Validated Healthcare Directory IG STU1 Draft for Comment

This page is part of the Validated Healthcare Directory FHIR IG (v0.1.0: STU 1 Draft) based on FHIR v3.2.0. . For a full list of available versions, see the Directory of published versions

1.0 - StructureDefinition: vhdir-restriction - Content

Background and Context

The FHIR specification contains a security meta tag which can be used to inform systems of the sensitivity of resources. The tag can be used by access control mechanisms to ensure content isn’t exposed inappropriately. However, the security meta tag can only indicate sensitivity at the resource level, and provides relatively little context about the restriction. We propose a new mechanism, usage-restriction, that extends the concept of restriction further into an individual resource, while providing additional information about the restriction itself.

Useage-restriction can be applied to a resource, element, or combination thereof. If applied to a resource/element, the restriction is understood to apply to all of the properties of that resource/element, unless otherwise specified (e.g. if applied to an identifier on a practitioner, then all of the properties of that identifier are restricted)

It consists of:

  • usage-restriction.target - indicates the resource(s), element(s), or combination thereof that the restriction applies to
  • usage-restriction.type - indicates the type of restriction (e.g. based on an item in a data use agreement)
  • usage-restriction.policy - indicates the policy defining the restriction
  • usage-restriction.status - indicates the status of the restriction (i.e. whether it is active)
  • usage-restriction.lastUpdated - indicates when the restriction was last updated
  • usage-restriction.retrospective - indicates whether the restriction is retrospective
  • usage-restriction.reason - indicates why the target is restricted
    • usage-restriction.reason.name - indicates the name of the restriction condition
    • usage-restriction.conditionalSource - Indicates whether information from another source is necessary to determine if something is restricted
    • usage-restriction.reasonType - indicates the type of restriction
  • usage-restriction.accessRights - defines a group/class of individuals/orgs to which the target is not restricted

Usage-restriction is expected to be used as a modifier extension.

Expected Implementations

1.2 - Formal Views of Profile Content

The official URL for this profile is: 

http://hl7.org/fhir/ig/vhdir/StructureDefinition/vhdir-restriction

Restriction on use/release of exchanged information

This profile builds on Consent.

This profile was published on Fri Dec 15 01:01:31 AEDT 2017 as a draft by null.

Description of Profiles, Differentials, Snapshots, and how the XML and JSON presentations work.

Summary of the Mandatory Requirements and Key properties

  1. At least one target in restriction.target
  2. If indicating the reason for restriction:
  3. One name of the restriction in restriction.reason.name
  4. One conditional source in restriction.reason.conditionalSource
  5. At least one type of reason in restriction.reason.reasonType
NameFlagsCard.TypeDescription & Constraintsdoco
.. Consent 0..*A policy may permit or deny recipients or roles to perform actions for specific purposes and periods of time
... identifier 0..0
... status S1..1codeIndicates the current state of this restriction
... scope S1..1codeFixed Value: privacy
... category S1..*CodeableConceptType of restriction
... patient 1..1Reference(Patient)As the consent is not applicable in the Restriction, this should have a null flavour applied to it
.... reference 0..0
.... identifier 0..0
... dateTime S0..1dateTimedate/time of last update for this restriction
... consentingParty 0..0
... organization 0..0
... source[x] 0..0
... policy S0..*BackboneElement
.... authority 0..0
.... uri S0..1uriSpecific policy covered by this restriction
... policyRule 0..0
... verification 0..0
... provision S1..1BackboneElementAccess rights
.... type S0..1codeFixed Value: permit
.... period 0..0
.... actor S1..*BackboneElement
..... role S1..1CodeableConceptFixed Value: {"system":"http://hl7.org/fhir/v3/ParticipationType","code":"IRCP"} (information recipient)
..... reference S1..1Reference(Organization), Reference(CareTeam), Reference(Practitioner), Reference(Group)definedUserOrGroup
.... action S0..1CodeableConceptreasonType
.... securityLabel S0..*CodinguserType
.... purpose S0..*CodingreasonName
.... class 0..0
.... code 0..0
.... dataPeriod 0..0
.... data 0..0
.... provision 0..0

doco Documentation for this format
NameFlagsCard.TypeDescription & Constraintsdoco
.. Consent I0..*A policy may permit or deny recipients or roles to perform actions for specific purposes and periods of time
... id Σ0..1idLogical id of this artifact
... meta Σ0..1MetaMetadata about the resource
... implicitRules ?!Σ0..1uriA set of rules under which this content was created
... language 0..1codeLanguage of the resource content
Binding: Common Languages (extensible)
... text I0..1NarrativeText summary of the resource, for human interpretation
... contained 0..*ResourceContained, inline Resources
... extension 0..*ExtensionAdditional Content defined by implementations
... modifierExtension ?!0..*ExtensionExtensions that cannot be ignored
... status ?!SΣ1..1codeIndicates the current state of this restriction
Binding: ConsentState (required)
... scope ?!SΣ1..1codeWhich of the four areas this resource covers
Binding: Consent Scope Codes (required)
Fixed Value: privacy
... category SΣ1..*CodeableConceptType of restriction
Binding: Consent Category Codes (example)
... patient Σ1..1Reference(Patient)As the consent is not applicable in the Restriction, this should have a null flavour applied to it
.... id 0..1stringxml:id (or equivalent in JSON)
.... display Σ0..1stringText alternative for the resource
... dateTime SΣ0..1dateTimedate/time of last update for this restriction
... policy SI0..*BackboneElementPolicies covered by this consent
.... id 0..1stringxml:id (or equivalent in JSON)
.... extension 0..*ExtensionAdditional Content defined by implementations
.... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored
.... uri SI0..1uriSpecific policy covered by this restriction
... provision SΣI1..1BackboneElementAccess rights
.... id 0..1stringxml:id (or equivalent in JSON)
.... extension 0..*ExtensionAdditional Content defined by implementations
.... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored
.... type SΣ0..1codedeny | permit
Binding: ConsentProvisionType (required)
Fixed Value: permit
.... actor SI1..*BackboneElementWho|what controlled by this rule (or group, by role)
..... id 0..1stringxml:id (or equivalent in JSON)
..... extension 0..*ExtensionAdditional Content defined by implementations
..... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored
..... role S1..1CodeableConceptHow the actor is involved
Binding: SecurityRoleType (extensible)
Fixed Value: {"system":"http://hl7.org/fhir/v3/ParticipationType","code":"IRCP"} (information recipient)
..... reference S1..1Reference(Organization), Reference(CareTeam), Reference(Practitioner), Reference(Group)definedUserOrGroup
.... action SΣ0..1CodeableConceptreasonType
Binding: Consent Action Codes (example)
.... securityLabel SΣ0..*CodinguserType
Binding: All Security Labels (extensible)
.... purpose SΣ0..*CodingreasonName
Binding: PurposeOfUse (extensible)

doco Documentation for this format

Summary of the Mandatory Requirements and Key properties

  1. At least one target in restriction.target
  2. If indicating the reason for restriction:
  3. One name of the restriction in restriction.reason.name
  4. One conditional source in restriction.reason.conditionalSource
  5. At least one type of reason in restriction.reason.reasonType

Differential View

NameFlagsCard.TypeDescription & Constraintsdoco
.. Consent 0..*A policy may permit or deny recipients or roles to perform actions for specific purposes and periods of time
... identifier 0..0
... status S1..1codeIndicates the current state of this restriction
... scope S1..1codeFixed Value: privacy
... category S1..*CodeableConceptType of restriction
... patient 1..1Reference(Patient)As the consent is not applicable in the Restriction, this should have a null flavour applied to it
.... reference 0..0
.... identifier 0..0
... dateTime S0..1dateTimedate/time of last update for this restriction
... consentingParty 0..0
... organization 0..0
... source[x] 0..0
... policy S0..*BackboneElement
.... authority 0..0
.... uri S0..1uriSpecific policy covered by this restriction
... policyRule 0..0
... verification 0..0
... provision S1..1BackboneElementAccess rights
.... type S0..1codeFixed Value: permit
.... period 0..0
.... actor S1..*BackboneElement
..... role S1..1CodeableConceptFixed Value: {"system":"http://hl7.org/fhir/v3/ParticipationType","code":"IRCP"} (information recipient)
..... reference S1..1Reference(Organization), Reference(CareTeam), Reference(Practitioner), Reference(Group)definedUserOrGroup
.... action S0..1CodeableConceptreasonType
.... securityLabel S0..*CodinguserType
.... purpose S0..*CodingreasonName
.... class 0..0
.... code 0..0
.... dataPeriod 0..0
.... data 0..0
.... provision 0..0

doco Documentation for this format

Snapshot View

NameFlagsCard.TypeDescription & Constraintsdoco
.. Consent I0..*A policy may permit or deny recipients or roles to perform actions for specific purposes and periods of time
... id Σ0..1idLogical id of this artifact
... meta Σ0..1MetaMetadata about the resource
... implicitRules ?!Σ0..1uriA set of rules under which this content was created
... language 0..1codeLanguage of the resource content
Binding: Common Languages (extensible)
... text I0..1NarrativeText summary of the resource, for human interpretation
... contained 0..*ResourceContained, inline Resources
... extension 0..*ExtensionAdditional Content defined by implementations
... modifierExtension ?!0..*ExtensionExtensions that cannot be ignored
... status ?!SΣ1..1codeIndicates the current state of this restriction
Binding: ConsentState (required)
... scope ?!SΣ1..1codeWhich of the four areas this resource covers
Binding: Consent Scope Codes (required)
Fixed Value: privacy
... category SΣ1..*CodeableConceptType of restriction
Binding: Consent Category Codes (example)
... patient Σ1..1Reference(Patient)As the consent is not applicable in the Restriction, this should have a null flavour applied to it
.... id 0..1stringxml:id (or equivalent in JSON)
.... display Σ0..1stringText alternative for the resource
... dateTime SΣ0..1dateTimedate/time of last update for this restriction
... policy SI0..*BackboneElementPolicies covered by this consent
.... id 0..1stringxml:id (or equivalent in JSON)
.... extension 0..*ExtensionAdditional Content defined by implementations
.... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored
.... uri SI0..1uriSpecific policy covered by this restriction
... provision SΣI1..1BackboneElementAccess rights
.... id 0..1stringxml:id (or equivalent in JSON)
.... extension 0..*ExtensionAdditional Content defined by implementations
.... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored
.... type SΣ0..1codedeny | permit
Binding: ConsentProvisionType (required)
Fixed Value: permit
.... actor SI1..*BackboneElementWho|what controlled by this rule (or group, by role)
..... id 0..1stringxml:id (or equivalent in JSON)
..... extension 0..*ExtensionAdditional Content defined by implementations
..... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored
..... role S1..1CodeableConceptHow the actor is involved
Binding: SecurityRoleType (extensible)
Fixed Value: {"system":"http://hl7.org/fhir/v3/ParticipationType","code":"IRCP"} (information recipient)
..... reference S1..1Reference(Organization), Reference(CareTeam), Reference(Practitioner), Reference(Group)definedUserOrGroup
.... action SΣ0..1CodeableConceptreasonType
Binding: Consent Action Codes (example)
.... securityLabel SΣ0..*CodinguserType
Binding: All Security Labels (extensible)
.... purpose SΣ0..*CodingreasonName
Binding: PurposeOfUse (extensible)

doco Documentation for this format

Downloads: StructureDefinition: (XML, JSON, CSV), Schema: XML Schematron

 

1.3 - Quick Start

Below is an overview of the required search and read operations for this profile. See the Conformance requirements for the US Core Server for a complete list of supported RESTful operations and search parameters for this IG.