Purpose

The process is initiated by responsible person from NHS side which created and approved contract request previously and involves the transfer of a signed contract request with electronic digital signature. 

Process is asynchronous. If all validations are successfully completed, the asynchronous process of creating a contract starts by processing the message.

Contract must be 2 time signed: from legal_entity and NHS sides. There is a particular order who must signed first - NHS side. After that legal entity owner can either sign contract request (will be created contract) or terminate contract request.

Preconditions

Before this the contract request should be created from MSP/PHARAMCY side and NHS employee should be appointed

Specification

Logic

This WS is designed to sign contract request from NHS side. Contract request's status must be ='PENDING_NHS_SIGN'. Method receives signed message (pkcs7) including signed content, digital signature, digital stamp and signer public key in signed_content property. All signature fields will be validated (including signer certificate authority).This service will store signed copy of Contract Request in Media Content Storage. Signed content MUST consists of JSON object with Contract Request data and printout template. Object that need to be signed is returned by Get Contract request details response, JSON.Path: $.data. data.prinout content must be changed to Print out content taken from Get Contract Request Printout Content

In DS EDRPOU/DRFO must be equal to contractor_legal_entity.edrpou

Input parameters

Request structure

See on Apiary

Example:

Authorize

1. Verify the validity of access token

2. Check user scopes in order to perform this action

   1. In case error - generate 401 response

Request to process the request using a token in the headers

Headers

Наприклад:

• Content-Type:application/json

• Authorization:Bearer c2778f3064753ea70de870a53795f5c9

Request data validation*

Validate EDRPOU

1. Check that EDRPOU in Certificate details exists and not empty

   1. in case of error return 422 error ('Invalid EDRPOU in DS')

2. Check that EDRPOU in Certificate details is equal to EDRPOU in legal entity

   1. Get client_id from token.

   2. Find prm.legal_entities id by client_id

   3. Compare EDRPOU in Certificate with legal_entities.edrpou

   4. In case validation fails - generate 422 error

3. Get party.last_name using nhs_signer_id from contract_request

   1. employees.employee_id=nhs_signer_id and client_id=employee.legal_entity_id → party.last_name

      1. Convert prm.parties.LAST_NAME and Certificate details.SURNAME to uppercase

      2. Compare prm.parties.LAST_NAME and Certificate details.SURNAME as Cyrillic letters

   2. In case validation fails - generate 422 error

Validate DRFO

1. Get parties.tax_id using party_users.party_id by user_id.

2. Compare DRFO in Certificate with party.tax_id

   1. Convert DRFO and TAX_ID to uppercase

   2. Compare DRFO and TAX_ID as Cyrillic letters

   3. Convert DRFO to Cyrillic and compare as Cyrillic letters

3. In case validation fails - generate 422 error

Validate Digital Stamp

1. Check that EDRPOU in Digital Stamp details exists and not empty

   1. in case of error return 422 error ('Invalid EDRPOU in DS')

2. Check that EDRPOU in Certificate details is equal to EDRPOU in legal entity

   1. Get client_id from token.

   2. Find prm.legal_entities id by client_id

   3. Compare EDRPOU in Certificate with legal_entities.edrpou

   4. In case validation fails - generate 422 error

3. Check that EDRPOU in Digital Stamp details is equal to EDRPOU in Digital signature

   1. Get EDRPOU from Digital signature.

   2. Get EDRPOU from Digital Stamp.

   3. Compare EDRPOU in Digital signature with Digital signature

   4. In case validation fails - generate 422 error

Check employee

Contract_request can be signed by owner or nhs_signer with necessary scopes in equal legal_entity_id and same id as was previously input in contract_request.

1. Extract legal_entity_id (client_id) from token. Take contract_request_id.

2. Check client_id=nhs_legal_entity_id (nhs_side) - in case of error return 403 Error ('Invalid client id')

3. Validate that contract_request hasn't been signed by  nhs_side already

   1. Check if status= 'PENDING_NHS_SIGNED'

   2. In case of error return 422 error ('The contract can't be signed by status')

Digital signature

Decode content that is encrypted in an electronic digital signature.
Use Digital signature WS. Method checks digital signature and returns result.

Check signed content

Check decoded signed content with previously created on IL.db.

In case if they are not equal - generate 422 error (message: "Signed content does not match the previously created content")

Validate request

1. Validate request using JSON schema

   1. In case validation fails - generate 422 error

2. Check contract request status

   1. If status is not PENDING_NHS_SIGN - return error 422 'Incorrect status'

3. Validate contractor_divisions

   1. Check divisions belongs to legal_entity and divisions.status='active'

      1. in case of error return 422  error view $divisions ('Division must be active and within current legal_entity')

4. Capitation only: Validate contractor_employee_divisions

   1. Employees from employee_divisions has employee_type='DOCTOR', status='APPROVED'

      1. in case of error return 422  error view $employee ('Employee must be an active DOCTOR')

   2. Check contractor_employee_divisions.division_id is present in contractor_divisions.id

      1. in case of error return 422 error $divisions ('The division is not belong to contractor_divisions')

   3. Check contract_number is null

      1. in case of error return 422  error view $employee  ('Employee can't be updated via Contract Request')

5. Validate start_date

   1. start_date>now()

      1. in case of error return 422 error $start_date ('Start date must be greater than create date')

6. Check whether all id is resolved and valid. For
    - contractor_legal_entity_id and nhs_legal_entity_id in status='active'  and nhs_verified = true (prm.legal_entities)
    - contractor_owner_id and nhs_signer_id in status = 'APPROVED' (prm.employees)

7. Invoke service Get Printout Form by Contract Request ID and compare to $printout_content from request

   1. in case of error return 422 error $printout_content ('Invalid printout content')

8. Reimbursement only: Validate medical_program_id is an ID of an ACTIVE medical program with type 'medication'

   1. in case of error return 409: "Program is not active"

9. For Capitation only: do not sing optional fields contractor_employee_divisions, external_contractor_flag and external_contractors 

Processing

Save signed contract to media storage

1. Get url for declaration upload

1. Upload signed contract to media storage.

Save Printout form 

After status is changed to NHS_SIGNED  save printout_content to db.contract_requests.printout_content by $contract_id

Update contract request

1. Change contract_request.status='NHS_SIGNED'

2. set nhs_signed_date=now()::date

Add status to event manager

After status was changed (status = NHS_SIGNED) - add new status to event_manager

Dictionaries

• CONTRACT_PAYMENT_METHOD

• CONTRACT_TYPE

• REIMBURSEMENT_CONTRACT_TYPE

Response structure

See on Apiary

Example:

HTTP status codes