Is there a way to handle the following provider permissions: > The provider should only be able to see patients that are assigned to them (in a provider portal)

Hi Kevin, This is probably we should work through together. There can be a lot of nuances with access policies. In general, the relevant examples are HealthCare partnerships (https://www.medplum.com/docs/tutorials/security/access-control#healthcare-partnerships) and Patient Access (https://www.medplum.com/docs/tutorials/security/access-control#patient-access) The main mechanism to enforce this is Compartments, which are enforced by the

meta.account

field on every resource.

"compartment": {
    "reference": "Organization/a23a2966-d58a-4098-b41b-e8f18bcda339",
    "display": "Example Customer Organization"
  },

This

compartment

property in the access policy says that every resource created by this user has their

meta.account

set to include "Example Customer Organization"

"resource": [
    {
      "resourceType": "Patient",
      "readonly": true,
      "compartment": {
        "reference": "Organization/a23a2966-d58a-4098-b41b-e8f18bcda339",
        "display": "Example Customer Organization"
      }
    }
  ]

This line says that the user can only access Patients whose

meta.account

field (aka the "compartment") includes "Example Customer Organization"

Ah, yes > A common need is to grant access to a subset of resources for a healthcare partnership. For example, a lab provider may want to grant access to all patient records that originated from a specific lab customer this is what I needed, thanks!