6.5 Resource Permission - Content

Name	Flags	Card.	Type	Description & Constraints
Permission	TU		DomainResource	Access Rules Elements defined in Ancestors: id, meta, implicitRules, language, text, contained, extension, modifierExtension
identifier	Σ	0..*	Identifier	Business Identifier for permission
status	Σ	1..1	code	active | entered-in-error | draft | rejected Binding: Permission Status (Required)
asserter	Σ	0..1	Reference(Practitioner | PractitionerRole | Organization | CareTeam | Patient | RelatedPerson | HealthcareService)	The person or entity that asserts the permission
date	Σ	0..*	dateTime	The date that permission was asserted
validity	Σ	0..1	Period	The period in which the permission is active
justification	Σ	0..1	BackboneElement	The asserted justification for using the data
basis	Σ	0..*	CodeableConcept	The regulatory grounds upon which this Permission builds Binding: Consent PolicyRule Codes (Example)
evidence	Σ	0..*	Reference(Any)	Justifing rational
combining	?!Σ	1..1	code	deny-overrides | permit-overrides | ordered-deny-overrides | ordered-permit-overrides | deny-unless-permit | permit-unless-deny Binding: Permission Rule Combining (Required)
rule	Σ	0..*	BackboneElement	Constraints to the Permission This repeating element order: The order of the rules processing is defined in rule combining selected in .combining element.
type	?!Σ	0..1	code	deny | permit Binding: Consent Provision Type (Required)
data	Σ	0..*	BackboneElement	The selection criteria to identify data that is within scope of this provision
resource	Σ	0..*	BackboneElement	Explicit FHIR Resource references
meaning	Σ	1..1	code	instance | related | dependents | authoredby Binding: Consent Data Meaning (Required)
reference	Σ	1..1	Reference(Any)	The actual data reference
security	Σ	0..*	Coding	Security tag code on .meta.security
period	Σ	0..1	Period	Timeframe encompasing data create/update
expression	Σ	0..1	Expression	Expression identifying the data
activity	Σ	0..*	BackboneElement	A description or definition of which activities are allowed to be done on the data
actor	Σ	0..*	Reference(Device | Group | CareTeam | Organization | Patient | Practitioner | RelatedPerson | PractitionerRole)	Authorized actor(s)
action	Σ	0..*	CodeableConcept	Actions controlled by this rule Binding: Consent Action Codes (Example)
purpose	Σ	0..*	CodeableConcept	The purpose for which the permission is given Binding: PurposeOfUse (Preferred)
limit	Σ	0..*	CodeableConcept	What limits apply to the use of the data Binding: Example set of Event / Bundle used Security Labels (Example)
Documentation for this format

See the Extensions for this resource

<Permission xmlns="http://hl7.org/fhir"> 
 <!-- from Resource: id, meta, implicitRules, and language -->
 <!-- from DomainResource: text, contained, extension, and modifierExtension -->
 <identifier><!-- 0..* Identifier Business Identifier for permission --></identifier>
 <status value="[code]"/><!-- 1..1 active | entered-in-error | draft | rejected -->
 <asserter><!-- 0..1 Reference(CareTeam|HealthcareService|Organization|Patient|
   Practitioner|PractitionerRole|RelatedPerson) The person or entity that asserts the permission --></asserter>
 <date value="[dateTime]"/><!-- 0..* The date that permission was asserted -->
 <validity><!-- 0..1 Period The period in which the permission is active --></validity>
 <justification>  <!-- 0..1 The asserted justification for using the data -->
  <basis><!-- 0..* CodeableConcept The regulatory grounds upon which this Permission builds --></basis>
  <evidence><!-- 0..* Reference(Any) Justifing rational --></evidence>
 </justification>
 <combining value="[code]"/><!-- 1..1 deny-overrides | permit-overrides | ordered-deny-overrides | ordered-permit-overrides | deny-unless-permit | permit-unless-deny -->
 <rule>  <!-- 0..* Constraints to the Permission -->
  <type value="[code]"/><!-- 0..1 deny | permit -->
  <data>  <!-- 0..* The selection criteria to identify data that is within scope of this provision -->
   <resource>  <!-- 0..* Explicit FHIR Resource references -->
    <meaning value="[code]"/><!-- 1..1 instance | related | dependents | authoredby -->
    <reference><!-- 1..1 Reference(Any) The actual data reference --></reference>
   </resource>
   <security><!-- 0..* Coding Security tag code on .meta.security --></security>
   <period><!-- 0..1 Period Timeframe encompasing data create/update --></period>
   <expression><!-- 0..1 Expression Expression identifying the data --></expression>
  </data>
  <activity>  <!-- 0..* A description or definition of which activities are allowed to be done on the data -->
   <actor><!-- 0..* Reference(CareTeam|Device|Group|Organization|Patient|
     Practitioner|PractitionerRole|RelatedPerson) Authorized actor(s) --></actor>
   <action><!-- 0..* CodeableConcept Actions controlled by this rule --></action>
   <purpose><!-- 0..* CodeableConcept The purpose for which the permission is given  --></purpose>
  </activity>
  <limit><!-- 0..* CodeableConcept What limits apply to the use of the data --></limit>
 </rule>
</Permission>

{
  "resourceType" : "Permission",
  // from Resource: id, meta, implicitRules, and language
  // from DomainResource: text, contained, extension, and modifierExtension
  "identifier" : [{ Identifier }], // Business Identifier for permission
  "status" : "<code>", // R!  active | entered-in-error | draft | rejected
  "asserter" : { Reference(CareTeam|HealthcareService|Organization|Patient|
   Practitioner|PractitionerRole|RelatedPerson) }, // The person or entity that asserts the permission
  "date" : ["<dateTime>"], // The date that permission was asserted
  "validity" : { Period }, // The period in which the permission is active
  "justification" : { // The asserted justification for using the data
    "basis" : [{ CodeableConcept }], // The regulatory grounds upon which this Permission builds
    "evidence" : [{ Reference(Any) }] // Justifing rational
  },
  "combining" : "<code>", // R!  deny-overrides | permit-overrides | ordered-deny-overrides | ordered-permit-overrides | deny-unless-permit | permit-unless-deny
  "rule" : [{ // Constraints to the Permission
    "type" : "<code>", // deny | permit
    "data" : [{ // The selection criteria to identify data that is within scope of this provision
      "resource" : [{ // Explicit FHIR Resource references
        "meaning" : "<code>", // R!  instance | related | dependents | authoredby
        "reference" : { Reference(Any) } // R!  The actual data reference
      }],
      "security" : [{ Coding }], // Security tag code on .meta.security
      "period" : { Period }, // Timeframe encompasing data create/update
      "expression" : { Expression } // Expression identifying the data
    }],
    "activity" : [{ // A description or definition of which activities are allowed to be done on the data
      "actor" : [{ Reference(CareTeam|Device|Group|Organization|Patient|
     Practitioner|PractitionerRole|RelatedPerson) }], // Authorized actor(s)
      "action" : [{ CodeableConcept }], // Actions controlled by this rule
      "purpose" : [{ CodeableConcept }] // The purpose for which the permission is given 
    }],
    "limit" : [{ CodeableConcept }] // What limits apply to the use of the data
  }]
}

@prefix fhir: <http://hl7.org/fhir/> .


[ a fhir:Permission;
  fhir:nodeRole fhir:treeRoot; # if this is the parser root

  # from Resource: .id, .meta, .implicitRules, and .language
  # from DomainResource: .text, .contained, .extension, and .modifierExtension
  fhir:identifier  ( [ Identifier ] ... ) ; # 0..* Business Identifier for permission
  fhir:status [ code ] ; # 1..1 active | entered-in-error | draft | rejected
  fhir:asserter [ Reference(CareTeam|HealthcareService|Organization|Patient|Practitioner|PractitionerRole|
  RelatedPerson) ] ; # 0..1 The person or entity that asserts the permission
  fhir:date  ( [ dateTime ] ... ) ; # 0..* The date that permission was asserted
  fhir:validity [ Period ] ; # 0..1 The period in which the permission is active
  fhir:justification [ # 0..1 The asserted justification for using the data
    fhir:basis  ( [ CodeableConcept ] ... ) ; # 0..* The regulatory grounds upon which this Permission builds
    fhir:evidence  ( [ Reference(Any) ] ... ) ; # 0..* Justifing rational
  ] ;
  fhir:combining [ code ] ; # 1..1 deny-overrides | permit-overrides | ordered-deny-overrides | ordered-permit-overrides | deny-unless-permit | permit-unless-deny
  fhir:rule ( [ # 0..* Constraints to the Permission
    fhir:type [ code ] ; # 0..1 deny | permit
    fhir:data ( [ # 0..* The selection criteria to identify data that is within scope of this provision
      fhir:resource ( [ # 0..* Explicit FHIR Resource references
        fhir:meaning [ code ] ; # 1..1 instance | related | dependents | authoredby
        fhir:reference [ Reference(Any) ] ; # 1..1 The actual data reference
      ] ... ) ;
      fhir:security  ( [ Coding ] ... ) ; # 0..* Security tag code on .meta.security
      fhir:period [ Period ] ; # 0..1 Timeframe encompasing data create/update
      fhir:expression [ Expression ] ; # 0..1 Expression identifying the data
    ] ... ) ;
    fhir:activity ( [ # 0..* A description or definition of which activities are allowed to be done on the data
      fhir:actor  ( [ Reference(CareTeam|Device|Group|Organization|Patient|Practitioner|PractitionerRole|
  RelatedPerson) ] ... ) ; # 0..* Authorized actor(s)
      fhir:action  ( [ CodeableConcept ] ... ) ; # 0..* Actions controlled by this rule
      fhir:purpose  ( [ CodeableConcept ] ... ) ; # 0..* The purpose for which the permission is given
    ] ... ) ;
    fhir:limit  ( [ CodeableConcept ] ... ) ; # 0..* What limits apply to the use of the data
  ] ... ) ;
]

Changes from both R4 and R4B

This resource did not exist in Release R4

See the Full Difference for further information

This analysis is available for R4 as XML or JSON and for R4B as XML or JSON.

Name	Flags	Card.	Type	Description & Constraints
Permission	TU		DomainResource	Access Rules Elements defined in Ancestors: id, meta, implicitRules, language, text, contained, extension, modifierExtension
identifier	Σ	0..*	Identifier	Business Identifier for permission
status	Σ	1..1	code	active | entered-in-error | draft | rejected Binding: Permission Status (Required)
asserter	Σ	0..1	Reference(Practitioner | PractitionerRole | Organization | CareTeam | Patient | RelatedPerson | HealthcareService)	The person or entity that asserts the permission
date	Σ	0..*	dateTime	The date that permission was asserted
validity	Σ	0..1	Period	The period in which the permission is active
justification	Σ	0..1	BackboneElement	The asserted justification for using the data
basis	Σ	0..*	CodeableConcept	The regulatory grounds upon which this Permission builds Binding: Consent PolicyRule Codes (Example)
evidence	Σ	0..*	Reference(Any)	Justifing rational
combining	?!Σ	1..1	code	deny-overrides | permit-overrides | ordered-deny-overrides | ordered-permit-overrides | deny-unless-permit | permit-unless-deny Binding: Permission Rule Combining (Required)
rule	Σ	0..*	BackboneElement	Constraints to the Permission This repeating element order: The order of the rules processing is defined in rule combining selected in .combining element.
type	?!Σ	0..1	code	deny | permit Binding: Consent Provision Type (Required)
data	Σ	0..*	BackboneElement	The selection criteria to identify data that is within scope of this provision
resource	Σ	0..*	BackboneElement	Explicit FHIR Resource references
meaning	Σ	1..1	code	instance | related | dependents | authoredby Binding: Consent Data Meaning (Required)
reference	Σ	1..1	Reference(Any)	The actual data reference
security	Σ	0..*	Coding	Security tag code on .meta.security
period	Σ	0..1	Period	Timeframe encompasing data create/update
expression	Σ	0..1	Expression	Expression identifying the data
activity	Σ	0..*	BackboneElement	A description or definition of which activities are allowed to be done on the data
actor	Σ	0..*	Reference(Device | Group | CareTeam | Organization | Patient | Practitioner | RelatedPerson | PractitionerRole)	Authorized actor(s)
action	Σ	0..*	CodeableConcept	Actions controlled by this rule Binding: Consent Action Codes (Example)
purpose	Σ	0..*	CodeableConcept	The purpose for which the permission is given Binding: PurposeOfUse (Preferred)
limit	Σ	0..*	CodeableConcept	What limits apply to the use of the data Binding: Example set of Event / Bundle used Security Labels (Example)
Documentation for this format

See the Extensions for this resource

<Permission xmlns="http://hl7.org/fhir"> 
 <!-- from Resource: id, meta, implicitRules, and language -->
 <!-- from DomainResource: text, contained, extension, and modifierExtension -->
 <identifier><!-- 0..* Identifier Business Identifier for permission --></identifier>
 <status value="[code]"/><!-- 1..1 active | entered-in-error | draft | rejected -->
 <asserter><!-- 0..1 Reference(CareTeam|HealthcareService|Organization|Patient|
   Practitioner|PractitionerRole|RelatedPerson) The person or entity that asserts the permission --></asserter>
 <date value="[dateTime]"/><!-- 0..* The date that permission was asserted -->
 <validity><!-- 0..1 Period The period in which the permission is active --></validity>
 <justification>  <!-- 0..1 The asserted justification for using the data -->
  <basis><!-- 0..* CodeableConcept The regulatory grounds upon which this Permission builds --></basis>
  <evidence><!-- 0..* Reference(Any) Justifing rational --></evidence>
 </justification>
 <combining value="[code]"/><!-- 1..1 deny-overrides | permit-overrides | ordered-deny-overrides | ordered-permit-overrides | deny-unless-permit | permit-unless-deny -->
 <rule>  <!-- 0..* Constraints to the Permission -->
  <type value="[code]"/><!-- 0..1 deny | permit -->
  <data>  <!-- 0..* The selection criteria to identify data that is within scope of this provision -->
   <resource>  <!-- 0..* Explicit FHIR Resource references -->
    <meaning value="[code]"/><!-- 1..1 instance | related | dependents | authoredby -->
    <reference><!-- 1..1 Reference(Any) The actual data reference --></reference>
   </resource>
   <security><!-- 0..* Coding Security tag code on .meta.security --></security>
   <period><!-- 0..1 Period Timeframe encompasing data create/update --></period>
   <expression><!-- 0..1 Expression Expression identifying the data --></expression>
  </data>
  <activity>  <!-- 0..* A description or definition of which activities are allowed to be done on the data -->
   <actor><!-- 0..* Reference(CareTeam|Device|Group|Organization|Patient|
     Practitioner|PractitionerRole|RelatedPerson) Authorized actor(s) --></actor>
   <action><!-- 0..* CodeableConcept Actions controlled by this rule --></action>
   <purpose><!-- 0..* CodeableConcept The purpose for which the permission is given  --></purpose>
  </activity>
  <limit><!-- 0..* CodeableConcept What limits apply to the use of the data --></limit>
 </rule>
</Permission>

{
  "resourceType" : "Permission",
  // from Resource: id, meta, implicitRules, and language
  // from DomainResource: text, contained, extension, and modifierExtension
  "identifier" : [{ Identifier }], // Business Identifier for permission
  "status" : "<code>", // R!  active | entered-in-error | draft | rejected
  "asserter" : { Reference(CareTeam|HealthcareService|Organization|Patient|
   Practitioner|PractitionerRole|RelatedPerson) }, // The person or entity that asserts the permission
  "date" : ["<dateTime>"], // The date that permission was asserted
  "validity" : { Period }, // The period in which the permission is active
  "justification" : { // The asserted justification for using the data
    "basis" : [{ CodeableConcept }], // The regulatory grounds upon which this Permission builds
    "evidence" : [{ Reference(Any) }] // Justifing rational
  },
  "combining" : "<code>", // R!  deny-overrides | permit-overrides | ordered-deny-overrides | ordered-permit-overrides | deny-unless-permit | permit-unless-deny
  "rule" : [{ // Constraints to the Permission
    "type" : "<code>", // deny | permit
    "data" : [{ // The selection criteria to identify data that is within scope of this provision
      "resource" : [{ // Explicit FHIR Resource references
        "meaning" : "<code>", // R!  instance | related | dependents | authoredby
        "reference" : { Reference(Any) } // R!  The actual data reference
      }],
      "security" : [{ Coding }], // Security tag code on .meta.security
      "period" : { Period }, // Timeframe encompasing data create/update
      "expression" : { Expression } // Expression identifying the data
    }],
    "activity" : [{ // A description or definition of which activities are allowed to be done on the data
      "actor" : [{ Reference(CareTeam|Device|Group|Organization|Patient|
     Practitioner|PractitionerRole|RelatedPerson) }], // Authorized actor(s)
      "action" : [{ CodeableConcept }], // Actions controlled by this rule
      "purpose" : [{ CodeableConcept }] // The purpose for which the permission is given 
    }],
    "limit" : [{ CodeableConcept }] // What limits apply to the use of the data
  }]
}

@prefix fhir: <http://hl7.org/fhir/> .


[ a fhir:Permission;
  fhir:nodeRole fhir:treeRoot; # if this is the parser root

  # from Resource: .id, .meta, .implicitRules, and .language
  # from DomainResource: .text, .contained, .extension, and .modifierExtension
  fhir:identifier  ( [ Identifier ] ... ) ; # 0..* Business Identifier for permission
  fhir:status [ code ] ; # 1..1 active | entered-in-error | draft | rejected
  fhir:asserter [ Reference(CareTeam|HealthcareService|Organization|Patient|Practitioner|PractitionerRole|
  RelatedPerson) ] ; # 0..1 The person or entity that asserts the permission
  fhir:date  ( [ dateTime ] ... ) ; # 0..* The date that permission was asserted
  fhir:validity [ Period ] ; # 0..1 The period in which the permission is active
  fhir:justification [ # 0..1 The asserted justification for using the data
    fhir:basis  ( [ CodeableConcept ] ... ) ; # 0..* The regulatory grounds upon which this Permission builds
    fhir:evidence  ( [ Reference(Any) ] ... ) ; # 0..* Justifing rational
  ] ;
  fhir:combining [ code ] ; # 1..1 deny-overrides | permit-overrides | ordered-deny-overrides | ordered-permit-overrides | deny-unless-permit | permit-unless-deny
  fhir:rule ( [ # 0..* Constraints to the Permission
    fhir:type [ code ] ; # 0..1 deny | permit
    fhir:data ( [ # 0..* The selection criteria to identify data that is within scope of this provision
      fhir:resource ( [ # 0..* Explicit FHIR Resource references
        fhir:meaning [ code ] ; # 1..1 instance | related | dependents | authoredby
        fhir:reference [ Reference(Any) ] ; # 1..1 The actual data reference
      ] ... ) ;
      fhir:security  ( [ Coding ] ... ) ; # 0..* Security tag code on .meta.security
      fhir:period [ Period ] ; # 0..1 Timeframe encompasing data create/update
      fhir:expression [ Expression ] ; # 0..1 Expression identifying the data
    ] ... ) ;
    fhir:activity ( [ # 0..* A description or definition of which activities are allowed to be done on the data
      fhir:actor  ( [ Reference(CareTeam|Device|Group|Organization|Patient|Practitioner|PractitionerRole|
  RelatedPerson) ] ... ) ; # 0..* Authorized actor(s)
      fhir:action  ( [ CodeableConcept ] ... ) ; # 0..* Actions controlled by this rule
      fhir:purpose  ( [ CodeableConcept ] ... ) ; # 0..* The purpose for which the permission is given
    ] ... ) ;
    fhir:limit  ( [ CodeableConcept ] ... ) ; # 0..* What limits apply to the use of the data
  ] ... ) ;
]

Changes from both R4 and R4B

This resource did not exist in Release R4

See the Full Difference for further information

This analysis is available for R4 as XML or JSON and for R4B as XML or JSON.