Help with configuring `AccessPolicy` for Admins, Bots, Patients, and Providers medplum #support

Help with configuring `AccessPolicy` for Admins, B...

alex_empallo

01/26/2025, 5:15 PM

Hi everyone, I'm currently working on configuring

AccessPolicy

resources in Medplum and need to create separate policies for admins, bots, patients, and providers. I came across this page (https://www.medplum.com/docs/access/access-policies), which has some short examples, but I'm wondering if there are any complete examples or additional guidance specifically for these four categories of users. Additionally, I'm wondering if there's a way to configure a patient’s

AccessPolicy

to allow them access to all resources that refer to themselves? Thank you!

rahul1

01/31/2025, 4:48 PM

Hi @alex_empallo , we do support the wildcard character

for the resourceType in an accesspolicy rule.

rahul1

01/31/2025, 4:48 PM

Would that help you achieve what you're looking for?

rahul1

01/31/2025, 4:59 PM

Wrt. the 4 categories; - Admins: This really means different things at different companies, so it's hard to give a 1-size fits all recommendation here. Generally, they can see patient resources, all clinical data, and maybe other resources like CareTeams and CarePlans. Other admin resources such as Organization and - Bots: There's no default recommendation here - Patients: Generally only allow access to resources in their compartment. Though there are exceptions (such as pediatics) - Providers: Similar guidance as admins

alex_empallo

01/31/2025, 6:59 PM

Hi @rahul1 , thanks for your message. That makes sense, I appreciate it. One follow-up question, if I may-- you mentioned restricting patients' access to resources within their compartments. How can I ensure that resources like

Observation

Condition

, etc. are under the patients' compartments, while resources like

Encounter

and

Task

are under practitioners' compartments?

183 Views

Previous Next