Hi! We have two

HealthcareService

records that are used to group

Practitioner

’s by their

PractitionerRole

. Each

HealthcareService

has a different role within the company, one being a group of RNs, the other being a backend operations team. They should have separate

AccessPolicies

with different permissions defined. Is there a way to define an

AccessPolicy

that relates to a

Practitioner

only if they are a part of a

HealthcareService

? Today, I believe we are only able to associate an

AccessPolicy

via a

ProjectMembership

for a

User

,

Bot

, or

ClientApplication

. I believe what we want is possible by generating an

AccessPolicy

that has the required permissions for the

HealthcareService

but we would be required to attach it to each

User

record involved in the

HealthcareService

.

Are they all logging into the same application? You may consider making them each service their own front end associated with ClientApplication. This may also be more clear communication device as they are presumably need different resources but not different patients.

Yes, they will all be logging into the application with their own logins. Right now we have them all defined as Practitioners. Eventually, they will have differing patients, as we will have multiple offices across states. Right now, all practitioners can interact with all patients. Our application supports a few different roles and the UI adapts based on their role. For instance, the RNs will have access to x and y, while the Operations team will have access to x, y, and z. We assumed this could be achieved by looking up their roles and adapting the application in that way. I still believe this is the case. I'm not sure a

ClientApplication

would apply if we're attempting to keep individual practitioner records, right? It's important to us to know who did what in the HealthcareService.

Ah, ok , I'm describing this poorly, so let me take another swing at it. When you set up a new application that runs on a custom domain (e.g. mymedicalpractice.com) you can specify a ClientID (example: https://github.com/medplum/foomedical#account-setup). That ClientID belongs to a client application, to which you can attach an access policy, so everyone who logs into that app will have that access policy applied. This may be useful in this scenario!

Hi @taylorqj , unfortunately access policies don't allow for transitive connections right now (e.g.

Practioner

->

PractionerRole

->

HealthcareService

) , as it's not well supported by the FHIR spec. Your original inclination of setting removing the access policy when the practitioner is assigned / unassigned to the HealthcareService is probably the right move currently

Great! Thank you @rahul1