3 * delete tool, for logging and removing patient data.
5 * Called from many different pages.
7 * Copyright (C) 2005-2016 Rod Roark <rod@sunsetsystems.com>
8 * Copyright (C) 2015 Roberto Vasquez <robertogagliotta@gmail.com>
10 * LICENSE: This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version 2
13 * of the License, or (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program. If not, see <http://opensource.org/licenses/gpl-license.php>;.
22 * @author Rod Roark <rod@sunsetsystems.com>
23 * @author Roberto Vasquez <robertogagliotta@gmail.com>
24 * @link http://www.open-emr.org
27 use OpenEMR\Core\Header
;
29 require_once('../globals.php');
30 require_once($GLOBALS['srcdir'].'/log.inc');
31 require_once($GLOBALS['srcdir'].'/acl.inc');
32 require_once($GLOBALS['srcdir'].'/sl_eob.inc.php');
34 $patient = $_REQUEST['patient'];
35 $encounterid = $_REQUEST['encounterid'];
36 $formid = $_REQUEST['formid'];
37 $issue = $_REQUEST['issue'];
38 $document = $_REQUEST['document'];
39 $payment = $_REQUEST['payment'];
40 $billing = $_REQUEST['billing'];
41 $transaction = $_REQUEST['transaction'];
45 // Delete rows, with logging, for the specified table using the
46 // specified WHERE clause.
48 function row_delete($table, $where)
50 $tres = sqlStatement("SELECT * FROM $table WHERE $where");
52 while ($trow = sqlFetchArray($tres)) {
54 foreach ($trow as $key => $value) {
55 if (! $value ||
$value == '0000-00-00 00:00:00') {
63 $logstring .= $key . "= '" . $value . "' ";
66 newEvent("delete", $_SESSION['authUser'], $_SESSION['authProvider'], 1, "$table: $logstring");
71 $query = "DELETE FROM $table WHERE $where";
72 if (!$GLOBALS['sql_string_no_show_screen']) {
73 echo text($query) . "<br>\n";
80 // Deactivate rows, with logging, for the specified table using the
81 // specified SET and WHERE clauses.
83 function row_modify($table, $set, $where)
85 if (sqlQuery("SELECT * FROM $table WHERE $where")) {
86 newEvent("deactivate", $_SESSION['authUser'], $_SESSION['authProvider'], 1, "$table: $where");
87 $query = "UPDATE $table SET $set WHERE $where";
88 if (!$GLOBALS['sql_string_no_show_screen']) {
89 echo text($query) . "<br>\n";
96 // We use this to put dashes, colons, etc. back into a timestamp.
98 function decorateString($fmt, $str)
102 $fc = substr($fmt, 0, 1);
103 $fmt = substr($fmt, 1);
105 $res .= substr($str, 0, 1);
106 $str = substr($str, 1);
115 // Delete and undo product sales for a given patient or visit.
116 // This is special because it has to replace the inventory.
118 function delete_drug_sales($patient_id, $encounter_id = 0)
120 $where = $encounter_id ?
"ds.encounter = '" . add_escape_custom($encounter_id) . "'" :
121 "ds.pid = '" . add_escape_custom($patient_id) . "' AND ds.encounter != 0";
122 sqlStatement("UPDATE drug_sales AS ds, drug_inventory AS di " .
123 "SET di.on_hand = di.on_hand + ds.quantity " .
124 "WHERE $where AND di.inventory_id = ds.inventory_id");
126 row_delete("drug_sales", "encounter = '" . add_escape_custom($encounter_id) . "'");
128 row_delete("drug_sales", "pid = '" . add_escape_custom($patient_id) . "'");
132 // Delete a form's data that is specific to that form.
134 function form_delete($formdir, $formid, $patient_id, $encounter_id)
136 $formdir = ($formdir == 'newpatient') ?
'encounter' : $formdir;
137 $formdir = ($formdir == 'newGroupEncounter') ?
'groups_encounter' : $formdir;
138 if (substr($formdir, 0, 3) == 'LBF') {
139 row_delete("lbf_data", "form_id = '" . add_escape_custom($formid) . "'");
140 // Delete the visit's "source=visit" attributes that are not used by any other form.
141 $where = "pid = '" . add_escape_custom($patient_id) . "' AND encounter = '" .
142 add_escape_custom($encounter_id) . "' AND field_id NOT IN (" .
143 "SELECT lo.field_id FROM forms AS f, layout_options AS lo WHERE " .
144 "f.pid = '" . add_escape_custom($patient_id) . "' AND f.encounter = '" .
145 add_escape_custom($encounter_id) . "' AND f.formdir LIKE 'LBF%' AND " .
146 "f.deleted = 0 AND f.form_id != '" . add_escape_custom($formid) . "' AND " .
147 "lo.form_id = f.formdir AND lo.source = 'E' AND lo.uor > 0)";
148 // echo "<!-- $where -->\n"; // debugging
149 row_delete("shared_attributes", $where);
150 } else if ($formdir == 'procedure_order') {
151 $tres = sqlStatement("SELECT procedure_report_id FROM procedure_report " .
152 "WHERE procedure_order_id = ?", array($formid));
153 while ($trow = sqlFetchArray($tres)) {
154 $reportid = 0 +
$trow['procedure_report_id'];
155 row_delete("procedure_result", "procedure_report_id = '" . add_escape_custom($reportid) . "'");
158 row_delete("procedure_report", "procedure_order_id = '" . add_escape_custom($formid) . "'");
159 row_delete("procedure_order_code", "procedure_order_id = '" . add_escape_custom($formid) . "'");
160 row_delete("procedure_order", "procedure_order_id = '" . add_escape_custom($formid) . "'");
161 } else if ($formdir == 'physical_exam') {
162 row_delete("form_$formdir", "forms_id = '" . add_escape_custom($formid) . "'");
164 row_delete("form_$formdir", "id = '" . add_escape_custom($formid) . "'");
168 // Delete a specified document including its associated relations and file.
170 function delete_document($document)
172 $trow = sqlQuery("SELECT url, thumb_url, storagemethod, couch_docid, couch_revid FROM documents WHERE id = ?", array($document));
174 $thumb_url = $trow['thumb_url'];
175 row_delete("categories_to_documents", "document_id = '" . add_escape_custom($document) . "'");
176 row_delete("documents", "id = '" . add_escape_custom($document) . "'");
177 row_delete("gprelations", "type1 = 1 AND id1 = '" . add_escape_custom($document) . "'");
179 switch ((int)$trow['storagemethod']) {
180 //for hard disk store
182 @unlink
(substr($url, 7));
184 if (!is_null($thumb_url)) {
185 @unlink
(substr($thumb_url, 7));
190 $couchDB = new CouchDB();
191 $couchDB->DeleteDoc($GLOBALS['couchdb_dbase'], $trow['couch_docid'], $trow['couch_revid']);
198 <?php Header
::setupHeader('opener'); ?
>
199 <title
><?php
echo xlt('Delete Patient, Encounter, Form, Issue, Document, Payment, Billing or Transaction'); ?
></title
>
201 <script language
="javascript">
202 function submit_form()
204 document
.deletefrm
.submit();
206 // Java script function for closing the popup
207 function popup_close() {
213 <body
class="body_top">
215 // If the delete is confirmed...
217 if ($_POST['form_submit']) {
219 if (!acl_check('admin', 'super') ||
!$GLOBALS['allow_pat_delete']) {
220 die("Not authorized!");
223 row_modify("billing", "activity = 0", "pid = '" . add_escape_custom($patient) . "'");
224 row_modify("pnotes", "deleted = 1", "pid = '" . add_escape_custom($patient) . "'");
225 // row_modify("prescriptions" , "active = 0" , "patient_id = '$patient'");
226 row_delete("prescriptions", "patient_id = '" . add_escape_custom($patient) . "'");
227 row_delete("claims", "patient_id = '" . add_escape_custom($patient) . "'");
228 delete_drug_sales($patient);
229 row_delete("payments", "pid = '" . add_escape_custom($patient) . "'");
230 row_delete("ar_activity", "pid = '" . add_escape_custom($patient) . "'");
231 row_delete("openemr_postcalendar_events", "pc_pid = '" . add_escape_custom($patient) . "'");
232 row_delete("immunizations", "patient_id = '" . add_escape_custom($patient) . "'");
233 row_delete("issue_encounter", "pid = '" . add_escape_custom($patient) . "'");
234 row_delete("lists", "pid = '" . add_escape_custom($patient) . "'");
235 row_delete("transactions", "pid = '" . add_escape_custom($patient) . "'");
236 row_delete("employer_data", "pid = '" . add_escape_custom($patient) . "'");
237 row_delete("history_data", "pid = '" . add_escape_custom($patient) . "'");
238 row_delete("insurance_data", "pid = '" . add_escape_custom($patient) . "'");
240 $res = sqlStatement("SELECT * FROM forms WHERE pid = ?", array($patient));
241 while ($row = sqlFetchArray($res)) {
242 form_delete($row['formdir'], $row['form_id'], $row['pid'], $row['encounter']);
245 row_delete("forms", "pid = '" . add_escape_custom($patient) . "'");
247 // Delete all documents for the patient.
248 $res = sqlStatement("SELECT id FROM documents WHERE foreign_id = ?", array($patient));
249 while ($row = sqlFetchArray($res)) {
250 delete_document($row['id']);
253 row_delete("patient_data", "pid = '" . add_escape_custom($patient) . "'");
254 } else if ($encounterid) {
255 if (!acl_check('admin', 'super')) {
256 die("Not authorized!");
259 row_modify("billing", "activity = 0", "encounter = '" . add_escape_custom($encounterid) . "'");
260 delete_drug_sales(0, $encounterid);
261 row_delete("ar_activity", "encounter = '" . add_escape_custom($encounterid) . "'");
262 row_delete("claims", "encounter_id = '" . add_escape_custom($encounterid) . "'");
263 row_delete("issue_encounter", "encounter = '" . add_escape_custom($encounterid) . "'");
264 $res = sqlStatement("SELECT * FROM forms WHERE encounter = ?", array($encounterid));
265 while ($row = sqlFetchArray($res)) {
266 form_delete($row['formdir'], $row['form_id'], $row['pid'], $row['encounter']);
269 row_delete("forms", "encounter = '" . add_escape_custom($encounterid) . "'");
270 } else if ($formid) {
271 if (!acl_check('admin', 'super')) {
272 die("Not authorized!");
275 $row = sqlQuery("SELECT * FROM forms WHERE id = ?", array($formid));
276 $formdir = $row['formdir'];
278 die("There is no form with id '" . text($formid) . "'");
280 form_delete($formdir, $row['form_id'], $row['pid'], $row['encounter']);
281 row_delete("forms", "id = '" . add_escape_custom($formid) . "'");
283 if (!acl_check('admin', 'super')) {
284 die("Not authorized!");
287 row_delete("issue_encounter", "list_id = '" . add_escape_custom($issue) ."'");
288 row_delete("lists", "id = '" . add_escape_custom($issue) ."'");
289 } else if ($document) {
290 if (!acl_check('admin', 'super')) {
291 die("Not authorized!");
294 delete_document($document);
295 } else if ($payment) {
296 if (!acl_check('admin', 'super')) {
297 die("Not authorized!");
300 list($patient_id, $timestamp, $ref_id) = explode(".", $payment);
301 // if (empty($ref_id)) $ref_id = -1;
302 $timestamp = decorateString('....-..-.. ..:..:..', $timestamp);
303 $payres = sqlStatement("SELECT * FROM payments WHERE " .
304 "pid = ? AND dtime = ?", array($patient_id, $timestamp));
305 while ($payrow = sqlFetchArray($payres)) {
306 if ($payrow['encounter']) {
308 // The session ID passed in is useless. Look for the most recent
309 // patient payment session with pay total matching pay amount and with
310 // no adjustments. The resulting session ID may be 0 (no session) which
311 // is why we start with -1.
312 $tpmt = $payrow['amount1'] +
$payrow['amount2'];
313 $seres = sqlStatement("SELECT " .
314 "SUM(pay_amount) AS pay_amount, session_id " .
315 "FROM ar_activity WHERE " .
317 "encounter = ? AND " .
318 "payer_type = 0 AND " .
319 "adj_amount = 0.00 " .
320 "GROUP BY session_id ORDER BY session_id DESC", array($patient_id, $payrow['encounter']));
321 while ($serow = sqlFetchArray($seres)) {
322 if (sprintf("%01.2f", $serow['adj_amount']) != 0.00) {
326 if (sprintf("%01.2f", $serow['pay_amount'] - $tpmt) == 0.00) {
327 $ref_id = $serow['session_id'];
333 die(xlt('Unable to match this payment in ar_activity') . ": " . text($tpmt));
336 // Delete the payment.
339 "pid = '" . add_escape_custom($patient_id) . "' AND " .
340 "encounter = '" . add_escape_custom($payrow['encounter']) . "' AND " .
341 "payer_type = 0 AND " .
342 "pay_amount != 0.00 AND " .
343 "adj_amount = 0.00 AND " .
344 "session_id = '" . add_escape_custom($ref_id) . "'"
349 "patient_id = '" . add_escape_custom($patient_id) ."' AND " .
350 "session_id = '" . add_escape_custom($ref_id) . "'"
354 // Encounter is 0! Seems this happens for pre-payments.
355 $tpmt = sprintf("%01.2f", $payrow['amount1'] +
$payrow['amount2']);
356 // Patched out 09/06/17- If this is prepayment can't see need for ar_activity when prepayments not stored there? In this case passed in session id is valid.
357 // Was causing delete of wrong prepayment session in the case of delete from checkout undo and/or front receipt delete if payment happens to be same
358 // amount of a previous prepayment. Much tested but look here if problems in postings.
360 /* row_delete("ar_session",
361 "patient_id = ' " . add_escape_custom($patient_id) . " ' AND " .
362 "payer_id = 0 AND " .
363 "reference = '" . add_escape_custom($payrow['source']) . "' AND " .
364 "pay_total = '" . add_escape_custom($tpmt) . "' AND " .
365 "(SELECT COUNT(*) FROM ar_activity where ar_activity.session_id = ar_session.session_id) = 0 " .
366 "ORDER BY session_id DESC LIMIT 1"); */
368 row_delete("ar_session", "session_id = '" . add_escape_custom($ref_id) . "'");
371 row_delete("payments", "id = '" . add_escape_custom($payrow['id']) . "'");
373 } else if ($billing) {
374 if (!acl_check('acct', 'disc')) {
375 die("Not authorized!");
378 list($patient_id, $encounter_id) = explode(".", $billing);
379 sqlStatement("DELETE FROM ar_activity WHERE " .
380 "pid = ? AND encounter = ? ", array($patient_id, $encounter_id));
381 sqlStatement("DELETE ar_session FROM ar_session LEFT JOIN " .
382 "ar_activity ON ar_session.session_id = ar_activity.session_id " .
383 "WHERE ar_activity.session_id IS NULL");
387 "pid = '" . add_escape_custom($patient_id) . "' AND " .
388 "encounter = '" . add_escape_custom($encounter_id) . "' AND " .
389 "code_type = 'COPAY' AND " .
392 sqlStatement("UPDATE form_encounter SET last_level_billed = 0, " .
393 "last_level_closed = 0, stmt_count = 0, last_stmt_date = NULL " .
394 "WHERE pid = ? AND encounter = ?", array($patient_id, $encounter_id));
395 sqlStatement("UPDATE drug_sales SET billed = 0 WHERE " .
396 "pid = ? AND encounter = ?", array($patient_id, $encounter_id));
397 updateClaim(true, $patient_id, $encounter_id, -1, -1, 1, 0, ''); // clears for rebilling
398 } else if ($transaction) {
399 if (!acl_check('admin', 'super')) {
400 die("Not authorized!");
403 row_delete("transactions", "id = '" . add_escape_custom($transaction) . "'");
405 die("Nothing was recognized to delete!");
409 $info_msg = xl('Delete successful.');
412 // Close this window and tell our opener that it's done.
413 // Not sure yet if the callback can be used universally.
414 echo "<script language='JavaScript'>\n";
417 echo " alert('" . addslashes($info_msg) . "');\n";
419 echo " dlgclose('imdeleted',false);\n";
421 if ($GLOBALS['sql_string_no_show_screen']) {
422 echo " dlgclose('imdeleted', $encounterid);\n";
423 } else { // this allows dialog to stay open then close with button or X.
424 echo " opener.dlgSetCallBack('imdeleted', $encounterid);\n";
427 echo "</script></body></html>\n";
432 <form method
='post' name
="deletefrm" action
='deleter.php?patient=<?php echo attr($patient) ?>&encounterid=<?php echo attr($encounterid) ?>&formid=<?php echo attr($formid) ?>&issue=<?php echo attr($issue) ?>&document=<?php echo attr($document) ?>&payment=<?php echo attr($payment) ?>&billing=<?php echo attr($billing) ?>&transaction=<?php echo attr($transaction) ?>' onsubmit
="javascript:alert('1');document.deleform.submit();">
434 <p
class="lead"> 
;<br
><?php
echo xlt('Do you really want to delete'); ?
>
438 echo xlt('patient') . " " . text($patient);
439 } else if ($encounterid) {
440 echo xlt('encounter') . " " . text($encounterid);
441 } else if ($formid) {
442 echo xlt('form') . " " . text($formid);
444 echo xlt('issue') . " " .text($issue);
445 } else if ($document) {
446 echo xlt('document') . " " . text($document);
447 } else if ($payment) {
448 echo xlt('payment') . " " .text($payment);
449 } else if ($billing) {
450 echo xlt('invoice') . " " . text($billing);
451 } else if ($transaction) {
452 echo xlt('transaction') . " " . text($transaction);
454 ?
> <?php
echo xlt('and all subordinate data? This action will be logged'); ?
>!</p
>
455 <div
class="btn-group">
456 <a href
="#" onclick
="submit_form()" class="btn btn-lg btn-save btn-default"><?php
echo xlt('Yes, Delete and Log'); ?
></a
>
457 <a href
='#' class="btn btn-lg btn-link btn-cancel" onclick
="popup_close();"><?php
echo xlt('No, Cancel');?
></a
>
459 <input type
='hidden' name
='form_submit' value
='<?php echo xla('Yes
, Delete
and Log
'); ?>'/>