search

IHE / ITI.PCF

The Privacy Consent on FHIR (PCF) Profile provides support for patient privacy consents and access control where a FHIR API is used to access Document Sharing Health Information Exchanges. This profile includes both Consent profiling and access controls profiling of oAuth access token.
Creative Commons Attribution 4.0 International
2 stars 2 forks source link

PCF_21: Should Provenance be recommended or required? #21

Open JohnMoehrke opened 1 year ago

JohnMoehrke commented 1 year ago

ITI-108 includes requirements to record AuditEvents, using BALP pattern. This is considered sufficient to track inappropriate changes, and is referenced in the Security Considerations. Should there also be requirements to record Provenance on Create, Update, and Delete in addition to AuditEvent?

JohnMoehrke commented 1 year ago

Seems @mojitoj use-case for clarifying "update" might be a good justification for Provenance. But this is still not all that clear is a requirement. The current specification has examples, but no requirement to create them, and no use-case that uses them.