Security
and
Privacy
This
page
is
part
of
the
FHIR
Specification
(v4.0.1:
R4
(v5.0.0:
R5
-
Mixed
Normative
and
STU
)
).
This
is
the
current
published
version
in
it's
permanent
home
(it
will
always
be
available
at
this
URL).
The
current
version
which
supercedes
this
version
is
5.0.0
.
For
a
full
list
of
available
versions,
see
the
Directory
of
published
versions
.
Page
versions:
R5
R4B
R4
R3
| Community Based Collaborative Care Work Group | Maturity Level : N/A | Standards Status : Informative | Compartments : Patient |
Raw XML ( canonical form + also see XML Format Specification )
Template for recording a Smart on FHIR Authorization (id = "consent-example-smartonfhir")
<?xml version="1.0" encoding="UTF-8"?>(Details : {http://terminology.hl7.org/CodeSystem/consentscope code 'patient-privacy' = 'Privacy Consent) <!-- In this SMART on FHIR login, the user consents for data sharing for their elderly parent's record --> <!-- this is the patient record that matches the person making the decision. note: it's not always a related person --><Consent xmlns="http://hl7.org/fhir"> <!-- This example provides a basic template for recording the consent associated with a SMART on FHIR OAuth dance. In SMART on FHIR, the user grants (consents) to a set of actions that the server can take when with regard to release of information from their own record to the application This is not the main intended use of the Consent resource, and there's no need for the consent resource as part of the SMART on FHIR Authorization process, or when using Heart UMA. Using a Consent resource to record and exchange the users consent may be useful for recording and storing the consent and making it available to the user later, or for exchanging the patient's consent between AS and RS, or between systems in a multi-system virtual RS a very common scenario) Note that whichever system builds this Content resource, it needs access to information from both the AS and the RS. Note also, that a situation where a practitioner type user authorises the application to access information on a general set of patients does not count as 'consent'. --> <id value="consent-example-smartonfhir"/> <text> <status value="generated"/> <div xmlns="http://www.w3.org/1999/xhtml"><p> <b> Generated Narrative: Consent</b> <a name="consent-example-smartonfhir"> </a> </p> <div style="display: inline-block; background-color: #d9e0e7; padding: 6px; margin: 4px; border: 1px solid #8da1b4; border-radius: 5px; line-height: 60%"><p style="margin-bottom: 0px">Resource Consent "consent-example-smartonfhir" </p> </div> <p> <b> status</b> : active</p> <p> <b> category</b> : Patient Consent <span style="background: LightGoldenRodYellow; margin: 4px; border: 1px solid khaki"> (<a href="https://loinc.org/">LOINC</a> #59284-0)</span> </p> <p> <b> subject</b> : <span title=" In this SMART on FHIR login, the user consents for data sharing for their elderly parent's record "><a href="patient-example-xcda.html">Patient/xcda</a> "Henry LEVIN"</span> </p> <p> <b> date</b> : 2016-06-23</p> <p> <b> grantor</b> : <a href="relatedperson-example-peter.html">RelatedPerson/peter</a> "Peter CHALMERS"</p> <p> <b> controller</b> : <a href="organization-example-f001-burgers.html">Organization/f001</a> "Burgers University Medical Center"</p> <p> <b> regulatoryBasis</b> : <span title=" there's no source record for a Smart on FHIR consent smart on fhir requires a base opt-in policy ">information access <span style="background: LightGoldenRodYellow; margin: 4px; border: 1px solid khaki"> (<a href="http://terminology.hl7.org/5.1.0/CodeSystem-v3-ActCode.html">ActCode</a> #INFA)</span> </span> </p> <p> <b> decision</b> : <span title=" each scope that relates to FHIR resource access is represented as an exception ">permit</span> </p> <blockquote> <p> <b> provision</b> </p> <p> <b> period</b> : 2016-06-23T17:02:33+10:00 --> 2016-06-23T17:32:33+10:00</p> <h3> Provisions</h3> <table class="grid"><tr> <td> -</td> <td> <b> Action</b> </td> <td> <b> ResourceType</b> </td> </tr> <tr> <td> *</td> <td> <span title=" this rule corresponds to MedicationRequest/read &#10; no actors here, or anything, just read/write and the resource type ">Access <span style="background: LightGoldenRodYellow; margin: 4px; border: 1px solid khaki"> (<a href="http://terminology.hl7.org/5.1.0/CodeSystem-consentaction.html">Consent Action Codes</a> #access)</span> </span> , Access and Correct <span style="background: LightGoldenRodYellow; margin: 4px; border: 1px solid khaki"> (<a href="http://terminology.hl7.org/5.1.0/CodeSystem-consentaction.html">Consent Action Codes</a> #correct)</span> </td> <td> MedicationRequest (Details: http://hl7.org/fhir/resource-types code MedicationRequest = 'MedicationRequest', stated as 'null')</td> </tr> </table> </blockquote> </div> </text> <status value="active"/> <category> <coding> <system value="http://loinc.org"/> <code value="59284-0"/> </coding> </category> <!-- In this SMART on FHIR login, the user consents for data sharing for their elderly parent's record --> <subject> <reference value="Patient/xcda"/> </subject> <date value="2016-06-23"/> <grantor> <!-- this is the patient record that matches the person making the decision. note: it's not always a related person --> <reference value="RelatedPerson/peter"/> </grantor> <controller> <!-- The organization running the Authentication server --> <reference value="Organization/f001"/> </controller> <!-- there's no source record for a Smart on FHIR consent smart on fhir requires a base opt-in policy --> <regulatoryBasis> <coding> <system value="http://terminology.hl7.org/CodeSystem/v3-ActCode"/> <code value="INFA"/> </coding> </regulatoryBasis> <!-- each scope that relates to FHIR resource access is represented as an exception --> <decision value="permit"/> <provision> <period> <start value="2016-06-23T17:02:33+10:00"/> <end value="2016-06-23T17:32:33+10:00"/> </period> <provision> <!-- this rule corresponds to MedicationRequest/read --> <!-- no actors here, or anything, just read/write and the resource type --> <action> <coding> <system value="http://terminology.hl7.org/CodeSystem/consentaction"/> <code value="access"/> </coding> </action> <action> <coding> <system value="http://terminology.hl7.org/CodeSystem/consentaction"/> <code value="correct"/> </coding> </action> <resourceType> <system value="http://hl7.org/fhir/resource-types"/> <code value="MedicationRequest"/> </resourceType> </provision> </provision> </ Consent >
Usage note: every effort has been made to ensure that the examples are correct and useful, but they are not a normative part of the specification.
FHIR
®©
HL7.org
2011+.
FHIR
Release
4
(Technical
Correction
#1)
(v4.0.1)
R5
hl7.fhir.core#5.0.0
generated
on
Fri,
Nov
1,
2019
09:34+1100.
QA
Page
Sun,
Mar
26,
2023
15:24+1100.
Links:
Search
|
Version
History
|
Table
of
Contents
|
Credits
Glossary
|
QA
|
Compare
to
R3
R4
|
Compare
to
R4B
|
|
Propose
a
change