HL7 FHIR Implementation Guide: Data Access Policies
1.0.0-current - International flag

HL7 FHIR Implementation Guide: Data Access Policies, published by HL7 International / Security. This guide is not an authorized publication; it is the continuous build for version 1.0.0-current built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/data-access-policies/ and changes regularly. See the Directory of published versions

Example Permission:

Language: en

Security Label: test health data (Details: ActReason code HTEST = 'test health data')

status: Active

asserter: Organization nowhere

date: 2023-12-22

combining: Permit-overrides

rule

type: Deny

rule

type: Permit

data

resourceType: All FHIR Types: Observation (Observation)

data

resourceType: All FHIR Types: AllergyIntolerance (AllergyIntolerance)

data

resourceType: All FHIR Types: Condition (Condition)

activity

Actors

-Reference
*PractitionerRole Doctor

action: create, read, update

purpose: treatment

Limits

-Control
*audit

rule

type: Permit

data

resourceType: All FHIR Types: Practitioner (Practitioner)

data

resourceType: All FHIR Types: PractitionerRole (PractitionerRole)

data

resourceType: All FHIR Types: Person (Person)

data

resourceType: All FHIR Types: Patient (Patient)

data

resourceType: All FHIR Types: RelatedPerson (RelatedPerson)

data

resourceType: All FHIR Types: Organization (Organization)

data

resourceType: All FHIR Types: Location (Location)

activity

Actors

-Reference
*PractitionerRole Doctor

action: read

purpose: treatment

Limits

-Control
*audit

rule

type: Permit

data

resourceType: All FHIR Types: AllergyIntolerance (AllergyIntolerance)

data

resourceType: All FHIR Types: Condition (Condition)

data

resourceType: All FHIR Types: Practitioner (Practitioner)

data

resourceType: All FHIR Types: PractitionerRole (PractitionerRole)

data

resourceType: All FHIR Types: Person (Person)

data

resourceType: All FHIR Types: Patient (Patient)

data

resourceType: All FHIR Types: RelatedPerson (RelatedPerson)

data

resourceType: All FHIR Types: Organization (Organization)

data

resourceType: All FHIR Types: Location (Location)

activity

Actors

-Reference
*PractitionerRole Dietician

action: read

purpose: treatment, healthcare operations

Limits

-Control
*audit

rule

type: Permit

data

resourceType: All FHIR Types: Person (Person)

data

resourceType: All FHIR Types: Patient (Patient)

data

resourceType: All FHIR Types: RelatedPerson (RelatedPerson)

activity

Actors

-Reference
*PractitionerRole Registration Clerk

action: create, read, update

purpose: healthcare operations

Limits

-Control
*audit

rule

type: Permit

data

resourceType: All FHIR Types: Practitioner (Practitioner)

data

resourceType: All FHIR Types: PractitionerRole (PractitionerRole)

data

resourceType: All FHIR Types: Organization (Organization)

data

resourceType: All FHIR Types: Location (Location)

activity

Actors

-Reference
*PractitionerRole Registration Clerk

action: read

purpose: healthcare operations

Limits

-Control
*audit

rule

type: Permit

activity

Actors

-Reference
*PractitionerRole Administration

action: delete, update

purpose: healthcare operations

Limits

-Control
*audit