<status value="active"/> <experimental value="true"/> <date value="2025-11-01"/> <publisher value="HL7 International / Security"/> <contact> <telecom> <system value="url"/> <value value="http://www.hl7.org/Special/committees/secure"/> </telecom> <telecom> <system value="email"/> <value value="fhir@lists.hl7.org"/> </telecom> </contact> <description value="A sample of security labels from [Healthcare Privacy and Security Classification System](security-labels.html#hcs) that are used on events and requests/responses (aka user context or organization context) made up of PurposeOfUse and maybe a refrain/obligation."/> <jurisdiction> <coding> <system value="http://unstats.un.org/unsd/methods/m49/m49.htm"/> <code value="001"/> <display value="World"/> </coding> </jurisdiction> <compose> <include> <system value="http://terminology.hl7.org/CodeSystem/v3-ActReason"/> <concept> <code value="TREAT"/> </concept> <concept> <code value="HPAYMT"/> </concept> <concept> <code value="ETREAT"/> </concept> </include> <include> <system value="http://terminology.hl7.org/CodeSystem/v3-ActCode"/> <concept> <code value="NOAUTH"/> </concept> <concept> <code value="DELAU"/> </concept> <concept> <code value="NORDSCLCD"/> </concept> </include> </compose> </ValueSet>

Generated Narrative: ValueSet security-label-event-example

This value set includes codes based on the following rules:

Include these codes as defined in http://terminology.hl7.org/CodeSystem/v3-ActReason version 📦4.0.0

Code	Display	Definition
TREAT	treatment	To perform one or more operations on information for provision of health care.
HPAYMT	healthcare payment	To perform one or more operations on information for conducting financial or contractual activities related to payment for provision of health care.
ETREAT	Emergency Treatment	To perform one or more operations on information for provision of immediately needed health care for an emergent condition.

Include these codes as defined in http://terminology.hl7.org/CodeSystem/v3-ActCode version 📦10.0.0

Code	Display	Definition
NOAUTH	no disclosure without subject authorization	Prohibition on disclosure without information subject's authorization.
DELAU	delete after use	Custodian system must remove target information from access after use.
NORDSCLCD	no redisclosure without consent directive	Prohibition on redisclosure without patient consent directive.