V3-Confidentiality.xml

A set of codes specifying the security classification of acts and roles in accordance with the definition for concept domain "Confidentiality".

Raw XML

<ValueSet xmlns="http://hl7.org/fhir">
  <id value="v3-Confidentiality"/>
  <meta>
    <lastUpdated value="2015-03-23T00:00:00.000+11:00"/>
    <profile value="http://hl7.org/fhir/StructureDefinition/valueset-shareable-definition"/>
  </meta>
  <text>
    <status value="generated"/>
    <div xmlns="http://www.w3.org/1999/xhtml"><!-- Snipped for brevity --></div>
  </text>
  <url value="http://hl7.org/fhir/v3/vs/Confidentiality"/>
  <version value="2015-03-23"/>
  <name value="v3 Code System Confidentiality"/>
  <publisher value="HL7, Inc"/>
  <contact>
    <telecom>
      <system value="url"/>
      <value value="http://hl7.org"/>
    </telecom>
  </contact>
  <description value=" A set of codes specifying the security classification of acts and roles in accordance
     with the definition for concept domain &quot;Confidentiality&quot;."/>
  <status value="active"/>
  <experimental value="false"/>
  <date value="2015-03-23"/>
  <define>
    <extension url="http://hl7.org/fhir/StructureDefinition/valueset-oid">
      <valueUri value="urn:oid:2.16.840.1.113883.5.25"/>
    </extension>
    <system value="http://hl7.org/fhir/v3/Confidentiality"/>
    <caseSensitive value="true"/>
    <concept>
      <code value="_Confidentiality"/>
      <abstract value="false"/>
      <display value="Confidentiality"/>
      <definition value="A specializable code and its leaf codes used in Confidentiality value sets to value the
         Act.Confidentiality and Role.Confidentiality attribute in accordance with the definition
         for concept domain &quot;Confidentiality&quot;."/>
      <concept>
        <code value="L"/>
        <abstract value="false"/>
        <display value="low"/>
        <definition value="Definition: Privacy metadata indicating that the information has been de-identified, and
           there are mitigating circumstances that prevent re-identification, which minimize risk
           of harm from unauthorized disclosure.  The information requires protection to maintain
           low sensitivity.                                                      Examples: Includes
           anonymized, pseudonymized, or non-personally identifiable information such as HIPAA limited
           data sets.                                                      Map: No clear map to ISO
           13606-4 Sensitivity Level (1) Care Management:   RECORD_COMPONENTs that might need to
           be accessed by a wide range of administrative staff to manage the subject of care's access
           to health services.                                                      Usage Note: This
           metadata indicates the receiver may have an obligation to comply with a data use agreement."/>
      </concept>
      <concept>
        <code value="M"/>
        <abstract value="false"/>
        <display value="moderate"/>
        <definition value="Definition: Privacy metadata indicating moderately sensitive information, which presents
           moderate risk of harm if disclosed without authorization.                            
                                    Examples: Includes allergies of non-sensitive nature used inform
           food service; health information a patient authorizes to be used for marketing, released
           to a bank for a health credit card or savings account; or information in personal health
           record systems that are not governed under health privacy laws.                      
                                          Map: Partial Map to ISO 13606-4 Sensitivity Level (2) Clinical
           Management:  Less sensitive RECORD_COMPONENTs that might need to be accessed by a wider
           range of personnel not all of whom are actively caring for the patient (e.g. radiology
           staff).                                                      Usage Note: This metadata
           indicates that the receiver may be obligated to comply with the receiver's terms of use
           or privacy policies."/>
      </concept>
      <concept>
        <code value="N"/>
        <abstract value="false"/>
        <display value="normal"/>
        <definition value="Definition: Privacy metadata indicating that the information is typical, non-stigmatizing
           health information, which presents typical risk of harm if disclosed without authorization.
                                                                Examples: In the US, this includes
           what HIPAA identifies as the minimum necessary protected health information (PHI) given
           a covered purpose of use (treatment, payment, or operations).  Includes typical, non-stigmatizing
           health information disclosed in an application for health, workers compensation, disability,
           or life insurance.                                                      Map: Partial Map
           to ISO 13606-4 Sensitivity Level (3) Clinical Care:   Default for normal clinical care
           access (i.e. most clinical staff directly caring for the patient should be able to access
           nearly all of the EHR).   Maps to normal confidentiality for treatment information but
           not to ancillary care, payment and operations.                                       
                         Usage Note: This metadata indicates that the receiver may be obligated to
           comply with applicable jurisdictional privacy law or disclosure authorization."/>
      </concept>
      <concept>
        <code value="R"/>
        <abstract value="false"/>
        <display value="restricted"/>
        <definition value="Privacy metadata indicating highly sensitive, potentially stigmatizing information, which
           presents a high risk to the information subject if disclosed without authorization.  May
           be preempted by jurisdictional law, e.g., for public health reporting or emergency treatment.
           &gt;                            Examples: In the US, this includes what HIPAA identifies
           as the minimum necessary protected health information (PHI) given a covered purpose of
           use (treatment, payment, or operations).  Includes typical, non-stigmatizing health information
           disclosed in an application for health, workers compensation, disability, or life insurance.
                                                                Map: Partial Map to ISO 13606-4 Sensitivity
           Level (3) Clinical Care:   Default for normal clinical care access (i.e. most clinical
           staff directly caring for the patient should be able to access nearly all of the EHR).
             Maps to normal confidentiality for treatment information but not to ancillary care,
           payment and operations.                                                      Usage Note:
           This metadata indicates that the receiver may be obligated to comply with applicable,
           prevailing (default)  jurisdictional privacy law or disclosure authorization."/>
      </concept>
      <concept>
        <code value="U"/>
        <abstract value="false"/>
        <display value="unrestricted"/>
        <definition value="Definition: Privacy metadata indicating that the information is not classified as sensitive.
                                                                Examples: Includes publicly available
           information, e.g., business name, phone, email or physical address.                  
                                              Usage Note: This metadata indicates that the receiver
           has no obligation to consider additional policies when making access control decisions.
             Note that in some jurisdictions, personally identifiable information must be protected
           as confidential, so it would not be appropriate to assign a confidentiality code of &quot;unrestrict
          ed&quot;  to that information even if it is publicly available."/>
      </concept>
      <concept>
        <code value="V"/>
        <abstract value="false"/>
        <display value="very restricted"/>
        <definition value=". Privacy metadata indicating that the information is extremely sensitive and likely stigmatizing
           health information that presents a very high risk if disclosed without authorization.
            This information must be kept in the highest confidence.                            
                                      Examples:  Includes information about a victim of abuse, patient
           requested information sensitivity, and taboo subjects relating to health status that must
           be discussed with the patient by an attending provider before sharing with the patient.
            May also include information held under “legal lock� or attorney-client privilege
                                                                Map:  This metadata indicates that
           the receiver may not disclose this information except as directed by the information custodian,
           who may be the information subject.                                                  
              Usage Note:  This metadata indicates that the receiver may not disclose this information
           except as directed by the information custodian, who may be the information subject."/>
      </concept>
    </concept>
  </define>
</ValueSet>