. Page versions: R4 R3 R2This page is part of the FHIR Specification (v0.0.82: DSTU 1). The current version which supercedes this version is 5.0.0. For a full list of available versions, see the Directory of published versions . Page versions: R4 R3 R2
A set of codes specifying the security classification of acts and roles in accordance with the definition for concept domain "Confidentiality".
<ValueSet xmlns="http://hl7.org/fhir"> <text> <status value="generated"/> <div xmlns="http://www.w3.org/1999/xhtml"> <p>Release Date: 2014-08-07</p> <h2>Description</h2> <p> A set of codes specifying the security classification of acts and roles in accordance with the definition for concept domain "Confidentiality". <br/> </p> <hr/> <table class="grid"> <tr> <td> <b>Level</b> </td> <td> <b>Code</b> </td> <td> <b>Display</b> </td> <td> <b>Definition</b> </td> </tr> <tr> <td>1</td> <td>_Confidentiality <a name="_Confidentiality"> </a> </td> <td>Confidentiality</td> <td> A specializable code and its leaf codes used in Confidentiality value sets to value the Act.Confidentiality and Role.Confidentiality attribute in accordance with the definition for concept domain "Confidentiality". <br/> </td> </tr> <tr> <td>2</td> <td> L <a name="L"> </a> </td> <td>low</td> <td> Definition: Privacy metadata indicating that the information has been de-identified, and there are mitigating circumstances that prevent re-identification, which minimize risk of harm from unauthorized disclosure. The information requires protection to maintain low sensitivity. <br/> Examples: Includes anonymized, pseudonymized, or non-personally identifiable information such as HIPAA limited data sets. <br/> Map: No clear map to ISO 13606-4 Sensitivity Level (1) Care Management: RECORD_COMPONENTs that might need to be accessed by a wide range of administrative staff to manage the subject of care's access to health services. <br/> Usage Note: This metadata indicates the receiver may have an obligation to comply with a data use agreement. <br/> </td> </tr> <tr> <td>2</td> <td> M <a name="M"> </a> </td> <td>moderate</td> <td> Definition: Privacy metadata indicating moderately sensitive information, which presents moderate risk of harm if disclosed without authorization. <br/> Examples: Includes allergies of non-sensitive nature used inform food service; health information a patient authorizes to be used for marketing, released to a bank for a health credit card or savings account; or information in personal health record systems that are not governed under health privacy laws. <br/> Map: Partial Map to ISO 13606-4 Sensitivity Level (2) Clinical Management: Less sensitive RECORD_COMPONENTs that might need to be accessed by a wider range of personnel not all of whom are actively caring for the patient (e.g. radiology staff). <br/> Usage Note: This metadata indicates that the receiver may be obligated to comply with the receiver's terms of use or privacy policies. <br/> </td> </tr> <tr> <td>2</td> <td> N <a name="N"> </a> </td> <td>normal</td> <td> Definition: Privacy metadata indicating that the information is typical, non-stigmatizing health information, which presents typical risk of harm if disclosed without authorization. <br/> Examples: In the US, this includes what HIPAA identifies as the minimum necessary protected health information (PHI) given a covered purpose of use (treatment, payment, or operations). Includes typical, non-stigmatizing health information disclosed in an application for health, workers compensation, disability, or life insurance. <br/> Map: Partial Map to ISO 13606-4 Sensitivity Level (3) Clinical Care: Default for normal clinical care access (i.e. most clinical staff directly caring for the patient should be able to access nearly all of the EHR). Maps to normal confidentiality for treatment information but not to ancillary care, payment and operations. <br/> Usage Note: This metadata indicates that the receiver may be obligated to comply with applicable jurisdictional privacy law or disclosure authorization. <br/> </td> </tr> <tr> <td>2</td> <td> R <a name="R"> </a> </td> <td>restricted</td> <td> Privacy metadata indicating highly sensitive, potentially stigmatizing information, which presents a high risk to the information subject if disclosed without authorization. May be preempted by jurisdictional law, e.g., for public health reporting or emergency treatment. <br/> > Examples: In the US, this includes what HIPAA identifies as the minimum necessary protected health information (PHI) given a covered purpose of use (treatment, payment, or operations). Includes typical, non-stigmatizing health information disclosed in an application for health, workers compensation, disability, or life insurance. <br/> Map: Partial Map to ISO 13606-4 Sensitivity Level (3) Clinical Care: Default for normal clinical care access (i.e. most clinical staff directly caring for the patient should be able to access nearly all of the EHR). Maps to normal confidentiality for treatment information but not to ancillary care, payment and operations. <br/> Usage Note: This metadata indicates that the receiver may be obligated to comply with applicable, prevailing (default) jurisdictional privacy law or disclosure authorization. <br/> </td> </tr> <tr> <td>2</td> <td> U <a name="U"> </a> </td> <td>unrestricted</td> <td> Definition: Privacy metadata indicating that the information is not classified as sensitive. <br/> Examples: Includes publicly available information, e.g., business name, phone, email or physical address. <br/> Usage Note: This metadata indicates that the receiver has no obligation to consider additional policies when making access control decisions. Note that in some jurisdictions, personally identifiable information must be protected as confidential, so it would not be appropriate to assign a confidentiality code of "unrestricted" to that information even if it is publicly available. <br/> </td> </tr> <tr> <td>2</td> <td> V <a name="V"> </a> </td> <td>very restricted</td> <td> . Privacy metadata indicating that the information is extremely sensitive and likely stigmatizing health information that presents a very high risk if disclosed without authorization. This information must be kept in the highest confidence. <br/> Examples: Includes information about a victim of abuse, patient requested information sensitivity, and taboo subjects relating to health status that must be discussed with the patient by an attending provider before sharing with the patient. May also include information held under “legal lock� or attorney-client privilege <br/> Map: This metadata indicates that the receiver may not disclose this information except as directed by the information custodian, who may be the information subject. <br/> Usage Note: This metadata indicates that the receiver may not disclose this information except as directed by the information custodian, who may be the information subject. <br/> </td> </tr> </table> </div> </text> <identifier value="http://hl7.org/fhir/v3/vs/Confidentiality"/> <name value="v3 Code System Confidentiality"/> <publisher value="HL7, Inc"/> <telecom> <system value="url"/> <value value="http://hl7.org"/> </telecom> <description value=" A set of codes specifying the security classification of acts and roles in accordance with the definition for concept domain "Confidentiality"."/> <status value="active"/> <date value="2014-08-07T00:00:00+10:00"/> <define> <system value="http://hl7.org/fhir/v3/Confidentiality"/> <caseSensitive value="true"/> <concept> <code value="_Confidentiality"/> <display value="Confidentiality"/> <definition value="A specializable code and its leaf codes used in Confidentiality value sets to value the Act.Confidentiality and Role.Confidentiality attribute in accordance with the definition for concept domain "Confidentiality"."/> <concept> <code value="L"/> <display value="low"/> <definition value="Definition: Privacy metadata indicating that the information has been de-identified, and there are mitigating circumstances that prevent re-identification, which minimize risk of harm from unauthorized disclosure. The information requires protection to maintain low sensitivity. Examples: Includes anonymized, pseudonymized, or non-personally identifiable information such as HIPAA limited data sets. Map: No clear map to ISO 13606-4 Sensitivity Level (1) Care Management: RECORD_COMPONENTs that might need to be accessed by a wide range of administrative staff to manage the subject of care's access to health services. Usage Note: This metadata indicates the receiver may have an obligation to comply with a data use agreement."/> </concept> <concept> <code value="M"/> <display value="moderate"/> <definition value="Definition: Privacy metadata indicating moderately sensitive information, which presents moderate risk of harm if disclosed without authorization. Examples: Includes allergies of non-sensitive nature used inform food service; health information a patient authorizes to be used for marketing, released to a bank for a health credit card or savings account; or information in personal health record systems that are not governed under health privacy laws. Map: Partial Map to ISO 13606-4 Sensitivity Level (2) Clinical Management: Less sensitive RECORD_COMPONENTs that might need to be accessed by a wider range of personnel not all of whom are actively caring for the patient (e.g. radiology staff). Usage Note: This metadata indicates that the receiver may be obligated to comply with the receiver's terms of use or privacy policies."/> </concept> <concept> <code value="N"/> <display value="normal"/> <definition value="Definition: Privacy metadata indicating that the information is typical, non-stigmatizing health information, which presents typical risk of harm if disclosed without authorization. Examples: In the US, this includes what HIPAA identifies as the minimum necessary protected health information (PHI) given a covered purpose of use (treatment, payment, or operations). Includes typical, non-stigmatizing health information disclosed in an application for health, workers compensation, disability, or life insurance. Map: Partial Map to ISO 13606-4 Sensitivity Level (3) Clinical Care: Default for normal clinical care access (i.e. most clinical staff directly caring for the patient should be able to access nearly all of the EHR). Maps to normal confidentiality for treatment information but not to ancillary care, payment and operations. Usage Note: This metadata indicates that the receiver may be obligated to comply with applicable jurisdictional privacy law or disclosure authorization."/> </concept> <concept> <code value="R"/> <display value="restricted"/> <definition value="Privacy metadata indicating highly sensitive, potentially stigmatizing information, which presents a high risk to the information subject if disclosed without authorization. May be preempted by jurisdictional law, e.g., for public health reporting or emergency treatment. > Examples: In the US, this includes what HIPAA identifies as the minimum necessary protected health information (PHI) given a covered purpose of use (treatment, payment, or operations). Includes typical, non-stigmatizing health information disclosed in an application for health, workers compensation, disability, or life insurance. Map: Partial Map to ISO 13606-4 Sensitivity Level (3) Clinical Care: Default for normal clinical care access (i.e. most clinical staff directly caring for the patient should be able to access nearly all of the EHR). Maps to normal confidentiality for treatment information but not to ancillary care, payment and operations. Usage Note: This metadata indicates that the receiver may be obligated to comply with applicable, prevailing (default) jurisdictional privacy law or disclosure authorization."/> </concept> <concept> <code value="U"/> <display value="unrestricted"/> <definition value="Definition: Privacy metadata indicating that the information is not classified as sensitive. Examples: Includes publicly available information, e.g., business name, phone, email or physical address. Usage Note: This metadata indicates that the receiver has no obligation to consider additional policies when making access control decisions. Note that in some jurisdictions, personally identifiable information must be protected as confidential, so it would not be appropriate to assign a confidentiality code of "unrestrict ed" to that information even if it is publicly available."/> </concept> <concept> <code value="V"/> <display value="very restricted"/> <definition value=". Privacy metadata indicating that the information is extremely sensitive and likely stigmatizing health information that presents a very high risk if disclosed without authorization. This information must be kept in the highest confidence. Examples: Includes information about a victim of abuse, patient requested information sensitivity, and taboo subjects relating to health status that must be discussed with the patient by an attending provider before sharing with the patient. May also include information held under “legal lock� or attorney-client privilege Map: This metadata indicates that the receiver may not disclose this information except as directed by the information custodian, who may be the information subject. Usage Note: This metadata indicates that the receiver may not disclose this information except as directed by the information custodian, who may be the information subject."/> </concept> </concept> </define> </ValueSet>
© HL7.org 2011+. FHIR DSTU (v0.0.82.2943) generated on Tue, Sep 30, 2014 18:10+1000.
Links:
What's a DSTU? |
Version History |
|
Propose a change