Restricting Access to Patient Data
Create a CompartmentDefinition instance from a standard patient CompartmentDefinition:
PUT /fhir/CompartmentDefinition/Patient
Content-Type: application/json
{
"resourceType": "CompartmentDefinition",
"id": "Patient",
"url": "http://hl7.org/fhir/CompartmentDefinition/patient",
"name": "Base FHIR compartment definition for Patient",
"status": "draft",
"experimental": true,
"date": "2018-12-27T22:37:54+11:00",
"publisher": "FHIR Project Team",
"contact": [
{
"telecom": [
{
"system": "url",
"value": "http://hl7.org/fhir"
}
]
}
],
"description": "There is an instance of the patient compartment for each patient resource, and the identity of the compartment is the same as the patient. When a patient is linked to another patient, all the records associated with the linked patient are in the compartment associated with the target of the link.. The set of resources associated with a particular patient",
"code": "Patient",
"search": true,
"resource": [
{
"code": "Account",
"param": [
"subject"
]
},
{
"code": "ActivityDefinition"
},
{
"code": "AdverseEvent",
"param": [
"subject"
]
},
{
"code": "AllergyIntolerance",
"param": [
"patient",
"recorder",
"asserter"
]
},
{
"code": "Appointment",
"param": [
"actor"
]
},
{
"code": "AppointmentResponse",
"param": [
"actor"
]
},
{
"code": "AuditEvent",
"param": [
"patient"
]
},
{
"code": "Basic",
"param": [
"patient",
"author"
]
},
{
"code": "Binary"
},
{
"code": "BiologicallyDerivedProduct"
},
{
"code": "BodyStructure",
"param": [
"patient"
]
},
{
"code": "Bundle"
},
{
"code": "CapabilityStatement"
},
{
"code": "CarePlan",
"param": [
"patient",
"performer"
]
},
{
"code": "CareTeam",
"param": [
"patient",
"participant"
]
},
{
"code": "CatalogEntry"
},
{
"code": "ChargeItem",
"param": [
"subject"
]
},
{
"code": "ChargeItemDefinition"
},
{
"code": "Claim",
"param": [
"patient",
"payee"
]
},
{
"code": "ClaimResponse",
"param": [
"patient"
]
},
{
"code": "ClinicalImpression",
"param": [
"subject"
]
},
{
"code": "CodeSystem"
},
{
"code": "Communication",
"param": [
"subject",
"sender",
"recipient"
]
},
{
"code": "CommunicationRequest",
"param": [
"subject",
"sender",
"recipient",
"requester"
]
},
{
"code": "CompartmentDefinition"
},
{
"code": "Composition",
"param": [
"subject",
"author",
"attester"
]
},
{
"code": "ConceptMap"
},
{
"code": "Condition",
"param": [
"patient",
"asserter"
]
},
{
"code": "Consent",
"param": [
"patient"
]
},
{
"code": "Contract"
},
{
"code": "Coverage",
"param": [
"policy-holder",
"subscriber",
"beneficiary",
"payor"
]
},
{
"code": "CoverageEligibilityRequest",
"param": [
"patient"
]
},
{
"code": "CoverageEligibilityResponse",
"param": [
"patient"
]
},
{
"code": "DetectedIssue",
"param": [
"patient"
]
},
{
"code": "Device"
},
{
"code": "DeviceDefinition"
},
{
"code": "DeviceMetric"
},
{
"code": "DeviceRequest",
"param": [
"subject",
"performer"
]
},
{
"code": "DeviceUseStatement",
"param": [
"subject"
]
},
{
"code": "DiagnosticReport",
"param": [
"subject"
]
},
{
"code": "DocumentManifest",
"param": [
"subject",
"author",
"recipient"
]
},
{
"code": "DocumentReference",
"param": [
"subject",
"author"
]
},
{
"code": "EffectEvidenceSynthesis"
},
{
"code": "Encounter",
"param": [
"patient"
]
},
{
"code": "Endpoint"
},
{
"code": "EnrollmentRequest",
"param": [
"subject"
]
},
{
"code": "EnrollmentResponse"
},
{
"code": "EpisodeOfCare",
"param": [
"patient"
]
},
{
"code": "EventDefinition"
},
{
"code": "Evidence"
},
{
"code": "EvidenceVariable"
},
{
"code": "ExampleScenario"
},
{
"code": "ExplanationOfBenefit",
"param": [
"patient",
"payee"
]
},
{
"code": "FamilyMemberHistory",
"param": [
"patient"
]
},
{
"code": "Flag",
"param": [
"patient"
]
},
{
"code": "Goal",
"param": [
"patient"
]
},
{
"code": "GraphDefinition"
},
{
"code": "Group",
"param": [
"member"
]
},
{
"code": "GuidanceResponse"
},
{
"code": "HealthcareService"
},
{
"code": "ImagingStudy",
"param": [
"patient"
]
},
{
"code": "Immunization",
"param": [
"patient"
]
},
{
"code": "ImmunizationEvaluation",
"param": [
"patient"
]
},
{
"code": "ImmunizationRecommendation",
"param": [
"patient"
]
},
{
"code": "ImplementationGuide"
},
{
"code": "InsurancePlan"
},
{
"code": "Invoice",
"param": [
"subject",
"patient",
"recipient"
]
},
{
"code": "Library"
},
{
"code": "Linkage"
},
{
"code": "List",
"param": [
"subject",
"source"
]
},
{
"code": "Location"
},
{
"code": "Measure"
},
{
"code": "MeasureReport",
"param": [
"patient"
]
},
{
"code": "Media",
"param": [
"subject"
]
},
{
"code": "Medication"
},
{
"code": "MedicationAdministration",
"param": [
"patient",
"performer",
"subject"
]
},
{
"code": "MedicationDispense",
"param": [
"subject",
"patient",
"receiver"
]
},
{
"code": "MedicationKnowledge"
},
{
"code": "MedicationRequest",
"param": [
"subject"
]
},
{
"code": "MedicationStatement",
"param": [
"subject"
]
},
{
"code": "MedicinalProduct"
},
{
"code": "MedicinalProductAuthorization"
},
{
"code": "MedicinalProductContraindication"
},
{
"code": "MedicinalProductIndication"
},
{
"code": "MedicinalProductIngredient"
},
{
"code": "MedicinalProductInteraction"
},
{
"code": "MedicinalProductManufactured"
},
{
"code": "MedicinalProductPackaged"
},
{
"code": "MedicinalProductPharmaceutical"
},
{
"code": "MedicinalProductUndesirableEffect"
},
{
"code": "MessageDefinition"
},
{
"code": "MessageHeader"
},
{
"code": "MolecularSequence",
"param": [
"patient"
]
},
{
"code": "NamingSystem"
},
{
"code": "NutritionOrder",
"param": [
"patient"
]
},
{
"code": "Observation",
"param": [
"subject",
"performer"
]
},
{
"code": "ObservationDefinition"
},
{
"code": "OperationDefinition"
},
{
"code": "OperationOutcome"
},
{
"code": "Organization"
},
{
"code": "OrganizationAffiliation"
},
{
"code": "Patient",
"param": [
"link"
]
},
{
"code": "PaymentNotice"
},
{
"code": "PaymentReconciliation"
},
{
"code": "Person",
"param": [
"patient"
]
},
{
"code": "PlanDefinition"
},
{
"code": "Practitioner"
},
{
"code": "PractitionerRole"
},
{
"code": "Procedure",
"param": [
"patient",
"performer"
]
},
{
"code": "Provenance",
"param": [
"patient"
]
},
{
"code": "Questionnaire"
},
{
"code": "QuestionnaireResponse",
"param": [
"subject",
"author"
]
},
{
"code": "RelatedPerson",
"param": [
"patient"
]
},
{
"code": "RequestGroup",
"param": [
"subject",
"participant"
]
},
{
"code": "ResearchDefinition"
},
{
"code": "ResearchElementDefinition"
},
{
"code": "ResearchStudy"
},
{
"code": "ResearchSubject",
"param": [
"individual"
]
},
{
"code": "RiskAssessment",
"param": [
"subject"
]
},
{
"code": "RiskEvidenceSynthesis"
},
{
"code": "Schedule",
"param": [
"actor"
]
},
{
"code": "SearchParameter"
},
{
"code": "ServiceRequest",
"param": [
"subject",
"performer"
]
},
{
"code": "Slot"
},
{
"code": "Specimen",
"param": [
"subject"
]
},
{
"code": "SpecimenDefinition"
},
{
"code": "StructureDefinition"
},
{
"code": "StructureMap"
},
{
"code": "Subscription"
},
{
"code": "Substance"
},
{
"code": "SubstanceNucleicAcid"
},
{
"code": "SubstancePolymer"
},
{
"code": "SubstanceProtein"
},
{
"code": "SubstanceReferenceInformation"
},
{
"code": "SubstanceSourceMaterial"
},
{
"code": "SubstanceSpecification"
},
{
"code": "SupplyDelivery",
"param": [
"patient"
]
},
{
"code": "SupplyRequest",
"param": [
"subject"
]
},
{
"code": "Task"
},
{
"code": "TerminologyCapabilities"
},
{
"code": "TestReport"
},
{
"code": "TestScript"
},
{
"code": "ValueSet"
},
{
"code": "VerificationResult"
},
{
"code": "VisionPrescription",
"param": [
"patient"
]
}
]
}Create AccessPolicy resource which will allow all GET requests for /fhir/Patient/*
PUT /AccessPolicy/allow-to-get-patient-compartment
Content-Type: application/json
{
"resourceType": "AccessPolicy",
"id": "allow-to-get-patient-compartment",
"engine": "json-schema",
"schema": {
"type": "object",
"properties": {
"uri": {
"type": "string",
"pattern": "^/fhir/Patient/"
},
"params": {
"type": "object",
"required": ["resource/id"],
"properties": {
"resource/id": {"constant": {"$data": "#/jwt/pid"}}
}
}
}
}
}Put your patient ID value into the pid claim of your JWT. Congratulations, that's all.
Last updated