Skip to main content


         This documentation site is for previous versions. Visit our new documentation site for current releases.      
 

This content has been archived and is no longer being updated.

Links may not function; however, this content may be relevant to outdated versions of the product.

Pega Customer Service for Healthcare modified rules for BAC prevention

Updated on September 10, 2021

Broken Access control (BAC) refers to all access control issues in web applications that allow end users to gain unauthorized access to privileged data and functionality. Open Web Application Security Project (OWASP) identifies BAC as one of the top 10 security vulnerabilities. BAC usually occurs when users can bypass access control checks by leveraging vulnerabilities such as uniform resource locator (URL)-based requests that do not verify user privileges.

In the 8.3 release, Pega Customer Service for Healthcare has modified the rules that call secured activities in the Pega Platform. The query strings and parameters in the calls are registered so that they cannot be tampered with by the end users.

For more information about the enhancements to prevent Broken Access Control (BAC), and to see a list of rules that were modified for all Pega Customer Service applications, see Pega Customer Service enhancements to prevent Broken Access Control.

The following list shows the modified rules for Pega Customer Service for Healthcare. If you have overridden any of these rules in your Pega Customer Service for Healthcare implementation layer, you need to update them with the changed rules. Run the Pre-Upgrade Checker to identify which of these changed rules are overridden in your implementation layer. For information about the Pre-Upgrade Checker, see the Pega Customer Service for Healthcare and Pega Sales Automation for Healthcare Upgrade Guide on the Pega Customer Service for Healthcare product page.

Rule typeRule nameClass name
Rule-Obj-ActivityHCInteractionStartPegaCPMHC-Work
Rule-Obj-ActivityHCResearchStartPegaCPMHC-Work-Interaction-Research
Rule-Obj-ActivityHCManualInboundCorrStartPegaCPMHC-Work-Interaction-InCorr
Rule-Obj-ActivityAppUpdatePriorityNoteBUPegaCPMHC-Work
Rule-Obj-ActivityHCGetClaimDetailsPegaCPMHC-Work
Rule-Obj-ActivityHCValidateNoteForPolicyPegaCPMHC-Work
Rule-Obj-ActivityHCAddNoteForPolicyPegaCPMHC-Work
Rule-Obj-ActivityHCDisplayClaimPegaHC-Data-Claim
Rule-Obj-ActivityHCShowProviderDetailsPegaHC-Data-Party-Provider
Rule-Obj-ActivityHCLaunchSearchInterAndSvcItemsByProviderPegaHC-Data-Party-Provider
Rule-Obj-ActivityHCLaunchSearchInterAndSvcItemsByProviderPegaCPMHC-Work
Rule-Obj-ActivityHCLaunchAuthSearchByMemberPegaCPMHC-Party-Member
Rule-Obj-ActivityHCLaunchClaimSearchByMemberPegaCPMHC-Work
Rule-Obj-ActivityHCLaunchSearchInterAndSvcItemsByMemberPegaCPMHC-Party-Member
Rule-Obj-ActivityHCLaunchSearchInterAndSvcItemsByMemberPegaCPMHC-Work
Rule-Obj-ActivityHCDisplayClaimDetailsPegaCPMHC-Work-DisputeClaim
Rule-Obj-ActivityHCDisplayAuthDetailsPegaCPMHC-Work-AppealAuthDenial
Rule-Obj-ActivityAppDisplayLinkPegaCPMHC-Work
Rule-Obj-ActivityHCShowAuthDetailsPegaCPMHC-Work
Rule-Obj-ActivityHCShowClaimDetailsPegaCPMHC-Work
Rule-Obj-ActivityHCShowPlanBenefitsPegaCPMHC-Work
Rule-Obj-ActivityHCSelectProviderBackgroundPegaCPMHC-Work
Rule-Obj-ActivityHCChangePolicyBackgroundPegaCPMHC-Work
Rule-Obj-ActivityHCLaunchClaimSearchByProviderPegaCPMHC-Work
Rule-Obj-ActivityHCLaunchClaimSearchByProviderPegaHC-Data-Party-Provider
Rule-Obj-ActivityHCChangeMemberPegaCPMHC-Work
Rule-Obj-ActivityHCChangeMemberPegaHC-Data-Party-Provider
Rule-HTML-SectionNPSACTIONEXTERNALPEGAFW-NPS-SURVEY
  • Previous topic Schedule Medical Appointment Microjourney
  • Next topic Pega Customer Relationship Management for Healthcare suite of applications

Have a question? Get answers now.

Visit the Support Center to ask questions, engage in discussions, share ideas, and help others.

Did you find this content helpful?

Want to help us improve this content?

We'd prefer it if you saw us at our best.

Pega.com is not optimized for Internet Explorer. For the optimal experience, please use:

Close Deprecation Notice
Contact us