Page Comparison

Table of Contents

...

Description

...

Based on declaration

...

Doctor with an active declaration can access all the patient's medical data.

...

Based on managing organization

...

User can read entities, created in his MSP

...

Based on context episode

...

User can read medical data, that was collected during an episode of care, that user has access to.

...

Based on diagnostic report

...

User can read medical data, that was collected as a part of a diagnostic report, managed by the user's legal entity.

...

Based on origin episode

...

Doctor can read medical data, that was collected as a part of a diagnostic report or episode of care, that user has access to.
Episode of care, that contains this service request, is considered as an origin episode in that case.

...

Based on care plan

...

User with active approval on the care plan can read or write the data based on this care plan

...

Rule

...

Base

...

Resource

...

Routes

...

Context

...

Logic

...

Source of context

...

@rule_-2

@read @episode @encounter @observation @condition @allergy_intolerance @primmunization @risk_assessment @device @medication_statement @service_request @diagnostic_report @procedure @medication_administration@care_plan @activity

Scenario: NHS employee can read patient’s data if he has Justification for monitoring

Given Justification on monitoring patient's data given by the user (works only from Admin panel, graphql api)

When I require read access

Then I can read

...

Based on user token

...

by id

...

patient_id

...

There is an active token

...

by search params

...

There is an active token

...

@rule_-1

@read @allergy_intolerance @immunization @risk_assessment @device @medication_statement

Scenario: Employee can read insensitive patient’s data

Given User access token with client_type not equal to cabinet

When I require read access

Then I can read

...

Based on user token

...

by id

...

There is an active token

...

by search params

...

There is an active token

...

@rule_0

@read @episode @encounter @observation @condition @allergy_intolerance @immunization @risk_assessment @device @medication_statement @service_request @diagnostic_report @procedure @medication_administration@care_plan @activity @clinical_impression

Scenario: Patient can read it's own data

Given Patient has access_token given by Cabinet

When I require read access

Then I can read

...

Based on patient token

...

by id

...

patient_id

...

There is an active token given by Cabinet to a patient

...

by search params

@rule_1

@read @episode @encounter @observation @condition @service_request @diagnostic_report @procedure @medication_administration @care_plan @activity @approval @clinical_impression

Scenario: Doctor with active declaration can read all patient data

Given Active declaration with patient

And declaration from the same MSP

When I require read access

Then I can read

Based on declaration

...

episode

...

by id

patient_id

...

There is an active declaration between the patient and the doctor in OPS

patient_id from URL

...

by search params

...

encounter

...

by id

...

by search params

...

by id in episode context

...

by search params in episode context

...

observation

...

by id

...

by search params

...

by id in episode context

...

by search params in episode context

...

condition

...

by id

...

by search params

...

by id in episode context

...

by search params in episode context

...

service_request

...

by id

...

by search params

...

diagnostic_report

...

by id

...

by search params

...

care_plan

...

by id

...

by search params

...

activity

...

by id

...

by search params

...

approval

...

by id

...

by search params

...

clinical_impression

...

by id

...

by search params

@rule_2

@read @episode @service_request @diagnostic_report @procedures

Scenario: Doctor can read entity created in the doctors MSP

...

Table of Contents

Rule base type	Description
Based on declaration	Doctor with an active declaration can access all the patient's medical data.
Based on managing organization	User can read entities, created in his MSP
Based on context episode	User can read medical data, that was collected during an episode of care, that user has access to.
Based on diagnostic report	User can read medical data, that was collected as a part of a diagnostic report, managed by the user's legal entity.
Based on origin episode	Doctor can read medical data, that was collected as a part of a diagnostic report or episode of care, that user has access to. Episode of care, that contains this service request, is considered as an origin episode in that case.
Based on care plan	User with active approval on the care plan can read or write the data based on this care plan

managing organizationepisode.client_idDB.service_request.managing_organization

episode

episode.managing_organization==token.client_id

episodeepisode_id from URL (path)DB.service_request.encounterimmunizationdeviceriskassessmentmedication_administrationallergyintoleranceservice requestdiagnostic report

Rule	Base	Resource	Routes	Context	Logic	Source of context
@rule_-2 (GraphQL only) @read @episode @encounter @observation @condition @allergy_intolerance @primmunization @risk_assessment @device @medication_statement @service_request @diagnostic_report @procedure @medication_administration@care_plan @activity Scenario: NHS employee can read patient’s data if he has Justification for monitoring Given Justification on monitoring patient's data given by the user (works only from Admin panel, graphql api) When I require read access Then I can read	Based on user token		by id	patient_id	There is an active token
	Based on user token		by search params	patient_id	There is an active token
@rule_-1 @read @allergy_intolerance @immunization @risk_assessment @device @medication_statement Scenario: Employee can read insensitive patient’s data Given User access token with client_type not equal to cabinet When I require read access Then I can read	Based on user token		by id		There is an active token
	Based on user token		by search params		There is an active token
@rule_0 @read @episode @encounter @observation @condition @allergy_intolerance @immunization @risk_assessment @device @medication_statement @service_request @diagnostic_report @procedure @medication_administration@care_plan @activity @clinical_impression Scenario: Patient can read it's own data Given Patient has access_token given by Cabinet When I require read access Then I can read	Based on patient token		by id	patient_id	There is an active token given by Cabinet to a patient
	Based on patient token		by search params	patient_id	There is an active token given by Cabinet to a patient
@rule_1 @read @episode @encounter @observation @condition @service_request @diagnostic_report @procedure @medication_administration @care_plan @activity @approval @clinical_impression Scenario: Employee with active declaration can read all patient data Given Active declaration with patient And declaration from the same MSP When I require read access Then I can read	Based on declaration	episode	by id	patient_id	There is an active declaration between the patient and the doctor in OPS	patient_id from URL
		episode	by search params
		encounter	by id
			by search params
			by id in episode context
			by search params in episode context
		observation	by id
			by search params
			by id in episode context
			by search params in episode context
		condition	by id
			by search params
			by id in episode context
			by search params in episode context
		service_request	by id
		service_request	by search params
		diagnostic_report	by id
		diagnostic_report	by search params
		care_plan	by id
		care_plan	by search params
		activity	by id
		activity	by search params
		approval	by id
		approval	by search params
		clinical_impression	by id
		clinical_impression	by search params
		medication_request_request	by id
		medication_request_request	by search params
		medication_request	by id
		medication_request	by search params
		medication_dispense	by id
		medication_dispense	by search params (Search Medication dispenses by Medication request ID)
@rule_2 @read @episode @service_request @diagnostic_report @procedures Scenario: Doctor can read entity created in the doctors MSP Given Entity has been created on my MSP When I require read access Then I can read	Based on managing organization	episode	by id	episode	managing_organization==token.client_id	DB.episode.managing_organization
		episode	by search params	episode		search param {managing_organization} from URL
		service_request	by id	service request		DB.service_request.managing_organization
		service_request	by search params	service request		search param {requester_legal_entity} from URL
		diagnostic_report	by id	diagnostic_report		DB.diagnostic_report.managing_organization
		diagnostic_report	by search params	diagnostic_report		search param {managing_organization} from URL
		procedures	by search params	managing_organization		search param {managing_organization} from URL
		medication_request_request	by id	legal_entity + patient_id	legal_entity_id==id	search param {legal_entity_id} from URL
		medication_request_request	by search param	legal_entity + patient_id	legal_entity_id ==token.client_id	search param {legal_entity_id} from URL
		medication_request	by id	legal_entity + patient_id	legal_entity_id==id	search param {legal_entity_id} from URL
		medication_request	by search param	legal_entity + patient_id	legal_entity_id ==token.client_id	search param {legal_entity_id} from URL
		medication_dispense	by id	legal_entity + patient_id	legal_entity_id==id	search param {legal_entity_id} from URL
		medication_dispense	by search param (Search Medication dispenses by Medication request ID)	legal_entity + patient_id	legal_entity_id ==token.client_id	search param {legal_entity_id} from URL
@rule_3 @read @encounter @observation @condition @service_request @diagnostic_report @device @medication_statement @immunization @risk_assessment @medication_administration @procedure @allergy_intolerance @clinical_impression Scenario: Doctor can read all the data of episodes created in the doctors MSP Given Episode context has been created on my MSP When I require read access Then I can read	Based on	context episode	encounter	by id	episode	episode.managing_organization==token	DB.episode.managing_organization
				by search params			search param {managing_organization} from URL
				service_request			by id	service request	.client_id	DB.encounter.episode
				service_request			by search params	service request		search param {requesterepisode_legal_entityid} from URL
			diagnostic_report	by id in episode context			diagnostic_report	DB.diagnostic_report.managing_organization		episode_id from URL (path)
			diagnostic_report	by search params			diagnostic_report	search param {managing_organization} from URL		episode_id from URL (path)	proceduresin episode context
			observation	by id			DB.observation.episode
				by search paramsmanaging_organization			search param {managingepisode_organizationid} from URL
				@rule_3 @read @encounter @observation @condition @service_request @diagnostic_report @device @medication_statement @immunization @risk_assessment @medication_administration @procedure @allergy_intolerance @clinical_impression Scenario: Doctor can read all the data of episodes created in the doctors MSP Given Episode context has been created on my MSP When I require read access Then I can read			Based on context episode	encounter		by id	DB.encounter.episodeby id in episode context	episode_id from URL (path)
										by search params in episode context		episode_id from URL (path)
			condition							by id	DB.condition.episode
										by search params	search param {episode_id} from URL
								by is in episode context		episode_id from URL (path)
								by search params in episode context		episode_id from URL (path)
			service_request					by id		DB.service_request.encounter.episode.managing_organization
								by search params		search param {episode_id} from URL
								by id in episode context		episode_id from URL (path)
			by search params in episode context
			observation					diagnostic_report		by id	DB.observationdiagnostic_report.encounter.episode.managing_organization
								diagnostic_report		by search params	search param {episode_id} from URL	by id in episode context	context_episode_id from URL (path)
								by search params in episode context
								condition		medication_statement	by id	IF context is encounter THEN: DB.medication_statements.conditioncontext.episode.managing_organization
			by search params							medication_statement	search param {episode_id} from URL	by is in episode context
			by search params in episode context
			service_request							by id	immunization	by id	IF context is encounter THEN: DB.immunizations.context.episode.managing_organization
								by search params		search param {episode_id} from URL
								by id in episode context		episode_id from URL (path)diagnostic_report
			by search params in episode context							episode_id from URL (path)diagnostic_report
			device					by id		IF context is encounter THEN: DB.diagnostic_reportdevices.encountercontext.episode.managing_organization
			device					by search params		context_search param {episode_id} from URL (path)
			medicationrisk_statementassessment					by id		IF context is encounter THEN: DB.medicationrisk_statementsassessments.context.episode.managing_organization
			medicationrisk_statementassessment					by search params		search param {episode_id} from URL
			medication_administration					by id		IF context is encounter THEN: DB.immunizationsmedication_administrations.context.episode.managing_organization
			medication_administration					by search params		search param {episode_id} from URL
			by id in episode context					episode_id from URL (path)
			by search params in episode context					episode_id from URL (path)
			from URL
			procedure		by id			IF context is encounter THEN: DB.devicesprocedures.contextencounter.episode.managing_organization
			procedure		by search params			search param {episode_id} from URL
			allergy_		intolerance			by id		IF context is encounter THEN: DB.riskallergy_assessmentsintolerances.context.episode.managing_organization
								by search params		search param {episode_id} from URL
								by id in episode context		episode_id from URL (path)
								by search params in episode context
clinical_impression	by id	IF context is encounter THEN: DB.medicationclinical_administrations.contextimpression.episode.managing_organization
clinical_impression	by search params	search param {episode_id} from URL
proceduremedication_request	by id	episode	DB.procedures.encounter.episode.managing_organizationmedication_request.context_episode_id
proceduremedication_request	by search params	episode	search param {episode_id} from URL
medication_	dispense	by idIF context is encounter THEN:	episode	DB.allergymedication_intolerancesrequest.context._episode.managing_organizationid
medication_	dispense	by search params (Search Medication dispenses by Medication request ID)	episode	search param {episode_id} from URL
by id in episode context	episode_id from URL (path)
by search params in episode context	clinical_impressionmedication_request_request	by id	episode	DB.clinicalmedication_request_impressionrequest.context_episode_id
by search params	clinical_impressionmedication_request_request	search param {episode_id} from URL	episode
@rule_4 @read @episode @encounter @observation @condition @allergy_intolerance @immunization @risk_assessment @device @medication_statement @service_request @diagnostic_report @medication_administration Scenario: Doctor with active approval can read all the data of specified in approval patient Given Active approval on patient When I require read access Then I can read	not implemented yet
@rule_5 @read @episode @encounter @observation @condition @allergy_intolerance @immunization @risk_assessment @device@medication_statement @service_request @diagnostic_report @procedure @medication_administration @clinical_impression Scenario: Doctor with active approval can read all the data of specified in approval episodes Given Active approval on episode When I require read access Then I can read	Based on context episode	episode	by id	episode	There is an active approval on the episode granted to the employee (one of user's employee) in MongoDB	DB.episode.id
		encounter	by id			DB.encounter.episode
			by search params			search param {episode_id} from URL
			by id in episode context			episode_id from URL (path)
			by search params in episode context			episode_id from URL (path)
		observation	by id			DB.observation.episode
			by search params			search param {episode_id} from URL
			by id in episode context			episode_id from URL (path)
			by search params in episode context			episode_id from URL (path)
		condition	by id			DB.condition.episode
			by search params			search param {episode_id} from URL
			by id in episode context			episode_id from URL (path)
			by search params in episode context			episode_id from URL (path)
		service request	by id			DB.service_requset.encounter.episode
			by search params			search param {episode_id} from URL
			by id in episode context			episode context	episode_id from URL (path)
		diagnostic report	by id			DB.diagnostic_report.encounter.episode
		diagnostic report	by search params			search param {episode_id} from URL
		procedure	by id			DB.service_requsetprocedures.encounter.episode
		procedure	by search params			search param {episode_id} from URL
		clinical_impression	by id in episode context			DB.clinical_impression.episode
		clinical_impression	by search params			search param {episode_id} from URL (path)
		medication_request	by id	episode		DB.diagnosticmedication_reportrequest.encounter.context_episode_id
		medication_request	by search params	episode		search param {episode_id} from URL
		proceduremedication_dispense	by id	episode		DB.procedures.encounter.episodemedication_request.context_episode_id
		proceduremedication_dispense	by search paramsparam (Search Medication dispenses by Medication request ID)	episode		search param {episode_id} from URL
		clinicalmedication_request_impressionrequest	by id	episode		DB.clinicalmedication_request_impressionrequest.context_episode_id
		clinicalmedication_request_impressionrequest	by search params	episode		search param {episode_id} from URL
@rule_6 @read @diagnostic_report @encounter @procedure Scenario: Doctor can read entity originated by episode created in the doctors MSP Given Entity has been originated by mine MSP episode When I require read access Then I can read	Based on origin episode	encounter	by id	origin_episode	origin_episode.managing_organization==token.client_id	DB.encounter.origin_episode
		encounter	by search params			Search param {origin_episode_id} from URL
		diagnostic repost	by id			DB.diagnostic_report.origin_episode
		diagnostic repost	by search params			Search param {origin_episode_id} from URL
		procedures	by search params			DB.diagnostic_report.origin_episode
@rule_7 @read @observation Scenario: Doctor can read all the data of diagnostic report originated by episode created in the doctors MSP Given Diagnostic report context has been originated by mine MSP episode When I require read access Then I can read	Based on origin episode	observation	by id	diagnostic_report	origin_episode.managing_organization==token.client_id	DB.observation.diagnostic_report.origin_episode
	Based on origin episode	observation	by search params	diagnostic_report	origin_episode.managing_organization==token.client_id	Search param {diagnostic_report_id} from URL
@rule_8 @read @observation @condition @allergy_intolerance @immunization @risk_assessment @device @medication_statement @service_request @diagnostic_report @procedure @medication_administration @clinical_impression Scenario: Doctor can read all the data of encounter originated by episode created in the doctors MSP Given Encounter context has been originated by mine MSP episode When I require read access Then I can read	Based on origin episode	observation	by id	encounter	origin_episode.managing_organization==token.client_id	DB.observation.context.origin_episode
		observation	by search params			Search param {encounter_id} from URL
		condition	by id			DB.condition.context.origin_episode
		condition	by search params			Search param {encounter_id} from URL
		service request	by id			DB.service_request.encounter.origin_episode
		service request	by search params			Search param {encounter_id} from URL
		diagnostic_report	by id			DB.diagnostic_report.encounter.origin_episode
		diagnostic_report	by search params			Search param {encounter_id} from URL
		procedure	by id			DB.procedure.origin_episode
		procedure	by search params			Search param {encounter_id} from URL
		medication_request	by id	encounter		DB.diagnosticmedication_report.encounter.origin_episoderequest.context
		medication_request	by search paramsSearch param search params	encounter		search param {encounter_id} from URL
		proceduremedication_request_request	by id	encounter		DB.procedure.origin_episodemedication_request_request.context
		proceduremedication_request_request	by search paramsSearch param search params	encounter		search param {encounter_id} from URL
@rule_9 @read @encounter @observation @condition @service_request @diagnostic_report Scenario: Doctor with active approval can read data, originated by the episode Given Active approval on episode When I require read access Then I can read	not implemented yet
@rule_10 @read @observation Scenario: Doctor can read all the data of diagnostic report created in the doctors MSP Given Diagnostic report context has been originated by mine MSP When I require read access Then I can read	Based on diagnostic report	observation	by id	diagnostic_report	diagnostic_report.managing_organization==token.client_id	DB.observation.diagnostic_report.managing_organization
	Based on diagnostic report	observation	by search params	diagnostic_report	diagnostic_report.managing_organization==token.client_id	Search param {diagnostic_report_id} from URL
@rule_11 @read @observation Scenario: Doctor with active approval can read all the data of specified in approval diagnostic report Given Active approval on diagnostic report When I require read access Then I can read	Based on diagnostic report	observation	by id	diagnostic_report	There is an active approval on the diagnostic report granted to the employee (one of user's employee) in MongoDB	DB.observation.diagnostic_report
	Based on diagnostic report	observation	by search params	diagnostic_report		Search param {diagnostic_report_id} from URL
@rule_12 @read @care_plan @activity @medication_request @medication_request_request Scenario: Doctor with active approval can read the data associated with the care plan. Given Active approval on care_plan When I require read access Then I can read	Based on care plan	care_plan	by id	care_plan	There is an active approval (access_level=read) on the care_plan granted to the employee (one of user's employee) in MongoDB	DB.care_plan.id=approvals.granted_resources[].value
		activity	by id			care_plan_id from URL (path) DB.activities.care_plan[].id=approvals.granted_resources[].value
		activity	by search params
		medication_request_requests	by search params			care_plan_id from URL (path) DB.medication_request_requests.based_on.care_plan[].id=approvals.granted_resources[].value
		medication_requests	by search params			care_plan_id from URL (path) DB.medication_requests.based_on.care_plan[].id=approvals.granted_resources[].value.id=approvals.granted_resources[].value
		medication_dispense	by id	care_plan + patient_id		care_plan_id & patient_id from URL (path)
		medication_dispense	by search params (Search Medication dispenses by Medication request ID)	care_plan + patient_id		care_plan_id & patient_id from URL (path)
@rule_13 @write @care_plan @activity @medication_request @medication_request_request Scenario: Doctor with active approval can write the data associated with the care plan. Given Active approval on care_plan When I require write access Then I can write	Based on care plan	care_plan	by id	care_plan	There is an active approval (access_level=write) on the care_plan granted to the employee (one of user's employee) in MongoDB	DB.care_plan.id=approvals.granted_resources[].value
			complete
			cancel
		activity	by id			care_plan_id from URL (path) DB.activities.care_plan[].id=approvals.granted_resources[].value
			by search params
			create
			complete
			cancel
		medication_request_requests	by search params			care_plan_id from URL (path) DB.medication_request_requests.based_on.care_plan[].id=approvals.granted_resources[].value
		medication_requests	by search params			care_plan_id from URL (path) DB.medication_requests.based_on.care_plan[].id=approvals.granted_resources[].value
		medication_dispense	by id	care_plan + patient_id		care_plan_id & patient_id from URL (path)
		medication_dispense	by search params (Search Medication dispenses by Medication request ID)	care_plan + patient_id		care_plan_id & patient_id from URL (path)
@rule_14 @read @service_request @encounter @diagnostic_report @procedure @medication_dispense Scenario: User with active approval on the care plan can read the data based on this care plan. Given Entity based on care_plan And Active approval on care_plan When I require read access Then I can read	Based on care plan	service_request	by id	care_plan	There is an active approval (access_level=read/write) on the care_plan granted to the employee (one of user's employee) in MongoDB	DB.service_request.based_on.care_plan[].id=approvals.granted_resources[].value
		service_request	by search params			care_plan_id from URL (search param) DB.service_request.based_on.care_plan[].id=approvals.granted_resources[].value
		encounter	by id			care_plan_id from URL (search param) DB.based_on.service_requests.based_on.care_plan[].id=approvals.granted_resources[].value
		diagnostic_report	by id
		procedure	by id

...

Versions Compared

Old Version 2

New Version 3

Key