realm_access

List of process privileges, that is, what is the user allowed to do.

"realm_access": {

    "roles": [

       "Patient.read",

       "Patient.write"

    ]

  }

context

List of items that are set in context. context in combination with items in realm_access governs the access to all resources in the eHealth infrastructure.

"context": {

    "organization_id" : "https://fut.com/fhir/Organization/1",

    "care_team_id": https://fut.com/fhir/CareTeam/4,

    "episode_of_care_id": https://fut.com/fhir/EpisodeOfCare/10,

    "patient_id": "https://fut.com/fhir/Patient/8"

  }

user_id

Id of the user. Can be either an FHIR patient Id, FHIR practitioner Id or a KeyCloak ID

"user_id": " e03ccef7-b0b1-4f68-8e16-6fc2f865a922"

user_type

Can be either SYSTEM, PATIENT, PRACTITIONER or SSL

"user_type": "PATIENT"

Practitioner

create/update

required:

must match modifierRole.reference

PlanDefinition/ActivityDefinition creation or modifierRole changed → owner

All other updates → owner or co-author

System

-

-

-

Practitioner

required:

Must match EpisodeOfCare.id

required:

Must match EpisodeOfCare.team

System

-

-

Practitioner / Patient

-

System

-

Practitioner / Patient

required:

must match DocumentReference.custodian

System

-

Practitioner

must not be present

required:

must match EpisodeOfCare.Patient

required:

Must match EpisodeOfCare.team

The patient

must not be present

required:

must match EpisodeOfCare.Patient

-

System

-

-

-

Practitioner/Patient

required:

must match EpisodeOfCare

System

-

Practitioner

required:

must match EpisodeOfCare

required:

Must match EpisodeOfCare.team

Patient

required:

must match EpisodeOfCare

-

System

-

-

Practitioner

must not be present

optional but when present:

must match the Patient search parameter

required:

Must match CareTeam search parameter

Patient

must not be present

Always present:

must match the Patient search parameter

-

System

-

-

-

Practitioner

required:

must match Condition.episodeOfCare

required:

must match Condition.subject

-

Patient

required:

must match Condition.episodeOfCare

required:

must match Condition.subject

-

System

-

-

-

Practitioner

required:

must match Provenance.target

-

Patient

required:

must match Provenance.target

-

System

-

-

Practitioner

required:

must match the EpisodeOfCare search parameter (provenance.target)

-

Patient

required:

must match the EpisodeOfCare search parameter (provenance.target)

-

System

-

-

Practitioner

Required

Must match data.reference

Required

Must match data.patient

-

Patient

Required

Must match data.reference

Required

Must match data.patient

-

System

-

-

-

Practitioner

required:

must match the EpisodeOfCare search parameter (consent.data.reference)

-

Patient

required:

must match the EpisodeOfCare search parameter (consent.data.reference)

-

System

-

-

Practitioner

required:

must match CarePlan/ServiceRequest .episodeOfCare

required:

Careplan: Context must match CarePlan.careTeam or Careplan.episodeOfCare.team

ServiceRequest: Context must match CarePlan.careTeam or Careplan.episodeOfCare.team for the CarePlan that the ServiceRequest belongs to.

Patient

required:

must match CarePlan/ServiceRequest.episodeOfCare

-

System

-

-

Practitioner

required:

must match CarePlan/ServiceRequest.episodeOfCare

required:

Careplan: Context must match CarePlan.careTeam or CarePlan.episodeOfCare.team

ServiceRequest: Context must match CarePlan.careTeam or CarePlan.episodeOfCare.team for the CarePlan that the ServiceRequest belongs to.

Patient

required:

must match CarePlan/ServiceRequest.episodeOfCare

-

Only allowed if definition.topic is 'self-treatment' 

System

-

-

Practitioner

required:

must match CarePlan.episodeOfCare

required:

Must match CarePlan.careTeam

Careplan$update.responsibility permission required in token to update careteam element

Practitioner

optional but when present:

must match searchparam episodeOfCare

optional but when present:

must match searchparam theSubject

Only checked if EpisodeOfCare Context is not set.

required:

Must match search parameter CarePlan.careteam or CarePlan.episodeOfCare.team. (Only a single search parameter is allowed for this element)

Patient

optional but when present:

must match searchparam episodeOfCare

Always present and must match searchparam theSubject

Only checked if EpisodeOfCare Context is not set.

-

System

-

-

-

Practitioner

required:

Must match Goal.subject

required:

must match Goal.addresses.episodeOfCare

required:

must match Goal.addresses.episodeOfCare.team or Careplan.careteam for the CarePlan that the Goal.addresses ServiceRequest belongs to.

Patient

required:

Must match Goal.subject

-

-

System

-

-

-

Practitioner

-

required:

must match search param: addresses.episodeOfCare

required:

must match search param addresses.episodeOfCare.team or Careplan.careteam for the CarePlan that the addresses ServiceRequest belongs to.

Patient

required:

Must match search param addresses.subject

-

-

System

-

-

-

Practitioner

required

must match CommunicationRequest.episodeOfCare

required

must match CommunicationRequest.subject

required

must match CommunicationRequest.recipient if the recipient contains a careteam

Patient

optional but when present:

must match CommunicationRequest.episodeOfCare

required

must match CommunicationRequest.subject

-

Update: Only status

System

-

-

Practitioner

required if the searchparam recipient is a patient. 

optional otherwise.

must match searchparam CommunicationRequest.episodeOfCare when present

optional but when present:

must match searchparam CommunicationRequest.subject

required if searchparam recipient is a careteam

Patient

optional but when present

must match CommunicationRequest.episodeOfCare

Always present and must match searchparam CommunicationRequest.recipient

-

System

-

-

-

Practitioner

CommunicationRequest.episodeOfCare and EpisodeOfCare security token context must match.

If CommunicationRequest.episodeOfCare is null then the security token must not have an episodeOfCare context

required

must match CommunicationRequest.subject

required

must match CommunicationRequest.recipient if the recipient contains a careteam

Patient

optional but when present it must match CommunicationRequest.episodeOfCare

If CommunicationRequest.episodeOfCare is null then the security token must not have an episodeOfCare context

required

must match CommunicationRequest.subject

-

Update: Only status

System

-

-

Practitioner

If EpisodeOfCare context is present, then searchparam and context must match

If EpisodeOfCare context is not present, then the search parameter must include at least one of:

1. episodeOfCare:missing=true

2. recipient=<careteam> matching CareTeam context

optional but when present:

must match searchparam patient

required if the search param recipient is a careteam. The search param and careteam context must match.

Patient

optional but when present

must match searchparam: episodeOfCare

Always present and must match searchparam CommunicationRequest.recipient

-

System

-

-

-

Practitioner

required:

must match ClinicalImpression.episodeOfCare

required:

must match ClinicalImpression.subject

required:

must be in ClinicalImpressions.ehealth-careplan.careTeam or ClinicalImpressions.episodeOfCare.team

Patient

optional but when present:

must match ClinicalImpression.episodeOfCare

required when EOC context is not present:

must match ClinicalImpression.subject

-

System

-

-

-

Practitioner

optional but when present:

must match searchparam: episodeOfCare

optional

must match searchparam: subject

Only checked if EOC context is not present:

required:

Must match search param value in context.team or carePlan.careTeam

Patient

optional but when present:

must match searchparam: episodeOfCare

required when EpisodeOfCare Context is not present:

must match searchparam: subject

-

System

-

-

-

Practitioner

optional but when present:

must match Task.episodeOfCare

optional, but when present:

must match Task.episis odeOfCare.subject

CareTeam Context must match Task.responsible

User must have at least one corresponding restriction category privilege in Task.restriction-category.

UserID must match Task.responsible, Task.owner or Task.requester

Patient

optional but when present:

must match Task.episodeOfCare

required when EOC context is not present:

must match Task.episodeOfCare.subject

UserID must match Task.responsible, Task.owner or Task.requester

System

-

-

-

Practitioner

optional but when present:

must match searchparam episodeOfCare

optional

must match searchparam Context.subject

Only checked if EOC context is not present:

CareTeam Context must match searchparam responsible

Users must have all restriction category privileges corresponding to the list in searchparam restriction-category.

UserID must match searchparam: Responsible, Owner or Requester

Patient

optional but when present:

must match searchparam episodeOfCare

required when EpisodeOfCare Context is not present:

must match searchparam theContext.subject

UserID must match searchparam: Responsible, Owner or Requester

System

-

-

-

Practitioner

optional but when present:

must match communication.episodeOfCare

required if EpisodeOfCare context is not present:

must match communication.subject

Only checked if EpisodeOfCare Context is not present.

A match must be found either through the Careteam or the UserID

• Careteam: must match either communication.senderCareTeam or communication.recipientCareTeam

• UserID: must match communication.sender or communication.recipient

Patient

-

required:

must match communication.recipient or communication.sender

-

System

-

-

-

Practitioner

optional but when present:

must match communication.episodeOfCare

required if EpisodeOfCare context is not present:

must match communication.subject

A match must be found either through the Careteam or the UserID

• Careteam: must match either communication.senderCareTeam

• UserID: must match communication.sender

Patient

-

required:

must match communication.subject

-

communication.sender must match AuthToken.userId

System

-

-

-

Practitioner

required:

search param must match the context

-

A match must be found either through the Careteam or the UserID

• Careteam: must match either communication.senderCareTeam or communication.recipientCareTeam

• UserID: must match communication.sender or communication.recipient

Patient

-

required:

context must match the subject and either of sender or recipient search params

-

System

-

-

-

Practitioner

required:

must match observation.episodeOfCare

--

required:

If the CareTeam is assigned on the EpisodeOfCare:

• The user is granted access with no further checks when the EpisodeOfCare.team of the EpisodeOfCare Context contains the CareTeam in the CareTeam Context

If the Careteam is assigned to the CarePlan:

• Observation.basedOn must be a ServiceRequest which is referenced in CarePlan.activity.reference where the CarePlan.careTeam contains the CareTeam in the CareTeam Context

Patient

optional but when present:

must match observation.episodeOfCare

required when EOC context is not present:

must match observation.subject

Only checked if EpisodeOfCare Context is not present.

--

System

--

--

--

Practitioner

required:

search param must match the context

--

required:

If the CareTeam is assigned on the EpisodeOfCare:

• basedOn search parameter is not mandatory

If the Careteam is assigned to the CarePlan:

• basedOn search parameter is mandatory and must match the context

Patient

optional but when present:

search param must match the context

required when EOC context is not present:

search param must match the context

--

System

--

--

--

Practitioner

required:

must match questionnaireResponse.episodeOfCare

--

required:

If the CareTeam is assigned on the EpisodeOfCare:

• The user is granted access with no further checks when the EpisodeOfCare.team of the EpisodeOfCare Context contains the CareTeam in the CareTeam Context

If the Careteam is assigned to the CarePlan:

• QuestionnaireResponse.basedOn must be a ServiceRequest which is referenced in CarePlan.activity.reference where the CarePlan.careTeam contains the CareTeam in the CareTeam Context

Patient

optional but when present:

must match questionnaireResponse.episodeOfCare

required

must match questionnaireResponse.subject

--

System

--

--

--

Practitioner

required:

search param must match the context

--

required:

If the CareTeam is assigned on the EpisodeOfCare:

• basedOn search parameter is not mandatory

If the Careteam is assigned to the CarePlan:

• basedOn search parameter is mandatory and must match the context

Patient

optional but when present:

search param must match the context

required when EOC context is not present:

search param must match the context

--

System

--

--

--

Practitioner

required:

must match questionnaireResponse.episodeOfCare

required:

If the CareTeam is assigned on the EpisodeOfCare:

• The user is granted access with no further checks when the EpisodeOfCare.team of the EpisodeOfCare Context contains the CareTeam in the CareTeam Context

If the Careteam is assigned to the CarePlan:

• QuestionnaireResponse.basedOn must be a ServiceRequest which is referenced in CarePlan.activity.reference where the CarePlan.careTeam contains the CareTeam in the CareTeam Context

Patient

required

must match questionnaireResponse.episodeOfCare

--

System

--

--

Practitioner

required:

must match media.episodeOfCare

--

required:

If the CareTeam is assigned on the EpisodeOfCare:

• The user is granted access with no further checks when the EpisodeOfCare.team of the EpisodeOfCare Context contains the CareTeam in the CareTeam Context

If the Careteam is assigned to the CarePlan:

• Media.basedOn must be a ServiceRequest which is referenced in CarePlan.activity.reference where the CarePlan.careTeam contains the CareTeam in the CareTeam Context

Patient

optional but when present:

must match media.episodeOfCare

required when EOC context is not present:

must match media.subject

--

System

--

--

--

Practitioner

required:

search param must match the context

--

required:

If the CareTeam is assigned on the EpisodeOfCare:

• basedOn search parameter is not mandatory

If the Careteam is assigned to the CarePlan:

• basedOn search parameter is mandatory and must match the context

Patient

optional but when present:

search param must match the context

required when EOC context is not present:

search param must match the context

--

System

--

--

--

Practitioner

required

required

Patient

required

required

System

--

--

Practitioner

required:

search param must match the context

--

required:

If the CareTeam is assigned on the EpisodeOfCare:

• basedOn search parameter is not mandatory

If the Careteam is assigned to the CarePlan:

• basedOn search parameter is mandatory and must match the context

Patient

optional but when present:

search param must match the context

required when EOC context is not present:

search param must match the context

--

System

--

--

--

SSL supplier/Practitioner

required

must match the Device.owner organization

Optional but when present:

must match a DeviceUseStatement where:

• DeviceUseStatement subject = patient context

• DeviceUseStatement device references the device.

Patient

-

must match a DeviceUseStatement where:

• DeviceUseStatement subject = patient context

• DeviceUseStatement device references the device.

System

-

SSL supplier/Practitioner

Optional but when present:

must match a DeviceUseStatement where:

• DeviceUseStatement subject = patient context

• DeviceUseStatement device references the device.

Required if patient context is not present.

Must match the device.owner 

Patient

must match a DeviceUseStatement where:

• DeviceUseStatement subject = patient context

• DeviceUseStatement device references the device.

-

System

-

SSL supplier/Practitioner

required

must match DeviceUseStatement.subject

required

must match the Device.owner organization

System

-

-

SSL supplier/Practitioner

required

must match DeviceUseStatement.subject

-

Patient

must match a DeviceUseStatement.subject

-

System

-

-

SSL supplier/Practitioner

required

must match the Device.owner organization when the non-privately owned device

-

Patient (Must be privately owned device)

-

must match a DeviceUseStatement where:

• DeviceUseStatement subject = patient context

• DeviceUseStatement device references the device

or have no related DeviceUseStatement.

System

-

-

SSL supplier/Practitioner

required

must match the Device.owner organization when the non-privately owned device

Optional but when present:

must match a DeviceUseStatement where:

• DeviceUseStatement subject = patient context

• DeviceUseStatematch device references the device.

or have no related DeviceUseStatement.

Patient

-

must match a DeviceUseStatement where:

• DeviceUseStatement subject = patient context

• DeviceUseStatement device references the device

or has no related DeviceUseStatement.

The device must be privately owned.

System

-

SSL supplier/Practitioner

required

must match the Device.owner organization when the non-privately owned device

required

must match DeviceUseStatement.subject

Patient

-

required. The DeviceUseStatement must have:

• DeviceUseStatement subject = patient context

• DeviceUseStatement device references the device

The device must be privately owned.

System

-

SSL supplier/Practitioner

-

required

must match DeviceUseStatement.subject

Patient

-

required

must match DeviceUseStatement.subject

System

-

-

SSL supplier/Practitioner

-

required

patient search param must match the context

Patient

-

required

patient search param must match the context

System

-

-

Practitioner / Patient

create

required:

must match Questionnaire.modifierRole.reference

-

owner

update

required:

must match Questionnaire.modifierRole.reference

Questionnaire.modifierRole

owner

Not Questionnaire.modifierRole

owner or co-author

delete

required:

must match Questionnaire.modifierRole.reference

-

owner

read/search

-

-

-

System

-

-

-

-

Practitioner / Patient

create

required:

must match Actionguidance.modifierRole.reference

-

owner

update

required:

must match Actionguidance.modifierRole.reference

Actionguidance.modifierRole

owner

Not Actionguidance.modifierRole

owner or co-author

read/search

-

Note:

There are two ways to be able to search. First, if permission for both Actionguidance and view is present, it will give access.

Secondly, to search, an actionguidance permission should be present, and the resource should be supplied as part of the profile search or as the search field code. All other cases will be rejected.

Values to supply for a profile search

profile=http://ehealth.sundhed.dk/fhir/StructureDefinition/ehealth-actionguidance

Values to supply for a code search

code=http://ehealth.sundhed.dk/cs/basic-resource-type|actionguidance

-

-

System

-

-

-

-

Practitioner / Patient

create

required:

must match View.modifierRole.reference

-

owner

update

required:

must match View.modifierRole.reference

View.modifierRole

owner

Not View.modifierRole

owner or co-author

read/search

-

Note:

There are two ways to be able to search. First, if permission for both View and view is present, it will give access.

Secondly, to search, a View permission should be present, and the resource should be supplied as part of the profile search or as the search field code. All other cases will be rejected.

Values to supply for a profile search

profile=http://ehealth.sundhed.dk/fhir/StructureDefinition/ehealth-view

Values to supply for a code search

code=http://ehealth.sundhed.dk/cs/basic-resource-type|view

-

-

System

-

-

-

-

Practitioner

required:

must match either Observation.episodeOfCare

or QuestionnaireResponse.episodeOfCare

required:

must match either Observation.subject

or QuestionnaireResponse.subject

-

Patient

required:

must match either Observation.episodeOfCare

or QuestionnaireResponse.episodeOfCare

required:

must match either Observation.subject

or QuestionnaireResponse.subject

-

System

-

-

-

SSL supplier

required:
must resolve to and match the Catalogue.seller party

Practitioner

-

System

-

SSL supplier

required:
must resolve to and match the CatalogueItem.Catalogue.seller party

Practitioner

-

System

-

SSL supplier

required:
must resolve to and match the CatalogueItem.Catalogue.seller party

Practitioner

required:
must resolve to and match WhiteList.buyer party, only returns CatalogueItems referred by WhiteLists

System

-

SSL supplier

required:
must resolve to and match the Annotation.CatalogueItem.Catalogue seller party

Practitioner

-

System

-

SSL supplier

- (no access)

Practitioner

required:
must resolve to and match the WhiteList.buyer party

System

-

SSL supplier

- (no access)

Practitioner

required:
must match the BlackList.patient

System

-

SSL supplier

required:
must resolve and match the Problem.CatalogueItem.Catalogue seller party

Practitioner

- (no access)

System

-

SSL supplier

required:
must resolve and match the Problem.CatalogueItem.Catalogue seller party

Practitioner

required:
must resolve to and match WhiteList.buyer party, only returns Problems with CatalogueItems referred by WhiteLists

System

-

SSL supplier

- (no access)

Practitioner

required:

must resolve to and match the Package.buyer party

System

-

SSL supplier

required:
must resolve to and match the Order.seller party

required:
used for reading CarePlan, see CarePlan resource for context rules

required:
used for reading CarePlan, see CarePlan resource for context rules

Practitioner

required:
must resolve to and match the Order.buyer party

required:
used for reading CarePlan, see CarePlan resource for context rules

required:
used for reading CarePlan, see CarePlan resource for context rules

System

-

-

-

SSL supplier

required:
must resolve to and match the Order.seller party

Practitioner

required:
must resolve to and match the Order.buyer party

System

-

SSL supplier

required:
must resolve to and match the OrderLine.Order.seller party

Practitioner

required:
must resolve to and match the OrderLine.Order.buyer party

System

-

SSL supplier

required:
must resolve to and match the Contract.seller party

Practitioner

-

System

-

SSL supplier

required:
must resolve to and match the Contract.seller party

Practitioner

-

System

-

SSL supplier

-

Practitioner

-

System

-

SSL supplier

required:
must match the organization parameter

Practitioner

required:
must match the organization parameter

System

-

Practitioner

required

Must match input parameter: ManagingOrganization

Only the user that called schedule is allowed to read the resulting /fhir/Binary/id

The privilege Report.non-anonymized is required if input parameter: anonymization == false

System-user

System users can't have an organization context

Only the user that called schedule is allowed to read the resulting /fhir/Binary/id

The privilege Report.non-anonymized is required if input parameter: anonymization == false

Patient.read

REGULAR SEARCH:

To perform a regular Patient Search, the user MUST have the Patient Context.

LIMITED SEARCH (Dashboard Search):

It is also possible to perform a patient search with a CareTeam Context instead of a Patient Context. In that case, the patients are then retrieved from EpisodesOfCare and CarePlan objects that the CareTeam is involved in.

NOTE: The patient resources that are returned from this search are limited and as such only the following information is returned:

• Identifier

• Date of Birth

• Gender

• Cpr

• Deceased status

• Home address

• Official name

*R - THE CONTEXTS ARE MUTUALLY EXCLUSIVE, AS SUCH IF BOTH CONTEXTS ARE PROVIDED IN THE TOKEN, ONLY THE PATIENT CONTEXT IS USED.

Patient.write

1: FHIR operations "create" and "update" are not available on the Patient resource. 
(use $createPatient and "patch")

2: Only certain attributes are allowed to be patched using HTTP PATCH

Patient$updatePatientWithSKRSData

Patient$createPatient

Appointment.read

For non-group appointments:

1: If an appointment involves a patient, then that patient must be in context

2: The appointment can be read if

• the user has a Care Team in context that is participating in the appointment

• the user is participating in the appointment (as a Practitioner or Patient)

3: Searching

• PATIENT users can search all Appointments that involve the user itself

• PRACTITIONER/SSL users can search all Appointments that involve the user itself, or the Organization/CareTeam/Patient in context

Appointment.write

For non-group appointments:

1: If an appointment involves a patient, then that patient must be in context

2: The appointment can be written if

• the user has a Care Team in context that is participating in the appointment

• the user is participating in the appointment (as a Practitioner or Patient)

Appointment$exportAsiCal

The same rules apply to reading appointments

Note: Only PRACTITIONER/SSL users can see the names of Practitioner participants in the exported iCal object

RelatedPerson.read

Only related persons to the patient in context can be read

RelatedPerson.write

Only related persons to the patient in context can be written

Communication.read

If the message has a restriction category X, the corresponding RestrictionCategory.X role must be present in the realm_access list.

1: PATIENT users can read

• communication where they are either the sender or recipient

2: PRACTITIONER and SSL users can read 

• communication where they are either the sender or recipient

• communication where the CareTeam in context is the sender or recipient

3: Only SYSTEM users can read communication from DEVICE senders

Communication.write

1: Communication must have exactly one sender and one recipient

2: Communication with the category "note" can only be created/patched/deleted if user = sender and (recipient = sender or recipient = a CareTeam). 
(notes can be shared with any CareTeam)

3: PATIENT users 

• can only create/delete "mesHTTP" communication where they are the sender, and the recipient is of type CareTeam

• can only patch "message" communication where they are sender or recipient (the recipient can patch "received" property)

4: PRACTITIONER and SSL users 

• can only create/delete "message" communication where the sender is the CareTeam in context and the recipient is of type PATIENT or type CareTeam

• can only patch "message" communication where the CareTeam in context is the sender or recipient

Person$match

Only requires the role “Person$match”

Used to lookup person data by CPR, including name and a patient reference, if one exists.

This is only a read operation and will not create any resources.

The operations are audit logged.