Medical Use Cases Based on

1. Medical Use Cases Based on • HL7 Clinical Document Architecture (an ANSII standard) based on XML • Medical considerations • Legislation and Executive Branch rules regarding privacy (HIPAA)

2. HL7 CDA Form • Header – administrative information • Body – clinical record

3. Ms AXS & her abusive ex • Don’t let him know my contact info a) She gets help with tendonitis from a physical therapist • Therapist gets record; the restrictions follow b) Billing info goes to outside payer • Restrictions are transmitted with info (even when the info leaves the originator, the restrictions persist)

4. Patient grants only primary care physician access to psych notes • Primary care physician grants overall record access to a covering doctor or practice, but blocks access to the psych notes.

5. Patient restricts access to HIV test results • The patient arrives at the emergency room with a severe trauma. The restrictions are overridden to provide the best treatment.

6. Patient is a care giver in a medical system • For the whole record, the patient grants access only to the primary care giver. • If billing is done in house, the billing staff is granted access to the record of services and charges.

7. Summary of Requirements • ACLs + selectors yielding fine grained access control • Persistence of access semantics over organizational boundaries • Override mechanism(s) such as “super user” • Ability to change access over time and context