Product/Service Feature Guidance – Oracle Argus Enterprise Edition (On-Premise) –

Release 6.0.x, Release 7.0.x, Release 8.0.x, Release 8.1.x, Release 8.2.x
JUNE 2 0 1 8

Disclaimer

The purpose of this document is to outline some of the product features currently available or under consideration for the Oracle service offering referenced above,
with a focus on privacy and security related controls. Customers should refer to the available on-line product documentation for a list of available product features
and functionality.

The information contained in this document is for information purposes only and may not be incorporated into any contract. It is not a commitment to
deliver any material, code, functionality, or certification or compliance status, and should not be relied upon in making purchasing decisions. The
development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle. All information
is provided “AS-IS”, without warranty, is subject to change, and is confidential information under your agreement with Oracle.

The information in this document may not be construed or used as legal advice about the content, interpretation or application of any law, regulation or regulatory
guideline. Customers and prospective customers must seek their own legal counsel to understand the applicability of any law or regulation, including through the
use of any vendor’s products or services.

1
Oracle Confidential
 Agreements and Documentation

Privacy Features Oracle Documentation

Data Minimization Argus Safety has specific data fields for the collection of personal data in accordance with global clinical trial and
pharmacovigilance regulations. Personal data is collected for adverse event reporting and entered in specific fields in the
Argus Safety Case Form, this data is used to report to regulatory authorities.
1. For more information go to http://docs.oracle.com/en/industries/health-sciences/argus-safety/index.html
2. Select the applicable version of Argus Safety.
3. In the User’s Guide, refer to the sections for Reporter Information on the General Tab and Patient Information on
the Patient Tab.

Argus Mart, Argus Insight and Argus Analytics does not have any personal data collection fields as these products are
not used for data capturing but for analyzing the data entered in the source system i.e. Argus Safety. The personal data
captured in source system is available for analysis and reporting.
Data Deletion at Contract Term or On-premise customers have control and responsibility over their environments at License Term or Termination.
Termination
Data Portability In Argus Safety, Individual Case Safety Report data (including personal data, health care professional contact details,
details of adverse events, medical history, medication and lab data can be exported using E2B (XML), case form print
(structured PDF). E2B (XML) and case form print (structured PDF) format are structured machine readable formats. Refer
to details on how to review draft regulatory reports.
1. For more information go to http://docs.oracle.com/en/industries/health-sciences/argus-safety/index.html
2. Select the applicable version of Argus Safety.
3. In the User’s Guide:
 For version 8.1.x and greater refer to the section on reviewing a draft expedited report.
 For versions prior to 8.1.1, search for details about printing a draft report or printing a case.
Argus Insight, Argus Mart and Argus Analytics users can save or export data in CSV, TXT, XLS or PDF formats.

1. For more information go to –

a. Argus Mart - http://docs.oracle.com/en/industries/health-sciences/argus-mart/index.html. Select the
applicable version of Argus Mart. Click Books and refer to the Oracle Argus Mart Extensibility Guide and
Oracle Argus Mart Installation and Administration Guide.
b. Argus Insight- http://docs.oracle.com/en/industries/health-sciences/argus-insight/index.html. Select the
applicable version of Argus Insight. Click Books and refer to the Oracle Argus Insight User’s Guide.

2
Oracle Confidential

End-user Access and Other Requests
Right to Erasure and/or Right to be
Forgotten
Notice and Consent
Availability
Tracking Technologies
Oracle Confidential
c. Argus Analytics - http://docs.oracle.com/en/industries/health-sciences/argus-analytics/index.html.
Select the applicable version of Argus Analytics. Click Books and refer to the Oracle Argus Analytics User’s
Guide.
Argus Safety end-user access is defined at Section level (group of fields) and Menu level. Records are given access based
on product, site, and study. User groups have access based on menu. Different Logs can have different groups that have
access to them.
1. For more information go to http://docs.oracle.com/en/industries/health-sciences/argus-safety/index.html
2. Select the applicable version of Argus Safety.
3. In the Administrator’s Guide, refer to the section on Access Management.
Argus Insight, Argus Mart and Argus Analytics End User access is defined at Menu/folder level. Records are given access
based on product, site and study. User groups have access based on menu/Folders. Different Logs can have different
groups that have access on them.
Patient data is pushed to the server by customer and loaded by a customer-managed IT resource.
1. For more information go to –
a. Argus Mart - http://docs.oracle.com/en/industries/health-sciences/argus-mart/index.html. Select the
applicable version of Argus Mart. Click Books and refer to the Oracle Argus Mart Extensibility Guide and
Oracle Argus Mart Installation and Administration Guide.
b. Argus Insight- http://docs.oracle.com/en/industries/health-sciences/argus-insight/index.html. Select the
applicable version of Argus Insight. Click Books and refer to the Oracle Argus Insight User’s Guide.
c. Argus Analytics - http://docs.oracle.com/en/industries/health-sciences/argus-analytics/index.html.
Select the applicable version of Argus Analytics. Click Books and refer to the Oracle Argus Analytics User’s
Guide.
This is not implemented within Argus Enterprise Edition at the clinical trial subject level or the application user level.
This is not provided by Argus Enterprise Edition.
Argus Enterprise Edition can be accessible to end users except when it is being upgraded, subject to maintenance, or
migrated to a newer version. Customers hosting Argus Enterprise Edition on-premise are responsible for application and
server maintenance, and for ensuring the availability of the application outside of these activities.
Argus Enterprise Edition only uses functional (no tracking) cookies for maintaining the login session and personalization
and no third-party cookies. Each of the cookies, if not set, would have a detrimental impact on the user experience, as
they each impact the availability of essential functionality. Each of the cookies is set based on an explicit end user action,
typically accessing a page or selecting an option within a page.
The following cookies are used by the application for maintaining the login session and personalization:
3

Security Features
Multi-factor authentication
IP white-listing
Separation of duties
Flagging Special Categories of Data
Oracle Confidential
 Visitor.Argus
 Visitor.key3
 Visitor.refreshing
 Visitor.MasterApp
 LoginId
 NewEnterpriseId
 LoginLangPref
 True_logout
Oracle Documentation
Argus Enterprise Edition does not provide multi-factor customer and end-user authentication functionality.
Argus Enterprise Edition does not provide configurable IP white-listing functionality.
Argus Safety product roles, permissions, and login groups enforce separation of duties.
For more information:
1. Go to https://docs.oracle.com/en/industries/health-sciences/argus-safety/index.html
2. Select the applicable version of Argus Safety.
3. In the Administrator’s Guide, refer to the section on access management.
For Argus Mart, Argus Insight and Argus Analytics; product roles, permissions and login groups enforce separation of
duties.
1. For more information go to –
a. Argus Mart - http://docs.oracle.com/en/industries/health-sciences/argus-mart/index.html. Select the
applicable version of Argus Mart. Click Books and refer to the Oracle Argus Mart Extensibility Guide and
Oracle Argus Mart Installation and Administration Guide.
b. Argus Insight- http://docs.oracle.com/en/industries/health-sciences/argus-insight/index.html. Select the
applicable version of Argus Insight. Click Books and refer to the Oracle Argus Insight Administrator
Guide> Securing User Accounts, Groups, and Access Rights
c. Argus Analytics - http://docs.oracle.com/en/industries/health-sciences/argus-analytics/index.html.
Select the applicable version of Argus Analytics. Click Books and refer to the Oracle Argus Analytics User’s
Guide.
Argus Safety has fields that are configurable for masking, but the configuration does not cover all the fields. The
following fields are masked:
 Patient (name or initials)
 Patient Medical Record Number(s) and Source(s) of the Record Number (GP Medical Record Number)
4

Separate auditing and “detective
control” privileges
Oracle Confidential
 DOB
 Parent ID
 Parent DOB
 Reporter or Health-care Professional (name, address, contact details)
For more information:
1. Go to https://docs.oracle.com/en/industries/health-sciences/argus-safety/index.html
2. Select the applicable version of Argus Safety.
3. In the User’s Guide, review descriptions for the use of MSK Null flavor, Privacy, and Protect Confidentiality.
4. For version 8.1.2 and greater, review the section on data privacy in the Administrator’s Guide.
In Argus Mart, Argus Insight and Argus Analytics masking is not implemented OOB but customer can mask the data as
per the requirement using extensibility features
1. For more information go to http://docs.oracle.com/en/industries/health-sciences/argus-mart/index.html. Select
the applicable version of Argus Mart. Click Books and refer to the Oracle Argus Mart Extensibility Guide.
2. For more information go to http://docs.oracle.com/en/industries/health-sciences/argus-insight/index.html.
Select the applicable version of Argus Insight. Click Books and refer to the Oracle Argus Insight Extensibility
Guide.
3. Argus Analytics - http://docs.oracle.com/en/industries/health-sciences/argus-analytics/index.html. Select the
applicable version of Argus Analytics. Click Books and refer to the Oracle Argus Analytics User’s Guide.
Argus Safety audit logs can be configured to be viewed by a specific group.
1. Go to https://docs.oracle.com/en/industries/health-sciences/argus-safety/index.html
2. Select the applicable version of Argus Safety.
In the Administrator’s Guide, refer to the section on access management.
In Argus Insight, Audit logs can be configured for viewing by a specific group.
1. Go to https://docs.oracle.com/en/industries/health-sciences/argus-insight/index.html
2. Select the applicable version of Argus Insight.
In the Administrator’s Guide, refer to the section on access management.
There is no application log for Argus Mart. Only DB Logs of installation process and ETL Logs are stored
1. For more information go to http://docs.oracle.com/en/industries/health-sciences/argus-mart/index.html
2. Select the applicable version of Argus Mart.
3. Click Books and refer to the Oracle Argus Mart Installation and Administration Guide.
5
 For Argus Analytics only DB Logs of installation process and ETL Logs are stored.

1. For more information go to http://docs.oracle.com/en/industries/health-sciences/argus-analytics/index.html

Select the applicable version of Argus Analytics. Click Books and refer to the Oracle Argus Analytics User’s Guide Chapter
– Extract Transform Load Programs for ETL logs and refer to Oracle Argus Analytics Installation Guide Chapter – Running
the Oracle Argus Analytics Installer for Installation logs.
Encryption To support data-at-rest encryption controls, Oracle recommends Transparent Data Encryption (TDE) on the database,
which may require additional licensing fees.
For more information, regarding products that support Oracle Database 11g:
http://www.oracle.com/technetwork/database/security/tde-faq-093689.html.
For more information regarding products that support Oracle Database 12c:
http://www.oracle.com/technetwork/database/options/advanced-security/overview/advanced-security-tde-faq-
2995212.pdf
Anonymization This is not supported in Argus Enterprise Edition.
Pseudonymization This is not supported in Argus Enterprise Edition.
Data Masking Argus Safety has fields that are configurable for masking, but the configuration does not cover all the fields. The
following fields are masked:
 Patient (name or initials)
 Patient Medical Record Number(s) and Source(s) of the Record Number (GP Medical Record Number)
 DOB
 Parent ID
 Parent DOB
 Reporter or Health-care Professional (name, address, contact details)
For more information:
1. Go to https://docs.oracle.com/en/industries/health-sciences/argus-safety/index.html
2. Select the applicable version of Argus Safety.
3. In the User’s Guide, review descriptions for the use of MSK Null flavor, Privacy, and Protect Confidentiality.
4. For version 8.1.2 and greater, review the section on data privacy in the Administrator’s Guide.
Argus Mart and Argus Insight does not have any data masking implemented but users’ can extend the system to mask
the data as per the requirement.

For more information go to –

a. Argus Mart - http://docs.oracle.com/en/industries/health-sciences/argus-mart/index.html. Select the
applicable version of Argus Mart. Click Books and refer to the Oracle Argus Mart Extensibility Guide.
6
Oracle Confidential
 b. Argus Insight - http://docs.oracle.com/en/industries/health-sciences/argus-insight/index.html. Select the
applicable version of Argus Insight. Click Books and refer to the Oracle Argus Insight Extensibility Guide.

Argus Analytics does not have any data masking implemented.

Truncation Argus Enterprise Edition does not support truncation.
Tokenization Argus Enterprise Edition does not support tokenization.
Logging The Argus Enterprise Edition event logs are stored within your environment, and are not accessible from Argus
Enterprise Edition application. Enabling automatic log purging and/or sending event logs to external destinations
(including write-once storage) are the responsibility of the system administrator.

7
Oracle Confidential