Da Vinci Clinical Data Exchange (CDex)
2.1.0 - STU 2.1 United States of America flag

Da Vinci Clinical Data Exchange (CDex), published by HL7 International / Payer/Provider Information Exchange Work Group. This guide is not an authorized publication; it is the continuous build for version 2.1.0 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/davinci-ecdx/ and changes regularly. See the Directory of published versions

Security and Privacy

Page standards status: Trial-use

Da Vinci HRex Security and Privacy Requirements

This implementation guide inherits all of the mandatory requirements and recommendations defined in the HRex Security and Privacy specification. Implementers SHALL read and adhere to the guidance for the following topics:

  • Da Vinci's Guiding Principles
  • Statutes, Regulations
  • Clinical Safety Guidelines
  • FHIR Security and Implementation Guidance
  • Security/Privacy-Related Technologies, Including Explicit Consent and Security - Labels
  • Exchange Security
  • Additionally Protected Information
  • Security Contexts for Da Vinci IGs

Supplemental Guidance

General Considerations

  1. User scopes SHALL be used as defined in SMART App Launch to restrict access to the relevant patients for a given Data Consumer. Organizational user access scopes are typically pre-negotiated and documented via business agreements. Data Sources shall translate these agreements into the appropriate SMART App Launch scopes.

  2. Audit mechanisms need to be in place so that exchange mechanisms with or without human intervention can be subject to review/oversight.

Purpose of Use

The purpose for which data may be used by or on behalf of an organization is known as the Purpose of Use (POU). It is an integral part of the data-sharing agreement between Data Consumers and Data Sources because privacy policies and consent directives dictate data requests' responses. Typically, a single POU is assigned for a client application when the app is registered and broadly defined POU types such as those listed in the [NHIN Purpose Of Use Code System]. For example, a Payer's typical POU is "OPERATIONS," and a Provider's typical POU is "TREATMENT". Therefore, it is implicit when the Data Consumer makes a direct query or an "automatically fulfilled" Task to the Data Source using that app.

For CDex Task-based queries, the Data Consumer and Data Source MAY communicate the POU for the requested data for each Task using codes from the CDex Purpose of Use Value Set in the POU Task.input element. This element is intended to define a new way to exchange data with dynamically defined POUs.

Sensitive and Confidential Data

If a data-consuming system requests sensitive information, the data source must decide whether the requester is authorized to access some or all of this information. For example, suppose the level of confidentiality protection required for some or all of the information requested by a data-consuming system is more stringent than the "default" confidentiality protection provided for HIPAA PHI. In that case, the data source needs to be able to decide whether to provide the information at all or whether to filter the information.

The FHIR Data Segmentation for Privacy (ballot version) standardizes how guidance for applying security labels in FHIR. Once ONC or CMS adopts it or a suitable approach by regulation, a future version of this guide will reference it. In the interim, implementers should consult with their compliance department to determine requirements and how best to satisfy them, whether with in-band or out-of-band communications.

[Da Vinci Prior Authorization Support (PAS)]: [CDex Work Queue Value Set]: ValueSet-cdex-work-queue.html [What is Signed]: signatures.html#what-is-signed [Signatures for Task Based Requests]: task-based-approach.html#signatures [X12]: https://x12.org/ [X12 transactions]: https://x12.org/ [X12 Transaction Sets]: https://x12.org/products/transaction-sets [HEDIS]: https://en.wikipedia.org/wiki/Healthcare_Effectiveness_Data_and_Information_Set [Specification]: specification.html [$match]: http://hl7.org/fhir/R4/patient-operation-match.html [Coverage]: http://hl7.org/fhir/R4/coverage.html [FHIR RESTful Search syntax]: http://hl7.org/fhir/R4/search.html#Introduction [DocumentReference]: http://hl7.org/fhir/R4/documentreference.html [FHIR Signature]: http://hl7.org/fhir/R4/datatypes.html#signature [Bundle.signature]: http://hl7.org/fhir/R4/bundle-definitions.html#Bundle.signature [enveloped signature]: http://www.w3.org/TR/xmldsig-core/#def-SignatureEnveloped [(Verification Signature)]: http://hl7.org/fhir/R4/valueset-signature-type.html [FHIR Document]: http://hl7.org/fhir/R4/documents.html [RFC 7515]: https://tools.ietf.org/html/rfc7515 [JSON Signature rules]: http://hl7.org/fhir/R4/datatypes.html#JSON [RFC 7515: JSON Web Signature (JWS)]: https://tools.ietf.org/html/rfc7515 [Detached]: https://tools.ietf.org/html/rfc7515#appendix-F [Canonical JSON]: http://hl7.org/fhir/R4/json.html#canonical [JWS JSON Serialization]: https://datatracker.ietf.org/doc/html/rfc7515#section-3.2 [X.509 certificates]: https://www.itu.int/rec/T-REC-X.509 [RFC 7518]: https://tools.ietf.org/html/rfc7518 [RFC 7517]: https://tools.ietf.org/html/rfc7517 [RFC 8785]: https://datatracker.ietf.org/doc/rfc8785 [self-signed certificates]: https://en.wikipedia.org/wiki/Self-signed_certificate [Signed SearchSet Bundle Example]: signed-searchset-bundle-example.html [Signed Document Bundle Example]: signed-document-bundle-example.html [FHIR-36158]: https://jira.hl7.org/browse/FHIR-36158 [Solicited and Unsolicited Attachments]: solicited-unsolicited-attachments.html [Sending Attachments]: sending-attachments.html [Requesting Attachments Using Attachment Codes]: requesting-attachments-code.html [Requesting Attachments Using Questionnaires]: requesting-attachments-questionnaire.html [Using Questionnaire as Task Input]: task-based-approach.html#using-questionnaire-as-task-input [Using CDex Attachments with DaVinci PAS]: burden-reduction.html [CDex Task Attachment Request Profile]: StructureDefinition-cdex-task-attachment-request.html [LOINC attachment codes]: https://loinc.org/attachments/ [Parameters]: http://hl7.org/fhir/R4/parameters.html [CDex Patient Demographics Profile]: StructureDefinition-cdex-patient-demographics.html [CDex Claim Use Value Set]: ValueSet-cdex-claim-use.html [Prior-Auth AttachmentRequest Example]: Task-cdex-task-example20.html [Claim AttachmentRequest Example]: Task-cdex-task-example19.html [CDex Temporary Code System]: CodeSystem-cdex-temp.html [NHIN Purpose Of Use Code System]: http://hl7.org/fhir/R4/codesystem-nhin-purposeofuse.html [LOINC Document Ontology]: https://loinc.org/document-ontology/ [CDex Signature Bundle Profile]: StructureDefinition-cdex-signature-bundle.html [FHIR RESTful search]: http://hl7.org/fhir/R4/http.html#search [FHIR RESTful read]: http://hl7.org/fhir/R4/http.html#read [Change Log]: changes.html [CDex Parameters Example1]: Parameters-cdex-parameters-example1.html [CDex Parameters Example2]: Parameters-cdex-parameters-example2.html [CDex Parameters Example3]: Parameters-cdex-parameters-example3.html [CDex Parameters Example4]: Parameters-cdex-parameters-example4.html [validating profiles and resources]: http://hl7.org/fhir/R4/validation.html [ImplementationGuide]: http://hl7.org/fhir/R4/implementationguide.html [CDex ImplementationGuide Resource]: ImplementationGuide-hl7.fhir.us.davinci-cdex.html [Da Vinci DTR]: http://hl7.org/fhir/us/davinci-dtr/2.1.0-preview [Questionnaire]: http://hl7.org/fhir/R4/questionnaire.html [Smart Version 2.0.0 EHR launch flow]: https://hl7.org/fhir/smart-app-launch/app-launch.html#launch-app-ehr-launch [Using Da Vinci DTR to Complete the Questionnaire]: requesting-attachments-questionnaire.html#using-da-vinci-dtr-to-complete-the-questionnaire [Conforming to CDex Attachments]: attachments-conformance.html [Request for Additional Information]: /additionalinfo.html [SDC Questionnaire Response Profile]:http://hl7.org/fhir/uv/sdc/STU3StructureDefinition-sdc-questionnaireresponse.html [SDC Adaptive Questionnaire Response Profile]:http://hl7.org/fhir/uv/sdc/STU3StructureDefinition-sdc-questionnaireresponse-adapt.html [45 CFR 164.506 Treatment, Payment, and Health Care Operations (TPO)]: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.506 [must support]: http://hl7.org/fhir/us/davinci-hrex/STU1.1/conformance.html [DTR SMART App Launch]: requesting-attachments-questionnaire.html#dtr-smart-app-launch [Conforming to CDex Task Based Approach]: task-based-conformance.html [Signature Extension]: http://hl7.org/fhir/StructureDefinition/questionnaireresponse-signature [DTR Standard Questionnaire]: http://hl7.org/fhir/us/davinci-dtr/2.1.0-previewStructureDefinition-dtr-std-questionnaire.html [signatureRequired]: http://hl7.org/fhir/StructureDefinition/questionnaire-signatureRequired [CDex Signature Profile]: StructureDefinition-cdex-signature.html [CDex SDC QuestionnaireResponse Profile]: StructureDefinition-cdex-sdc-questionnaireresponse.html [QuestionnaireResponse]: http://hl7.org/fhir/R4/questionnaireresponse.html [Topic-Based Subscriptions Framework]: http://hl7.org/fhir/2022Sep/subscriptions.html [C-CDA on FHIR Documents]: http://www.hl7.org/fhir/us/ccda/index.html [FHIR Conformance]: http://hl7.org/fhir/R4/conformance-rules.html#conflang [Must Support]: http://hl7.org/fhir/R4/profiling.html#mustsupport [modifier elements]: http://hl7.org/fhir/R4/conformance-rules.html#isModifier [CDex PractitionerRole Profile]: StructureDefinition-cdex-practitionerrole.html [CDex Task Update]: SubscriptionTopic-cdex-task-update.html [Subscription R5 Backport Implementation Guide]: http://hl7.org/fhir/uv/subscriptions-backport/STU1.1 [SubscriptionTopic]: https://hl7.org/fhir/R4B/subscriptiontopic.html [CapabilityStatement SubscriptionTopic Canonical]: http://hl7.org/fhir/uv/subscriptions-backport/STU1.1/StructureDefinition-capabilitystatement-subscriptiontopic-canonical.html [Conformance in FHIR R4]: http://hl7.org/fhir/uv/subscriptions-backport/STU1.1/conformance.html#conformance-in-fhir-r4 [R4/B Topic-Based Subscription Profile]: http://hl7.org/fhir/uv/subscriptions-backport/STU1.1/StructureDefinition-backport-subscription.html [R4 Topic-Based Subscription Notification Bundle]: http://hl7.org/fhir/uv/subscriptions-backport/STU1.1/StructureDefinition-backport-subscription-notification-r4.html [HRex Task Status ValueSet]: http://hl7.org/fhir/us/davinci-hrex/STU1.1/ValueSet-hrex-task-status.html [Task.businessStatus]: http://hl7.org/fhir/R4/task-definitions.html#Task.businessStatus [Benefits]: task-based-approach.html#benefits [Task Inputs and Outputs]: task-based-approach.html#task-inputs-and-outputs [Purpose of Use]: task-based-approach.html#purpose-of-use [Task Reason]: task-based-approach.html#task-reason [Discovery of Identifiers]: task-based-approach.html#discovery-of-identifiers [Task State Machine]: task-based-approach.html#task-state-machine [Approaches to Exchanging FHIR Data]: https://hl7.org/fhir/R5/exchanging.html [PAS Claim Response Bundle]: /StructureDefinition-profile-pas-response-bundle.html [PAS Task]: /StructureDefinition-profile-task.html [Patient Matching]: https://hl7.org/fhir/us/identity-matching/patient-matching.html [Guidance on Identity Assurance]: https://hl7.org/fhir/us/identity-matching/guidance-on-identity-assurance.html [Interoperable Digital Identity and Patient Matching]: https://hl7.org/fhir/us/identity-matching/index.html [CQL]: https://cql.hl7.org/ [Da Vinci Use Cases]: https://confluence.hl7.org/display/DVP/Da+Vinci+Use+Cases [FHIR R4 core]: http://hl7.org/fhir/R4/fhir-spec.zip [FHIR core downloads]: http://hl7.org/fhir/R4/downloads.html [validator]: https://fhir.github.io/latest-ig-validator/org.hl7.fhir.validator.jar [instructions on how to use it]: https://confluence.hl7.org/display/FHIR/Using+the+FHIR+Validator