Is it possible to create an access policy for a

Practitioner

to (for example) only have access to the

MedicationRequests

from `Patient`s in a particular

Organization

? For some background, we have a patient site, provider site, and patient mobile app that will have multiple health systems but each health system should only have access to their own patients. Can we separate them using

Organization

or does it have to be `Project`s? If only projects, how difficult is it to move a patient from one project to another?

This should be directional https://www.medplum.com/docs/auth/access-control#healthcare-partnerships - you'll need to provide the Patient resource too I'd imagine though

So when a patient creates a

MedicationRequest

, organization is set in the metadata. So move a patient to a different organization would require many updates across all their data? And in the example, the Practitioner would be associated with the

Patient Example

access policy and we could have only resource types with the same compartment?

Yeah, that's right, moving their data would require updates across all their data. Moving data between orgs is intended to be explicit vs implicit. This policy sample is based on compartments and would only have access to resource types within that compartment: https://www.medplum.com/docs/auth/access-control#healthcare-partnerships

Your three bullet points are correct. I setup basic access like the example you provided but from the practitioner side, I don't see any results from the API. I also don't see how it will work to add MedicationRequest, Task, etc to that practitioner access policy

Hi @mstark6428 , would it be possible to share your AP? Feel free to DM me if that's easier