1. MyFloridaMarketPlace System Administrator Training February 12 – 16, 2007

2. Page - 2 System Administrator Training Agenda  Review of Roles and Groups within MFMP 2.0  Conversion of existing users  Setting up new users in MFMP 2.0  Demo  Job aid  Clean up tasks  System Administrator responsibilities  Use of appropriate roles for staff  Scanning and Attachments  Inactivation of users  HIPAA Information

3. Page - 3 MFMP 2.0 Groups, Roles & Permissions  MFMP 2.0 has an increased ability to manage users within it’s structure by adding a new level of function called “Groups”. Groups are a collection of permissions that apply to a set of users within an organization. Permissions control the lowest level access to system functions, notifications or operations. Groups Roles Roles will be PUI specific and will be used for routing purposes in the workflow.

4. Page - 4 MFMP 2.0 Group and Role Structure Groups  A group is a collection of permissions  Groups are used to enable specific functionality within the application  Examples of groups:  Analysis  Contract Manager  Edit Accounting  eQuote  Invoicing  Purchasing  Requester  Req Approver Roles  Roles will be used for PUI and statewide routing in workflow processing  Roles will no longer contain any permissions  Examples of roles:  7300: Purchasing Gatekeeper  7300: Purchasing Office  7300: Exception Handler  7300: Invoice Manager  7300: Fleet Approver

5. Page - 5 MFMP 2.0 Group and Role Structure Contract Purchasing System Admin Analysis Requester Edit Accounting eQuote New Roles Current Red = Roles that will no longer be needed Green Underline = MFMP 2.0 Roles 8010: Contract Specialist 8010: Purchasing Office 8010: System Administrator Analysis Authorized Requester - eQuote 8010: Contract Specialist 8010: Purchasing Office 8010: System Administrator Roles Groups Permissions are the same for all agencies. The new structure provides better maintenance for future updates. -- Changes can be made once for everyone in a group.

6. Page - 6 MFMP 2.0 Groups, Roles & Permissions Helpful tips:  Security Administrators will need to review the System Administrator’s Guide and Scanning and Attachment Guidelines to understand the security functions (see handouts provided during training). Impacts:  The MFMP Team will convert User Roles and Groups for your agency.  Review the User Report and the Cross Walk handouts to ensure that agency user roles are mapped properly.  System Administrators may need to add roles to users so they will be assigned to the proper groups.

7. Page - 7 Conversion of Existing Users  Sample agency crosswalk review Current RoleMFMP 2.0 RoleMaps to Group(s) 3700: CIO Approver 3700: IT Approver Req Approver 3700: Contract Specialist Contract 3700: Exception Handler Invoicing 3700: Invoice Manager Invoicing 3700: IRM Approver - Admin Services 3700: IT Approver - Admin Services Req Approver 3700: Master Agreement Manager 3700: Contract Manager Contract Manager 3700: Purchasing Agent Purchasing 3700: Purchasing/Procurement Gatekeeper 3700: Purchasing Gatekeeper Purchasing 3700: System Administrator System Admin Analysis AuthorizedThis role will be deletedAnalysis CO No WorkflowThis role will be deletedCO No Workflow InquirerThis role will be deletedQuery Invoice InquirerThis role will be deletedQuery Requester - eQuoteThis role will be deletedEdit Accounting, eQuote, Requester Bold=Indicates new role name Do not appear in approval flow Users now have access to both Requester and Invoicing Info. Before they did not. Future query views will be limited with data scoping.

8. Page - 8 Adding a New User Demo – What’s new or different?  You can jump from the login page directly to Company Forms  When adding a new user, you will need to assign the user to roles and groups.  On the ‘Choose Values..’ pages:  you will ‘check’ the roles and groups instead of using the select button  The page x of y function is replaced by up and down scrolling New features or highlights for adding a new user:

9. Page - 9 Adding a new user in MFMP 2.0 – Sign in using jump to ‘Company Forms’ Select “Company Forms” from the jump menu

10. Page - 10 Adding a new user in MFMP 2.0 - Select ‘Company Forms’ link from homepage Select ’Company eForm’

11. Page - 11 Adding a new user in MFMP 2.0 - Click User Maintenance Select ‘User Maintenance’ eForm

12. Page - 12 Adding a new user in MFMP 2.0 - Click User Maintenance (Optional): Enter a title or description of the function you are performing. Using a meaningful description may help you in the future if you archive this job in your folders.

13. Page - 13 Adding a new user in MFMP 2.0 – Select the ‘Add’ Maintenance Function Select the ‘Add’ function

14. Page - 14 Adding a new user in MFMP 2.0 – Complete the eForm fields Complete the eForm – edit fields are shaded It is a best practice to always fill out all available fields.

15. Page - 15 Adding a new user in MFMP 2.0 – Complete the eForm Fields Role & Group Select the appropriate groups and PUI specific roles for the new user based on the new role crosswalk/user guide Login name will be determined after completing fields below - derived from the email address

16. Page - 16 Adding a new user in MFMP 2.0 – Assign PUI specific Roles Type in PUI. Note: Roles are only for routing purposes and they have no permissions. Page numbers have been replaced with the scroll bar. To navigate to the end of the query, scroll down.

17. Page - 17 Adding a new user in MFMP 2.0 – Assign PUI specific Roles Select the appropriate roles then press OK.

18. Page - 18 Adding a new user in MFMP 2.0 – Assign Groups Selected roles. To change the roles, click the ‘select’ link. Assign groups by clicking the ‘select’ link

19. Page - 19 Sample Groups  A Requester might be assigned the following :  Requester Group  Edit Accounting Group  eQuote Group  Query Group  With these Groups, the Requester could:  Access MFMP Buyer  Create Requisitions  Edit specific accounting fields  Access the eQuote punch-out site  Search for requisitions If this requester will only need to search for their own requisitions, you will not need to give them the Query Group.

20. Page - 20 Adding a new user in MFMP 2.0 – Assign Groups Select the groups that are appropriate for your user.

21. Page - 21 Adding a new user in MFMP 2.0 – Assign Groups When scrolling through a list with many values, occasionally you may encounter this page indicating the system is getting additional data for your list.

22. Page - 22 Adding a new user in MFMP 2.0 – Assign Groups Search for Groups – searching is automatically wildcard so it will return results with all or part of your search request. Select the groups – refer to the Group to Role crosswalk guide.

23. Page - 23 Adding a new user in MFMP 2.0 – Assign Groups Verify proper roles and groups. You may edit by selecting the links for each and change.

24. Page - 24 Adding a new user in MFMP 2.0 – Edit comments/attachments Add a comment as you see fit. A meaningful comment may help at a later time. Please follow your agency & MFMP attachment guidelines. Add an attachment as you see fit. Remember to check the box for your attachment.

25. Page - 25 Adding a new user in MFMP 2.0 – Add approvers Although no approvers are required, they may be added.

26. Page - 26 Adding a new user in MFMP 2.0 – Review data & Submit Always verify information on the summary page before you click submit.

27. Page - 27 Adding a new user in MFMP 2.0 – Change the new user’s password Because the system does not automatically assign new users a password, you must click on the ‘Company eForm’ link and select ‘Password Change’ to enter a temporary password for your user.

28. Page - 28 Adding a new user in MFMP 2.0 – Change the new user’s password Enter a title for the transaction as desired. Search for the user just added.

29. Page - 29 Adding a new user in MFMP 2.0 – Change the new user’s password Enter the new user’s name or partial name to search from the list – this will save you time unless you have a small list of users. The more information you enter – the smaller the list!

30. Page - 30 Adding a new user in MFMP 2.0 – Change the new user’s password The information for the new user will be pulled in from the data entered when adding the user. and assign a temporary password. Note: The user will be prompted to change the password on the initial login.

31. Page - 31 System Administrator Responsibilities On the MyFloridaMarketPlace Toolkit, there are Job Aids specifically for System/Security Administrators to assist you with your role.  Security Administrator Guidance - This document details the responsibilities of the System/Security Administrators. These responsibilities include creating new user accounts, assigning only necessary roles for each user (to avoid providing more access than needed to any one user), resetting passwords, and updating and inactivating users Security Administrator Guidance  MFMP User Inactivation Job Aid - This document provides the necessary steps for inactivating users in MyFloridaMarketPlace MFMP User Inactivation Job Aid Also available on the Toolkit, there are documents that give guidance regarding scanning and attaching documents, and how to remove documents if they contain confidential information.  Scanning and File Attachment Guidelines.doc - This document gives guidance for attaching documents, the size of file you can attach, and recommended file types Scanning and File Attachment Guidelines.doc  Attachment Purge Request Process - This document explains the process of removing any confidential information from MyFloridaMarketPlace Attachment Purge Request Process  PUR 3785 - Attachment Purge Request Form - Form to remove confidential information from MyFloridaMarketPlace PUR 3785 - Attachment Purge Request Form  Sample Confidential Information Policy - This document gives Security Administrators a sample policy on how their agency should handle the monitoring and removal of any confidential information that may have been inputted in MyFloridaMarketPlace. Sample Confidential Information Policy

32. Page - 32 User Inactivation  It is each agency Security Administrator’s responsibility to maintain the user account information for all users.  There will be occasions where a user account will need to be inactivated  Employee retires  Transfers to another agency  Terminated  There are several actions a Security Administrator will need to take in order to successfully transfer responsibilities from one user to another.

33. Page - 33 User Inactivation  The System Administrator will need to:  Change the password  Print the employees queues  Change the email address  Verify employee is not listed as the supervisor for other users.  Delegate the employee’s approval authority  (For complete step-by-step instructions, follow the MyFloridaMarketPlace User Inactivation Job Aid found on the Toolkit.) http://dms.myflorida.com/dms2/business_operations/state_purchasi ng/myflorida_marketplace/buyers/myflorida_marketplace_toolkit/job _aids http://dms.myflorida.com/dms2/business_operations/state_purchasi ng/myflorida_marketplace/buyers/myflorida_marketplace_toolkit/job _aids  After completing the steps above, you can inactivate the user account by using the User Maintenance eForm and selecting the maintenance mode of ‘Delete’.

34. Page - 34 User Inactivation  If the employee acted as an approver only in the system, account deletion will be possible.  A user account can only be deleted if a request is NOT in the following statuses:  Composing  Submitted  Approved  Ordering  Ordered  Canceling  Receiving  If the employee created a requisition ‘On Behalf Of’ another user, the system will not allow you to delete their account if the requisition status is listed above.

35. Page - 35 Delegation of Authority  As a reminder, the user should complete a Delegation of Authority when they are going to be on leave and/or out of the office and unable to obtain Internet access.  The delegation of authorization is completed by accessing Preferences, selecting Delegation of Authority and completing the required fields.  Delegation starts at 12:00 a.m. on the date selected.  Be sure to give enough time so that if your supervisor is required to approve your request, they will be able to do so in advance of the intended start date of the delegation.  Delegation is extremely important to ensure Requisition approvals as well as IRs are approved in a timely manner.

36. Page - 36 Delegating Authority

37. Page - 37 Scanning and Attachments Guidelines  MyFloridaMarketPlace is designed to support the storage of necessary payment-related information such as purchase orders, contracts and invoices and supporting documentation in conformance with established guidelines.  Attachments that include confidential information are not considered appropriate for uploading into MFMP, and if they are confidential, uploading them into MFMP may violate F.S. 119.071 as well as comparable federal regulations relating to confidentiality such as HIPAA.  It is the agency’s responsibility to redact this information prior to posting it to MyFloridaMarketPlace. Workflow approvals that are included in MyFloridaMarketPlace offer the opportunity for multiple users to identify and take action against a transaction that includes confidential information, including initiating the ‘Attachment Purge Request’ process (form and process is posted on the MyFloridaMarketPlace toolkit). http://dms.myflorida.com/dms2/business_operations/state_purchasing/myflorida_marketplace/buyers/ myflorida_marketplace_toolkit/job_aids and refer to the documents under Attachment Purging. http://dms.myflorida.com/dms2/business_operations/state_purchasing/myflorida_marketplace/buyers/ myflorida_marketplace_toolkit/job_aids  Attachments on a MyFloridaMarketPlace transaction should be less than 4 megabytes in size  Recommended File Types For MyFloridaMarketPlace.bmp – Bitmap Image.doc – MS Word.fdf – Adobe Acrobat Forms Document.csv – MS Excel Comma Separated Values File.rft – Rich Text Format.xls – MS Excel Worksheet.pcx – PCX Image Document.tif – TIF Image Document.wri – Write Document

38. Page - 38 HIPAA Information  Confidential Information that is directly related to an individual is prohibited from being included in MyFloridaMarketPlace. This includes information included in the comments field, line item description as well as attachments. The following list is the most common types of confidential information that a user should ensure is redacted from attachments included in MyFloridaMarketPlace. Agency specific questions about confidential information should be directed to the agency’s HIPAA compliance officer or General Counsel’s Office.  Names  All geographic subdivisions smaller than a state, including street addresses, city, county and zip codes.  All elements of dates (except year) directly related to an individual, including birth date, admission date, discharge date, and date of death.  Telephone numbers  Electronic mail addresses  Social security numbers  Medical record numbers  Health plan beneficiary numbers  Account numbers  Certificate/license numbers

39. Page - 39 HIPAA Audit  MyFloridaMarketPlace can assist you in following your agency’s confidential information policy by providing you with reports that search invoices or purchase requisitions for predefined commodity codes thought to be most likely to contain data/information.  These reports are available on the secure website at: http://dms-purchasing-ftp.state.fl.us/xx00/  A description of these reports is available in the report job aid posted on the Toolkit at: http://dms.myflorida.com/dms2/business_operations/state_purchasing/ myflorida_marketplace/buyers/myflorida_marketplace_toolkit/job_aids http://dms.myflorida.com/dms2/business_operations/state_purchasing/ myflorida_marketplace/buyers/myflorida_marketplace_toolkit/job_aids

40. Page - 40 Confidential Information Policy  Each agency is to submit a policy stating no confidential information will be inputted in MyFloridaMarketPlace.  Examples of confidential information are names, social security numbers, medical records, and addresses. Always consult your agency general counsel’s office if you have a question about what is confidential information.  The policy will also state how the agency will monitor for confidential information that may be inputted.  Each policy will have a training plan which includes how to train users not to put in confidential information.  Every agency will have a security officer who is responsible for their agency’s policy.  There is a sample policy posted for agencies to use as an example: http://dms.myflorida.com/dms2/business_operations/state_purchasing/ myflorida_marketplace/buyers/myflorida_marketplace_toolkit/job_aids http://dms.myflorida.com/dms2/business_operations/state_purchasing/ myflorida_marketplace/buyers/myflorida_marketplace_toolkit/job_aids