R5-v3-SecurityPolicy-for-R4
type: ValueSet
node role: treeRoot
id:
  v: R5-v3-SecurityPolicy-for-R4
text:
  status:
    v: generated
  div: Generated Narrative: ValueSet R5-v3-SecurityPolicy-for-R4 This value set expansion contains 74 concepts. Code System Display Definition SecurityPolicy http://terminology.hl7.org/CodeSystem/v3-ActCode security policy Types of security policies that further specify the ActClassPolicy value set. Examples: obligation to encrypt refrain from redisclosure without consent AUTHPOL http://terminology.hl7.org/CodeSystem/v3-ActCode authorization policy Authorisation policies are essentially security policies related to access-control and specify what activities a subject is permitted or forbidden to do, to a set of target objects. They are designed to protect target objects so are interpreted by access control agents or the run-time systems at the target system. A positive authorisation policy defines the actions that a subject is permitted to perform on a target. A negative authorisation policy specifies the actions that a subject is forbidden to perform on a target. Positive authorisation policies may also include filters to transform the parameters associated with their actions. (Based on PONDERS) ACCESSCONSCHEME http://terminology.hl7.org/CodeSystem/v3-ActCode access control scheme An access control policy specific to the type of access control scheme, which is used to enforce one or more authorization policies. Usage Note: Access control schemes are the type of access control policy, which is comprised of access control policy rules concerning the provision of the access control service. There are two categories of access control policies, rule-based and identity-based, which are identified in CCITT Rec. X.800 aka ISO 7498-2. Rule-based access control policies are intended to apply to all access requests by any initiator on any target in a security domain. Identity-based access control policies are based on rules specific to an individual initiator, a group of initiators, entities acting on behalf of initiators, or originators acting in a specific role. Context can modify…
extension:
  url:
    v: http://hl7.org/fhir/StructureDefinition/structuredefinition-wg
  value: code
    v: fhir
extension:
  extension:
    url:
      v: packageId
    value: id
      v: hl7.fhir.uv.xver-r5.r4
  extension:
    url:
      v: version
    value: string
      v: 0.0.1-snapshot-2
  url:
    v: http://hl7.org/fhir/StructureDefinition/package-source
extension:
  url:
    v: http://hl7.org/fhir/StructureDefinition/structuredefinition-fmm
  value: integer
    v: 0
    extension:
      url:
        v: http://hl7.org/fhir/StructureDefinition/structuredefinition-conformance-derivedFrom
      value: canonical
        v: http://hl7.org/fhir/5.0/ImplementationGuide/hl7.fhir.uv.xver-r5.r4
        link: http://hl7.org/fhir/5.0/ImplementationGuide/hl7.fhir.uv.xver-r5.r4
extension:
  url:
    v: http://hl7.org/fhir/StructureDefinition/structuredefinition-standards-status
  value: code
    v: trial-use
    extension:
      url:
        v: http://hl7.org/fhir/StructureDefinition/structuredefinition-conformance-derivedFrom
      value: canonical
        v: http://hl7.org/fhir/5.0/ImplementationGuide/hl7.fhir.uv.xver-r5.r4
        link: http://hl7.org/fhir/5.0/ImplementationGuide/hl7.fhir.uv.xver-r5.r4
url:
  v: http://hl7.org/fhir/5.0/ValueSet/R5-v3-SecurityPolicy-for-R4
version:
  v: 0.0.1-snapshot-2
name:
  v: R5_v3_SecurityPolicy_for_R4
title:
  v: Cross-version VS for R5.SecurityPolicy for use in FHIR R4
status:
  v: active
experimental:
  v: false
date:
  v: 2025-09-01T22:37:05.397914+10:00
publisher:
  v: FHIR Infrastructure
contact:
  name:
    v: FHIR Infrastructure
  telecom:
    system:
      v: url
    value:
      v: http://www.hl7.org/Special/committees/fiwg
description:
  v: This cross-version ValueSet represents concepts from http://terminology.hl7.org/ValueSet/v3-SecurityPolicy|2.0.0 for use in FHIR R4. Concepts not present here have direct `equivalent` mappings crossing all versions from R5 to R4.
jurisdiction:
  coding:
    system:
      v: http://unstats.un.org/unsd/methods/m49/m49.htm
    code:
      v: 001
    display:
      v: World
compose:
  include:
    system:
      v: http://terminology.hl7.org/CodeSystem/v3-ActCode
    version:
      v: 8.0.0
    concept:
      code:
        v: SecurityPolicy
      display:
        v: security policy
    concept:
      code:
        v: AUTHPOL
      display:
        v: authorization policy
    concept:
      code:
        v: ACCESSCONSCHEME
      display:
        v: access control scheme
    concept:
      code:
        v: DELEPOL
      display:
        v: delegation policy
    concept:
      code:
        v: ObligationPolicy
      display:
        v: obligation policy
    concept:
      code:
        v: ANONY
      display:
        v: anonymize
    concept:
      code:
        v: AOD
      display:
        v: accounting of disclosure
    concept:
      code:
        v: AUDIT
      display:
        v: audit
    concept:
      code:
        v: AUDTR
      display:
        v: audit trail
    concept:
      code:
        v: CPLYPOL
      display:
        v: comply with policy
    concept:
      code:
        v: CPLYCC
      display:
        v: comply with confidentiality code
    concept:
      code:
        v: CPLYCD
      display:
        v: comply with consent directive
    concept:
      code:
        v: CPLYCUI
      display:
        v: comply with controlled unclassified information policy
    concept:
      code:
        v: CPLYJPP
      display:
        v: comply with jurisdictional privacy policy
    concept:
      code:
        v: CPLYJSP
      display:
        v: comply with jurisdictional security policy
    concept:
      code:
        v: CPLYOPP
      display:
        v: comply with organizational privacy policy
    concept:
      code:
        v: CPLYOSP
      display:
        v: comply with organizational security policy
    concept:
      code:
        v: DECLASSIFYLABEL
      display:
        v: declassify security label
    concept:
      code:
        v: DEID
      display:
        v: deidentify
    concept:
      code:
        v: DELAU
      display:
        v: delete after use
    concept:
      code:
        v: DOWNGRDLABEL
      display:
        v: downgrade security label
    concept:
      code:
        v: DRIVLABEL
      display:
        v: derive security label
    concept:
      code:
        v: ENCRYPT
      display:
        v: encrypt

code:
  v: ENCRYPTR
display:
  v: encrypt at rest

code:
  v: ENCRYPTT
display:
  v: encrypt in transit

code:
  v: ENCRYPTU
display:
  v: encrypt in use

code:
  v: HUAPRV
display:
  v: human approval

code:
  v: LABEL
display:
  v: assign security label

code:
  v: MASK
display:
  v: mask

code:
  v: MINEC
display:
  v: minimum necessary

code:
  v: PERSISTLABEL
display:
  v: persist security label

code:
  v: PRIVMARK
display:
  v: privacy mark

code:
  v: CUIMark
display:
  v: CUI Mark

code:
  v: PSEUD
display:
  v: pseudonymize

code:
  v: REDACT
display:
  v: redact

code:
  v: UPGRDLABEL
display:
  v: upgrade security label

code:
  v: PROCESSINLINELABEL
display:
  v: process inline security label

code:
  v: CONTROLLED
display:
  v: CONTROLLED

code:
  v: CUI
display:
  v: CUI

code:
  v: CUIHLTH
display:
  v: CUI//HLTH

code:
  v: CUIHLTHP
display:
  v: (CUI//HLTH)

code:
  v: CUIP
display:
  v: (CUI)

code:
  v: CUIPRVCY
display:
  v: CUI//PRVCY

code:
  v: CUIPRVCYP
display:
  v: (CUI//PRVCY)

code:
  v: CUISP-HLTH
display:
  v: CUI//SP-HLTH

code:
  v: CUISP-HLTHP
display:
  v: (CUI//SP-HLTH)

code:
  v: CUISP-PRVCY
display:
  v: CUI//SP-PRVCY

code:
  v: CUISP-PRVCYP
display:
  v: (CUI//SP-PRVCY)

code:
  v: UUI
display:
  v: (U)

code:
  v: ConfidentialMark
display:
  v: confidential mark

code:
  v: COPYMark
display:
  v: copy of original mark

code:
  v: DeliverToAddresseeOnlyMark
display:
  v: deliver only to addressee mark

code:
  v: RedisclosureProhibitionMark
display:
  v: prohibition against redisclosure mark

code:
  v: RestrictedConfidentialityMark
display:
  v: restricted confidentiality mark

code:
  v: DRAFTMark
display:
  v: Draft Mark

code:
  v: RefrainPolicy
display:
  v: refrain policy

code:
  v: NOAUTH
display:
  v: no disclosure without subject authorization

code:
  v: NOCOLLECT
display:
  v: no collection

code:
  v: NODSCLCD
display:
  v: no disclosure without consent directive

code:
  v: NODSCLCDS
display:
  v: no disclosure without information subject's consent directive

code:
  v: NOINTEGRATE
display:
  v: no integration

code:
  v: NOLIST
display:
  v: no unlisted entity disclosure

code:
  v: NOMOU
display:
  v: no disclosure without MOU

code:
  v: NOORGPOL
display:
  v: no disclosure without organizational authorization

code:
  v: NOPAT
display:
  v: no disclosure to patient, family or caregivers without attending provider's authorization

code:
  v: NOPERSISTP
display:
  v: no collection beyond purpose of use

code:
  v: NORDSCLCD
display:
  v: no redisclosure without consent directive

code:
  v: NORDSLCD
display:
  v: no redisclosure without consent directive

code:
  v: NORDSCLCDS
display:
  v: no redisclosure without information subject's consent directive

code:
  v: NORDSCLW
display:
  v: no disclosure without jurisdictional authorization

code:
  v: NORELINK
display:
  v: no relinking

code:
  v: NOREUSE
display:
  v: no reuse beyond purpose of use

code:
  v: NOVIP
display:
  v: no unauthorized VIP disclosure

code:
  v: ORCON
display:
  v: no disclosure without originator authorization

timestamp:
  v: 2025-09-01T22:37:05.397895+10:00
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: SecurityPolicy
  display:
    v: security policy
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: AUTHPOL
  display:
    v: authorization policy
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: ACCESSCONSCHEME
  display:
    v: access control scheme
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: DELEPOL
  display:
    v: delegation policy
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: ObligationPolicy
  display:
    v: obligation policy
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: ANONY
  display:
    v: anonymize
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: AOD
  display:
    v: accounting of disclosure
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: AUDIT
  display:
    v: audit
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: AUDTR
  display:
    v: audit trail
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: CPLYPOL
  display:
    v: comply with policy
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: CPLYCC
  display:
    v: comply with confidentiality code
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: CPLYCD
  display:
    v: comply with consent directive
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: CPLYCUI
  display:
    v: comply with controlled unclassified information policy
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: CPLYJPP
  display:
    v: comply with jurisdictional privacy policy
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: CPLYJSP
  display:
    v: comply with jurisdictional security policy
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: CPLYOPP
  display:
    v: comply with organizational privacy policy
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: CPLYOSP
  display:
    v: comply with organizational security policy
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: DECLASSIFYLABEL
  display:
    v: declassify security label
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: DEID
  display:
    v: deidentify
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: DELAU
  display:
    v: delete after use
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: DOWNGRDLABEL
  display:
    v: downgrade security label
contains:
  system:
    v: http://terminology.hl7.org/CodeSystem/v3-ActCode
  version:
    v: 8.0.0
  code:
    v: DRIVLABEL
  display:
    v: derive security label

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: ENCRYPT
display:
  v: encrypt

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: ENCRYPTR
display:
  v: encrypt at rest

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: ENCRYPTT
display:
  v: encrypt in transit

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: ENCRYPTU
display:
  v: encrypt in use

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: HUAPRV
display:
  v: human approval

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: LABEL
display:
  v: assign security label

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: MASK
display:
  v: mask

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: MINEC
display:
  v: minimum necessary

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: PERSISTLABEL
display:
  v: persist security label

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: PRIVMARK
display:
  v: privacy mark

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: CUIMark
display:
  v: CUI Mark

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: PSEUD
display:
  v: pseudonymize

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: REDACT
display:
  v: redact

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: UPGRDLABEL
display:
  v: upgrade security label

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: PROCESSINLINELABEL
display:
  v: process inline security label

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: CONTROLLED
display:
  v: CONTROLLED

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: CUI
display:
  v: CUI

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: CUIHLTH
display:
  v: CUI//HLTH

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: CUIHLTHP
display:
  v: (CUI//HLTH)

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: CUIP
display:
  v: (CUI)

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: CUIPRVCY
display:
  v: CUI//PRVCY

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: CUIPRVCYP
display:
  v: (CUI//PRVCY)

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: CUISP-HLTH
display:
  v: CUI//SP-HLTH

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: CUISP-HLTHP
display:
  v: (CUI//SP-HLTH)

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: CUISP-PRVCY
display:
  v: CUI//SP-PRVCY

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: CUISP-PRVCYP
display:
  v: (CUI//SP-PRVCY)

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: UUI
display:
  v: (U)

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: ConfidentialMark
display:
  v: confidential mark

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: COPYMark
display:
  v: copy of original mark

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: DeliverToAddresseeOnlyMark
display:
  v: deliver only to addressee mark

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: RedisclosureProhibitionMark
display:
  v: prohibition against redisclosure mark

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: RestrictedConfidentialityMark
display:
  v: restricted confidentiality mark

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: DRAFTMark
display:
  v: Draft Mark

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: RefrainPolicy
display:
  v: refrain policy

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: NOAUTH
display:
  v: no disclosure without subject authorization

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: NOCOLLECT
display:
  v: no collection

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: NODSCLCD
display:
  v: no disclosure without consent directive

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: NODSCLCDS
display:
  v: no disclosure without information subject's consent directive

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: NOINTEGRATE
display:
  v: no integration

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: NOLIST
display:
  v: no unlisted entity disclosure

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: NOMOU
display:
  v: no disclosure without MOU

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: NOORGPOL
display:
  v: no disclosure without organizational authorization

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: NOPAT
display:
  v: no disclosure to patient, family or caregivers without attending provider's authorization

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: NOPERSISTP
display:
  v: no collection beyond purpose of use

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: NORDSCLCD
display:
  v: no redisclosure without consent directive

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: NORDSLCD
display:
  v: no redisclosure without consent directive

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: NORDSCLCDS
display:
  v: no redisclosure without information subject's consent directive

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: NORDSCLW
display:
  v: no disclosure without jurisdictional authorization

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: NORELINK
display:
  v: no relinking

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: NOREUSE
display:
  v: no reuse beyond purpose of use

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: NOVIP
display:
  v: no unauthorized VIP disclosure

system:
  v: http://terminology.hl7.org/CodeSystem/v3-ActCode
version:
  v: 8.0.0
code:
  v: ORCON
display:
  v: no disclosure without originator authorization