Hello we have support for a RelatedPerson care giver to logi medplum #general

Hello, we have support for a RelatedPerson (care-g...

mstark6428

02/27/2023, 2:25 PM

Hello, we have support for a RelatedPerson (care-giver) to login to our platform so they can see updated on a connected Patient. However, we are running into an access policy issue where the RelatedPerson is unable to update their profile due to it not being "found". Since the access policy has the patient compartment, it adds the search for that when trying to update the RelatedPerson record. Have you seen this before? Is it potentially an issue with how we created the RelatedPerson record?

rahul1

02/27/2023, 4:42 PM

hi @mstark6428 ! Would you be able to share your access policy that is applied to the RelatedPerson? That might help me understand the issue a bit deeper

mstark6428

02/27/2023, 5:15 PM

Copy code

{
    resourceType: "AccessPolicy",
    name: `RelatedPerson Access Policy - ${relatedPersonId}`,
    compartment: {
      reference: patientRef,
    },
    resource: [
      {
        resourceType: "Patient",
        compartment: {
          reference: patientRef,
        },
        readonly: true,
      },
      {
        resourceType: "RelatedPerson",
        compartment: {
          reference: `RelatedPerson/${relatedPersonId}`,
        },
      },
      {
        resourceType: "Observation",
        compartment: {
          reference: patientRef,
        },
        readonly: true,
      },
      {
        resourceType: "DiagnosticReport",
        compartment: {
          reference: patientRef,
        },
        readonly: true,
      },
      {
        resourceType: "MedicationRequest",
        compartment: {
          reference: patientRef,
        },
        readonly: true,
      },
      {
        resourceType: "Coverage",
        compartment: {
          reference: patientRef,
        },
        readonly: true,
      },
      {
        resourceType: "CarePlan",
        compartment: {
          reference: patientRef,
        },
        readonly: true,
      },
      {
        resourceType: "Immunization",
        compartment: {
          reference: patientRef,
        },
        readonly: true,
      },
      {
        resourceType: "Task",
        criteria: `Task?patient=${patientRef}`,
        readonly: true,
      },
    ],
  }

mstark6428

02/27/2023, 5:16 PM

This is the templated javascript version where we inject the Patient reference and RelatedPerson id.

mstark6428

02/27/2023, 5:18 PM

As well as setting the

patient

property on the RelatedPerson record.

mstark6428

02/28/2023, 2:11 PM

@rahul1 Have you had a chance to look over this yet?

rahul1

02/28/2023, 4:04 PM

Sorry for the delay @mstark6428

rahul1

02/28/2023, 4:06 PM

The issue is probably this block

Copy code

{
        resourceType: "RelatedPerson",
        compartment: {
          reference: `RelatedPerson/${relatedPersonId}`,
        },
      },

FHIR compartments have a very specific definition in FHIR, but right now we only support the Patient compartment in our server. However, we could try to add the RelatedPerson compartment, if you thought that was necessary

rahul1

02/28/2023, 4:07 PM

If you're goal is to just restrict the related person to seeing their own record, you could try to use a "criteria-based" access policy

rahul1

02/28/2023, 4:07 PM

https://www.medplum.com/docs/auth/access-control#criteria-based-access-control

rahul1

02/28/2023, 4:09 PM

Copy code

{
        resourceType: "RelatedPerson",
        criteria: `RelatedPerson?_id=${relatedPersonId}`,
      },

mstark6428

02/28/2023, 4:58 PM

Thanks for the response. I will give that a try.

mstark6428

02/28/2023, 6:07 PM

using criteria is working. Thank you!

183 Views

Previous Next