FHIR & access control, deep dive into consent services
summary
Shows a concrete HAPI FHIR implementation that enforces patient-level consent by registering an IConsentService implementation with a Consent Interceptor registered to the server, then filtering GETs. Uses the R4 Consent resource with a base deny and two permit provisions (Jan and Mar) to block one February Encounter; demo posts three Encounters and returns only January and March. No special error when filtering, and performance cost depends on where hooks run.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:46Overview of authorization
- 1:50OAuth 2 and SMART on FHIR
- 3:37Consent-based access control
- 5:52Consent resource structure
- 8:46Consent interceptor hooks
- 11:41Use case walkthrough
- 16:34Live demo setup
- 19:08Testing consent enforcement
- 21:23Business rule separation
- 22:25Happy FHIR registration
- 23:27Q&A session
related talks
22mEnforcing consent directives on FHIR
23mCreating and managing Consent Directives on FHIR
45mApisecure, 14 & 15 March 2023 - John Moehrke, Co-Chair at Security Working Group.
52mIntroduction to the FHIR API
02h 01mLet's Build a FHIR App: Introduction HAPI Library for FHIR
01h 04mApisecure, 14 & 15 March 2023 - Grahame Grieve, Principal at Health Intersections Pty Ltd.
43mConsent Based Access Control and Healthcare Data
43mGlobal Implementations with the International Patient Access