Clause Claim lines table within claims page Common Reference Sheets Documentation Links: Security Guide - User Access - Functional Access Restriction (JET)
NXT-32017	UI: Additional Features Advanced Search With this enhancement, the following multiple capabilities are added to the advanced search: Ability to select query operators for different search criteria. Ability to specify selected criteria as mandatory in advanced search. Multiple adjustments to reference sheet lines, page searches, and sort, including the ability to search on nulls, the ability to sort on start and end dates, view last updated by, and time details. Documentation Links: Developer Guide - JET UI - References - Components - Advanced Search
NXT-32037	User Interface - Additional tab features Added a 'Close Other Tabs' option via a three-dot menu to close all but the active tab, auto-scroll to keep the active tab visible, and improved tab closing behavior to fall back to the previous tab when closing the last tab.
NXT-32471	Improve handling of HTTP error: 401 UnAuthorized in JET UI With this enhancement, OHI uses system property OHI_DEPLOYMENT_TYPE to handle HTTP 401 error. When this property value is set to "CLOUD", this will force a "401" response to re-direct the OHI JET login page when the IDCS OpenID session cookie is missing/expired.
NXT-32633	UI: Additional Features Sort With this enhancement, the sort component is updated to display null values based on the sort order, that is, for Default and Criteria: If the sort order is descending, nulls last is applied. If the sort order is ascending, nulls first is applied. It is now possible to specify sorting criteria for a multi-value property (list) configuration in a form and region. Documentation Links: Developer Guide - JET UI - References - Components - Sort Component
NXT-33004	Copy Action for Duplicating Records on HRR Pages The Copy Action is available when the metadata indicates that cloning is supported for a resource. It allows users to quickly duplicate an existing record by providing a new functional key. The system pre-fills the remaining values from the original record (excluding system-generated fields), allowing users to modify and save the new record while keeping the original record unchanged. During cloning, the following child entities are not copied: User Roles for Access Roles, Relation Identifiers for Persons, and Provider Limit Rules for Provider Limit Categories. Modifying individual child records during the clone operation is currently not supported for Access Restriction Grants under Access Roles, Partial Provider Pricing Clauses under Pricing Options, and Diminishing Rate Blocks, along with nested block amount and size lists, under Diminishing Rates.
NXT-33488	Remove outer join for 'And' mode quick search As part of this enhancement outer join is removed from "AND" mode based quick search and selection pop-up in LOV field. Also, outer join is removed for searches on insurable entity field in JET UI when used in quick search "OR" mode
NXT-33659	Disable user location based time conversion JET UI no longer relies only on the user’s browser timezone for datetime display. This helps prevent incorrect time conversion for customers operating across different geographic locations. The customerTimeZone, configured in the deployment metadata table during application installation, is used by default by JET UI. Users can override this through the "Use Browser Timezone?" option in the Preferences dialog, after which the UI will use the browser timezone. If customerTimeZone is not configured or is invalid/unsupported by JET, the UI falls back to the browser timezone. Documentation Links: Developer Guide - JET UI - References - Properties - Properties Security Guide - User Access - Function Access Restriction (JET)
NXT-33718	Extended user preference - Reorder and Auto-commit With this enhancement it is now possible to reorder table columns as per user’s preference. Also, the save button to store preference is replaced by auto commit feature. This feature is available for all pages based on the following floor plan template: View and Edit List Table List View - Table This feature is also available for selected pages which are not floorplan based: Common Pages like Reference sheets. Claims page claim line tab. In Policies application, pages like Premium schedule lines, Adjustment lines, and Fee schedule lines. Documentation Links: Developer Guide - JET UI - References - Components - Table
POL-18132	UI: Conditional display of row-level actions: edit and delete for tabs. This enhancement introduces the ability to control the display of actions (edit/delete) through initconditions. Documentation Links: Developer Guide - JET UI - References - Components - Conditions

CPN-4206

Introduced additional attributes in security logs for enhancing log auditing and parsing capabilities

Introduced the following new attributes in security logs:

eventCategory: All security events are categorized into distinct categories. This attribute holds the category assigned to the security event being logged.
eventType: Brief summary of the security event being logged.
eventOutcome: Outcome of the event. Possible values: Success or Failure.
eventSeverity: Describes the severity of the event. Possible values: INFO, WARN or ERROR.
httpStatusCode: Http response code of the request for which the event is being logged. This will be null whenever the code is not deterministic at the time of event.
failureReason: Briefly describes the reason of failure. This attribute will be non-null only where relevant.
apiEndpoint: Holds the API endpoint to which the request was sent.
session ID: Identifies the session provided by the caller. Applicable to SaaS and UI requests.
access token ID: Identifies the access token associated with the request. Applicable to SaaS and non-UI requests

Documentation Links:
Administration Guide - Application - Security Logs Generated in Oracle Health Insurance
Administration Guide - Fetch Security Logs through API

CPN-4207

Enhanced PHI access logs to include access scope, session ID and access token ID

Enhanced PHI access logs to include three new attributes:

access scope: Indicates whether a single record or multiple records are accessed within a transaction.
session ID: Identifies the session provided by the caller. Applicable to SaaS and UI requests.
access token ID: Identifies the access token associated with the request. Applicable to SaaS and non-UI requests.

Documentation Links:
Security Guide - User Access - Resource Auditing

NXT-26542

Exposed generic API for deployment metadata and extended User Preferences to support switching between customer and browser timezones

Exposed generic API for deployment metadata to retrieve the customer timezone information. Introduced a new browserTimeZone flag in the User Preferences API, with a default value of false. When browserTimeZone is set to true, timestamps are displayed in the end user’s browser timezone. When browserTimeZone is set to false, timestamps are displayed in the configured customer timezone.

NXT-31594

JET: Save user preferences for table displays

This enhancement enables you to save your table column selections and column widths on supported pages. After you adjust a table, select Save Preferences to save your settings for that page.

Where it applies

System- or floorplan-driven pages that use following templates when the flexColumn property is true (Note: Default setting is true):
- View/Edit List
- Search Object Table

Supported pages and tables

Product Definition
- Product Service Definition table in products and across products page
Claims
- Draft provider pricing clause table within worksheet and across worksheet page
- Fee Schedule lines
- Provider Pricing Clause
- Claim lines table within claims page
Common
- Reference Sheets

Documentation Links:
Security Guide - User Access - Functional Access Restriction (JET)

NXT-32017

UI: Additional Features Advanced Search

With this enhancement, the following multiple capabilities are added to the advanced search:

Ability to select query operators for different search criteria.
Ability to specify selected criteria as mandatory in advanced search.
Multiple adjustments to reference sheet lines, page searches, and sort, including the ability to search on nulls, the ability to sort on start and end dates, view last updated by, and time details.

Documentation Links:
Developer Guide - JET UI - References - Components - Advanced Search

NXT-32037

User Interface - Additional tab features

Added a 'Close Other Tabs' option via a three-dot menu to close all but the active tab, auto-scroll to keep the active tab visible, and improved tab closing behavior to fall back to the previous tab when closing the last tab.

NXT-32471

Improve handling of HTTP error: 401 UnAuthorized in JET UI

With this enhancement, OHI uses system property OHI_DEPLOYMENT_TYPE to handle HTTP 401 error. When this property value is set to "CLOUD", this will force a "401" response to re-direct the OHI JET login page when the IDCS OpenID session cookie is missing/expired.

NXT-32633

UI: Additional Features Sort

With this enhancement, the sort component is updated to display null values based on the sort order, that is, for Default and Criteria:

If the sort order is descending, nulls last is applied.
If the sort order is ascending, nulls first is applied.

It is now possible to specify sorting criteria for a multi-value property (list) configuration in a form and region.

Documentation Links:
Developer Guide - JET UI - References - Components - Sort Component

NXT-33004

Copy Action for Duplicating Records on HRR Pages

The Copy Action is available when the metadata indicates that cloning is supported for a resource. It allows users to quickly duplicate an existing record by providing a new functional key. The system pre-fills the remaining values from the original record (excluding system-generated fields), allowing users to modify and save the new record while keeping the original record unchanged.

During cloning, the following child entities are not copied: User Roles for Access Roles, Relation Identifiers for Persons, and Provider Limit Rules for Provider Limit Categories.

Modifying individual child records during the clone operation is currently not supported for Access Restriction Grants under Access Roles, Partial Provider Pricing Clauses under Pricing Options, and Diminishing Rate Blocks, along with nested block amount and size lists, under Diminishing Rates.

NXT-33488

Remove outer join for 'And' mode quick search

As part of this enhancement outer join is removed from "AND" mode based quick search and selection pop-up in LOV field. Also, outer join is removed for searches on insurable entity field in JET UI when used in quick search "OR" mode

NXT-33659

Disable user location based time conversion

JET UI no longer relies only on the user’s browser timezone for datetime display. This helps prevent incorrect time conversion for customers operating across different geographic locations. The customerTimeZone, configured in the deployment metadata table during application installation, is used by default by JET UI. Users can override this through the "Use Browser Timezone?" option in the Preferences dialog, after which the UI will use the browser timezone. If customerTimeZone is not configured or is invalid/unsupported by JET, the UI falls back to the browser timezone.

Documentation Links:
Developer Guide - JET UI - References - Properties - Properties
Security Guide - User Access - Function Access Restriction (JET)

NXT-33718

Extended user preference - Reorder and Auto-commit

With this enhancement it is now possible to reorder table columns as per user’s preference. Also, the save button to store preference is replaced by auto commit feature.

This feature is available for all pages based on the following floor plan template:

View and Edit List Table
List View - Table

This feature is also available for selected pages which are not floorplan based:

Common Pages like Reference sheets.
Claims page claim line tab.
In Policies application, pages like Premium schedule lines, Adjustment lines, and Fee schedule lines.

Documentation Links:
Developer Guide - JET UI - References - Components - Table

POL-18132

UI: Conditional display of row-level actions: edit and delete for tabs.

This enhancement introduces the ability to control the display of actions (edit/delete) through initconditions.

Documentation Links:
Developer Guide - JET UI - References - Components - Conditions

Upgrade Steps for Installation

To perform the upgrade, perform the following steps:

Perform any pre-upgrade steps.
Stop all the managed nodes running the existing version of the application.
Perform any pre-undeploy steps.
Undeploy the existing version of the application.
Back up the database.
Perform any post-undeploy steps.
Unpack the release bundle into a directory that we refer to as OHI_ROOT from now on.
Change Installation Configuration: In <OHI_ROOT>/util/install, make a copy of ohi_install.cfg.template and name it ohi_install.cfg.
Edit ohi_install.cfg to contain your specific database connection data and other configuration settings. The settings are explained in the file itself.
Make sure NO connections are present to the database using the OHI_xxx_USER account (where xxx is the abbreviation of the application)
Run the Upgrade script:
1. Open a command window and browse to <OHI_ROOT>/util/install.
2. Run the upgrade by executing ./ohi-update.sh .
Make the required changes to the ohi properties file
Perform any post-upgrade steps
Start WebLogic application server
Deploy the Application
Perform any post-deploy steps

Configuration Properties

Ref	Action	Description
CPN-4200	Added	ohi.httpapi.query.dynamicdata.fetchexplicit.disable Property to disable query api behavior where dynamic fields and records are returned only for the lists explicitly specified in the fields parameter.

Ref

Action

Description

CPN-4200

Added

ohi.httpapi.query.dynamicdata.fetchexplicit.disable

Property to disable query api behavior where dynamic fields and records are returned only for the lists explicitly specified in the fields parameter.

Web Services

Ref Action Description

Ref	Action	Description
CPN-4206	Modified	logsecurityevents Added eight new attributes: `eventCategory`, `eventType`, `eventOutcome`, `eventSeverity`, `httpStatusCode`, `failureReason`, `apiEndpoint`, `sessionId`, `accessTokenId`.
CPN-4207	Modified	logphievents Added three new attributes: `accessScope`, `sessionId`, and `accessTokenId`.
NXT-26542	Added	deploymentmetadata API New read-only generic API is added.
NXT-26542	Modified	userpreferences API Added a new attribute browserTimeZone to the user preferences API.

CPN-4206

Modified

logsecurityevents

Added eight new attributes: eventCategory, eventType, eventOutcome, eventSeverity, httpStatusCode, failureReason, apiEndpoint, sessionId, accessTokenId.

CPN-4207

Modified

logphievents

Added three new attributes: accessScope, sessionId, and accessTokenId.

NXT-26542

Added

deploymentmetadata API

New read-only generic API is added.

NXT-26542

Modified

userpreferences API

Added a new attribute browserTimeZone to the user preferences API.

Data Conversion

This section intentionally left blank.

Dynamic Logic

This section intentionally left blank.

UI Changes

Ref	Action	Description
NXT-33659	Modified	Preferences Dialog A new checkbox - "Use Browser Timezone?" has been introduced in Preferences which can be used to override the customer’s configured timezone.

Ref

Action

Description

NXT-33659

Modified

Preferences Dialog

A new checkbox - "Use Browser Timezone?" has been introduced in Preferences which can be used to override the customer’s configured timezone.

Breaking Changes

This section intentionally left blank.

Access Restrictions

Ref	Action	Description
NXT-33659	Modified	CO0019 The 'deploymentmetadata API' access restriction has been added to function code CO0019.

Ref

Action

Description

NXT-33659

Modified

CO0019

The 'deploymentmetadata API' access restriction has been added to function code CO0019.

Bug Fixes

BugDB	SR	Internal	Summary
38856877	4-0001793793	CPN-4160	Missing secrets for OAuth clients while ohistore is used as keystore
Description:	Missing secrets for OAuth clients while ohistore is used as keystore
Resolution:	OAuth client credential keys are now correctly fetched.
39026272	4-0002125064	CPN-4213	Resources cannot be searched when code starts with %255%
Description:	POST search API requests fail with an IntrusionDetectionException when the query contained specific special patterns. These legitimate input parameters were incorrectly identified as potential intrusion attempts, resulting in search failures.
Resolution:	Enhanced the intrusion detection mechanism to correctly handle search query parameters, preventing legitimate requests from being incorrectly flagged.
39079794		CPN-4234	Flex Code Base Views are both removed and updated at the same time
Description:	During Base View Generation, the generation of Flex Code Base View is unstable: (1) Concurrent update/remove operations occasionally targeted the same view, raising the Oracle error “table or view does not exist”. This happened intermittently. (2) The generator skipped creating some Flex Code Base Views whenever the Flex Code System code contained lowercase characters.
Resolution:	The update/removal operations are serialized to prevent errors like “table or view does not exist”. Flex Code Base Views are generated for Flex Code Systems with a code containing lowercase characters.
38659276		CPN-4078	The activity thread pool size does not revert to its original value of 8 after memory usage returns to normal
Description:	During periods of high memory usage, the system automatically reduces the number of activity threads it can handle to 1, to prevent further strain. However, after memory usage returns to normal, the system does not increase this capacity back to its usual level i.e. 8. As a result, the affected node can only process one activity at a time, which causes slow performance and delays.
Resolution:	Once memory usage returns to normal, the system automatically restores it the thread-pool capacity back to the usual level of 8 threads on the impacted node. This ensures that performance returns to normal and multiple tasks can be processed at the same time, preventing delays.
38904244	4-0001784507	CPN-4169	System throwing NullPointerException when there is no value for EXCL_PHI_LOGGING in the OHI_REPORTING_VIEWS table
Description:	When invoking the Data Transfer IP, the system verifies if any PHI information is fetched and creates PHI log entries when needed. In case the EXCL_PHI_LOGGING column in the OHI_REPORTING_VIEWS table is empty, the system throws a NullPointerException.
Resolution:	The EXCL_PHI_LOGGING column in the OHI_REPORTING_VIEWS table gets a default value 'N'
39526134		CPN-4341	PHI logging includes unmatched 'left joins' rows
Description:	When a query selects a PHI column from the right side of a LEFT JOIN, PHI logging is created for all rows from the left-side table, including rows where the joined row does not exist. In those cases the PHI column is effectively null, but a PHI log event is still written. This leads to incorrect PHI audit entries for rows that did not actually expose PHI.
Resolution:	When the joined column is marked as PHI but there is no match, no PHI Event is logged for that missing column.
39526243		CPN-4342	PHI audit logs corrected for aliased base views in data transfer payloads
Description:	In specific data transfer scenarios, when a base view is queried through an alias and the Base View is outside of the Relation context, PHI logging was not generated correctly.
Resolution:	The system now generates the PHI audit logs correctly for these aliased base view scenarios.
38974674		CPN-4200	Control dynamic Data retrieval in Generic API using a flag
Description:	Dynamic fields and records were returned only for the lists explicitly specified in the fields parameter.
Resolution:	This introduces a property ohi.httpapi.query.dynamicdata.fetchexplicit.disable to disable query api behavior where dynamic fields and records are returned only for the lists explicitly specified in the fields parameter. Note : This property will be taken out in a future 4.25.1.x patch version.
39693600		CPN-4377	Generic search requests with total results could fail for some resources like calculationresults
Description:	When a generic search request included totalResults=true for some resources (like calculationresults), the response could fail instead of returning the matching records and total result count.
Resolution:	Generic search requests with totalResults=true now return the expected response, including the total result count, for the affected resources. Requests with totalResults=false continue to return matching records without calculating total results.
39018289		CPN-4211	Object storage operation cause assert or Weblogic asserts at event publishing time in absence of missing class loader context in underlying thread
Description:	Object storage operation cause assert or Weblogic asserts at event publishing time in absence of missing class loader context in underlying thread. This resulted in import registration failures, failure observed at weblogic operation at time of publishing event.
Resolution:	Object storage operation cause assert or Weblogic asserts at event publishing time in absence of missing class loader context in underlying thread. Issue has been fixed by ensuring class loader context is always initialized

BugDB

Internal

Summary

38856877

4-0001793793

CPN-4160

Missing secrets for OAuth clients while ohistore is used as keystore

Description:

Missing secrets for OAuth clients while ohistore is used as keystore

Resolution:

OAuth client credential keys are now correctly fetched.

39026272

4-0002125064

CPN-4213

Resources cannot be searched when code starts with %255%

Description:

POST search API requests fail with an IntrusionDetectionException when the query contained specific special patterns. These legitimate input parameters were incorrectly identified as potential intrusion attempts, resulting in search failures.

Resolution:

Enhanced the intrusion detection mechanism to correctly handle search query parameters, preventing legitimate requests from being incorrectly flagged.

39079794

CPN-4234

Flex Code Base Views are both removed and updated at the same time

Description:

During Base View Generation, the generation of Flex Code Base View is unstable: (1) Concurrent update/remove operations occasionally targeted the same view, raising the Oracle error “table or view does not exist”. This happened intermittently. (2) The generator skipped creating some Flex Code Base Views whenever the Flex Code System code contained lowercase characters.

Resolution:

The update/removal operations are serialized to prevent errors like “table or view does not exist”. Flex Code Base Views are generated for Flex Code Systems with a code containing lowercase characters.

38659276

CPN-4078

The activity thread pool size does not revert to its original value of 8 after memory usage returns to normal

Description:

During periods of high memory usage, the system automatically reduces the number of activity threads it can handle to 1, to prevent further strain. However, after memory usage returns to normal, the system does not increase this capacity back to its usual level i.e. 8. As a result, the affected node can only process one activity at a time, which causes slow performance and delays.

Resolution:

Once memory usage returns to normal, the system automatically restores it the thread-pool capacity back to the usual level of 8 threads on the impacted node. This ensures that performance returns to normal and multiple tasks can be processed at the same time, preventing delays.

38904244

4-0001784507

CPN-4169

System throwing NullPointerException when there is no value for EXCL_PHI_LOGGING in the OHI_REPORTING_VIEWS table

Description:

When invoking the Data Transfer IP, the system verifies if any PHI information is fetched and creates PHI log entries when needed. In case the EXCL_PHI_LOGGING column in the OHI_REPORTING_VIEWS table is empty, the system throws a NullPointerException.

Resolution:

The EXCL_PHI_LOGGING column in the OHI_REPORTING_VIEWS table gets a default value 'N'

39526134

CPN-4341

PHI logging includes unmatched 'left joins' rows

Description:

When a query selects a PHI column from the right side of a LEFT JOIN, PHI logging is created for all rows from the left-side table, including rows where the joined row does not exist. In those cases the PHI column is effectively null, but a PHI log event is still written. This leads to incorrect PHI audit entries for rows that did not actually expose PHI.

Resolution:

When the joined column is marked as PHI but there is no match, no PHI Event is logged for that missing column.

39526243

CPN-4342

PHI audit logs corrected for aliased base views in data transfer payloads

Description:

In specific data transfer scenarios, when a base view is queried through an alias and the Base View is outside of the Relation context, PHI logging was not generated correctly.

Resolution:

The system now generates the PHI audit logs correctly for these aliased base view scenarios.

38974674

CPN-4200

Control dynamic Data retrieval in Generic API using a flag

Description:

Dynamic fields and records were returned only for the lists explicitly specified in the fields parameter.

Resolution:

This introduces a property ohi.httpapi.query.dynamicdata.fetchexplicit.disable to disable query api behavior where dynamic fields and records are returned only for the lists explicitly specified in the fields parameter.

Note : This property will be taken out in a future 4.25.1.x patch version.

39693600

CPN-4377

Generic search requests with total results could fail for some resources like calculationresults

Description:

When a generic search request included totalResults=true for some resources (like calculationresults), the response could fail instead of returning the matching records and total result count.

Resolution:

Generic search requests with totalResults=true now return the expected response, including the total result count, for the affected resources. Requests with totalResults=false continue to return matching records without calculating total results.

39018289

CPN-4211

Object storage operation cause assert or Weblogic asserts at event publishing time in absence of missing class loader context in underlying thread

Description:

Object storage operation cause assert or Weblogic asserts at event publishing time in absence of missing class loader context in underlying thread. This resulted in import registration failures, failure observed at weblogic operation at time of publishing event.

Resolution:

Object storage operation cause assert or Weblogic asserts at event publishing time in absence of missing class loader context in underlying thread. Issue has been fixed by ensuring class loader context is always initialized

Issues that were backported in previous Release / Patch

No backports.