FHIR Chat · Ownership of patient data/resources · implementers

Stream: implementers

Topic: Ownership of patient data/resources


view this post on Zulip Rebecka Hansson (Dec 09 2021 at 07:43):

Hello! In a Swedish context we need to be able to present the owner of the data included in FHIR resources. The owner is defined to be a Care provider (lv1) and a care unit (lvl 2), which could for example be a region within Sweden and then a medical responsible unit at a hospital. A typical scenario is that a consumer who retrieves an Observation resource, also need to get information about the owner lvl1 and 2.
We have considered the following alternatives:

  1. Use one or two extensions directly from Observation resource.
  2. Use extensions within the referenced performer Organization. A consumer would then need to include/look up this Organization to know more about the information owner of the Observation.

Since this is needed to support swedish law, it is something that most of the cases always needs to be included in one way or the other. It means that for alternative 1, we would need to include this extension for almost all profiles (not only Observations) that carry patient data.

My question is: Is there another way, in FHIR, to represent ownership of resources similar to this?

view this post on Zulip René Spronk (Dec 09 2021 at 07:51):

If there are any resources created by organization X, where the 'ownership' is a different organization Y, the option 2 won't work. This could potentially happen (?) if things are outsources from one organization to another one, or organization X updating a data item originally created by organization Y.

Option 1 sounds the least attractive option to me. Option 2 is slightly better. Have you looked at Provenance ? Depending on the Swedish legal definition of 'ownership' this may well fit your requirement. It has the advantage that a Provenance may reference multiple resources.

Could describe 'ownership' (what does that mean in your context) without using the word 'owner'?

view this post on Zulip René Spronk (Dec 09 2021 at 07:52):

Is this in any way tied in to the GDPR (EU privavcy law) legislation as adopted in Sweden ?

view this post on Zulip Grahame Grieve (Dec 09 2021 at 08:03):

this does sound like provenance

view this post on Zulip John Moehrke (Dec 09 2021 at 13:42):

This seems to be very much like the Provenance profile that US-Core created for "Basic Provenance" -- https://www.hl7.org/fhir/us/core/basic-provenance.html


Last updated: Apr 12 2022 at 19:14 UTC