============================================================================= Run Date: SEP 24, 2026 Designation: WEBP*1*65 Package : WEBP - PATIENT CENTERED MANAGEMENT Priority: Mandatory Version : 1 SEQ #62 Status: Released Compliance Date: OCT 26, 2026 ============================================================================= Subject: PCMM WEB DEFECT AND SECURITY SCAN REMEDIATION XXIX Category: - Informational Description: ============ The purpose of the patch is to remediate defects. There are 5 issues, 2 are defects, and 3 are adaptive maintenance issues. Defects: -------- 1.PCMMW-5416 When DoD is rescinded for station, reset of DoD and reversion of unassigned for DoD patient assignments are possible at other stations. 2.PCMMW-5419 Optimize UM active user list loading function to prevent duplicate results. Adaptive Maintenance: --------------------- 1.PCMMW-5372 CodeQL flagged high issue in PCMM UI https://va.ghe.com/software/pcmm-webp-pcmmr/security/code-scanning/19 2.PCMMW-5412 Optimize user's permission fetching to avoid multiple DB calls. EHRM Impact Statement: ---------------------- This patch can be installed at all sites, including EHRM converted sites. Patch Components: ----------------- Files & Fields Associated: File Name (Number) Field Name (Number) New/Modified/Deleted ------------------ ------------------- -------------------- N/A Forms Associated: Form Name File Number New/Modified/Deleted --------- ----------- -------------------- N/A Mail Groups Associated: Mail Group Name New/Modified/Deleted --------------- -------------------- N/A Options Associated: Option Name Type New/Modified/Deleted ----------- ---- -------------------- N/A Protocols Associated: Protocol Name New/Modified/Deleted ------------- -------------------- N/A Security Keys Associated: Security Key Name ----------------- N/A Templates Associated: Template Name Type File Name (Number) New/Modified/Deleted ------------- ---- ------------------ -------------------- N/A Remote Procedures Associated: Remote Procedure Name New/Modified/Deleted --------------------- -------------------- N/A Parameter Definitions Associated: Parameter Name New/Modified/Deleted -------------- -------------------- N/A Additional Information: ----------------------- N/A New Service Requests (NSRs): N/A Patient Safety Issues (PSIs): N/A Defect Tracking System Ticket(s) & Overview: -------------------------------------------- 1.PCMMW-5416 When DoD is rescinded for station, reset of DoD and reversion of unassigned for DoD patient assignments are possible at other stations. Problem: -------- When DoD is rescinded for station, reset of DoD and reversion of unassigned for DoD patient assignments are possible at other stations. This should not happen. Resolution: ----------- Updated station comparison to only use stations with the same three digit station when resetting DoD and restoring DoD un-assigned assignments. 2.PCMMW-5419 Optimize UM active user list loading function to prevent duplicate results. Problem: -------- The query for data to display users active in the last 90 days was not filtering non-PCMM user records out and because of the join could create duplicate records Resolution: ----------- Updated query to filter out non-pcmm users and use "distinct" to prevent duplicates. Adaptive Maintenance Tracking System Ticket(s) & Overview: ---------------------------------------------------------- 1.PCMMW-5372 CodeQL flagged high issue in PCMM UI https://va.ghe.com/software/pcmm-webp-pcmmr/security/code-scanning/19 Problem: -------- CodeQL flagged special character escaping using regex as problematic, possibly susceptible to attach. Resolution: ----------- Replaced regex sanitization with using DOMPurify sanitization functionality. 2.PCMMW-5412 Optimize user's permission fetching to avoid multiple DB calls. Problem: -------- Code used loop to fetch permissions for each role in the set using multiple database queries, which were bad for performance. Resolution: ----------- Updated query to use join and added distinct to query to fetch all distinct permissions for all roles in the set in one query. Test Sites: ----------- Memphis VA Medical Center (Memphis, TN) Omaha VA Medical Center (Omaha, Nebraska) SNOW Change Order #: -------------------- CHG0783329 - Centralized Servers - Austin Information Technology Center, Austin, TX Software and Documentation Retrieval Instructions: -------------------------------------------------- PCMM Web patch, WEBP*1*65, is a centrally managed web-based application and will be implemented and deployed to a central web server. Sites do not need to download any file for the patch installation. Other Software Files: --------------------- This release also includes other software files. Other software files can be obtained by accessing the URL: https://download.vista.domain.ext/index.html/SOFTWARE File Name Description -------------------------------------------------------- pcmmr_ear-1.0-65-03.ear Installation file pcmmr_unattended_ear-1.0-65-03.ear Installation file cissUserManagement-1.0-65-03.ear Installation file Documentation describing the new functionality is included in this release. Documentation can be found on the VA Software Documentation Library at: https://www.domain.ext/vdl/. Documentation can also be obtained at https://download.vista.domain.ext/index.html/SOFTWARE. Documentation Title File Name --------------------------------------------------------------------- Deployment, Installation Back-Out, WEBP_1.0_65_DIBRG.DOCX and Rollback Guide WEBP_1.0_65_DIBRG.PDF Patch Installation: =================== PCMM Web patch, WEBP*1*65, is a centrally managed web-based application and will be implemented and deployed to a central web server. No installation is required by sites. Pre/Post Installation overview: --------------------------------------- N/A Pre-Installation Instructions: ------------------------------ Installation Instructions: ------------------------- ****************************************************************** ** PLEASE NOTE: THERE IS NO INSTALLATION FOR THIS PATCH. ** ****************************************************************** This informational patch, WEBP*1.0*65, is for PCMM Web. Installation is done on a centralized server. Please refer to the WEBP_1.0_65_DIBRG.PDF for more details. Post-Installation Instructions: ----------------------------- N/A Back-Out Plan: -------------------------- Backout plan is provided as part of deployment guide detailed in the Deployment, Installation Back-Out, and Rollback Guide. Routine Information: ==================== No routines included. ============================================================================= User Information: Entered By : Date Entered : AUG 06, 2026 Completed By: Date Completed: SEP 23, 2026 Released By : Date Released : SEP 24, 2026 ============================================================================= Packman Mail Message: ===================== No routines included