Is there a possibility for manual review so that sensitive data is not shared?

XMLWordPrintableJSON

    • Type: Change Request
    • Resolution: Persuasive with Modification
    • Priority: Highest
    • US Da Vinci Alerts (FHIR)
    • 0.2.0 [deprecated]
    • Infrastructure & Messaging
    • Home (index)
    • 2.1.4
    • Hide

      Based on ballot comments, will NOT document how to transmit endpoint data to Receiver.

      RE: is there any human review/intervention before additional information is sent?

      We will be updating this IG to reference US Core for provider access to data which details the security ( OAuth 2.0 ) protocols. Therefore the requester will have been granted the scopes by the data source based upon individual organization's business rules.

      re: manual review...

      Both IGs are silent on human review as these are an implementation details outside the scope of these guide and in general these transactions are intended to to be automated.

      Will add text to triggering discussion in the assumption: Considerations for sensitive data when triggering a Notification need to be taken into account as well and hence all events may not trigger a notification.

      Show
      Based on ballot comments, will NOT document how to transmit endpoint data to Receiver. RE: is there any human review/intervention before additional information is sent? We will be updating this IG to reference US Core for provider access to data which details the security ( OAuth 2.0 ) protocols. Therefore the requester will have been granted the scopes by the data source based upon individual organization's business rules. re: manual review... Both IGs are silent on human review as these are an implementation details outside the scope of these guide and in general these transactions are intended to to be automated. Will add text to triggering discussion in the assumption: Considerations for sensitive data when triggering a Notification need to be taken into account as well and hence all events may not trigger a notification.
    • Eric Haas/Paul Knapp: 3-0-1
    • Clarification
    • Non-substantive

      The AMA finds this could be somewhat concerning – is there any human review/intervention before additional information is sent? And is there the possibility to manually review what notifications are pushed (or at least to understand what notifications a system will automatically send and set parameters for what can be done without human review)? There need to be adequate protections to ensure that sensitive data are not inappropriately shared.

      Existing Wording:

      We are actively seeking input input on whether or not to document how to transmit endpoint data intended only for the immediate recipient (which may be the final recipient or an intermediary) recipient of the operation and to provides the recipient with the technical details for getting additional information from the medical record for the alert - Note that this has serious security implications as it may contain sensitive access information .

            Assignee:
            Unassigned
            Reporter:
            Celine Lefebvre
            Celine Lefebvre
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: