Access policy for patient data access
# supportt
thomabig
06/21/2024, 12:41 PMHello @rahul1 ,
So we went through the Github discussion again.
https://github.com/medplum/medplum/discussions/1453
Our use case looks a lot like 2.A / 2.B
From our understanding the "easiest" way of handling our use case is to have a Parametrized Access Policy for HCP that will take as parameter the Patient.
For each patient who wants to share their informations, we will use a bot to modify the projectmembership of a practitioner to add a new patientReference.
Our question is :
- What are the limits for the Parametrized Access Policy ? If a Practitioner has access to 10000 Patient, will that be an issue in terms of performance ? Is there a hard limit that we should be aware of ?
Thank you very much.
thomabig
06/25/2024, 3:04 PMHi @rahul1 , any idea here ?
r
rahul1
06/26/2024, 4:52 AMHI @thomabig , thanks for your patience! THere isn't a hard limit of Parameterized Access policies, but performance is a consideration. If you are dealing with 10000s, of patients, I might advise a single parameterized access policy as such
rahul1
06/26/2024, 4:53 AM Copy code
json
{
"resourceType": "AccessPolicy",
"name": "Physician Access Policy",
"resource": [
{
"resourceType": "Patient",
"criteria": "Patient?_id=%patientIds",
},
// ...
]
} Copy code
json
{
"resourceType": "ProjectMembership",
"access": [
{
"policy": { "reference": "AccessPolicy/abc", "display": "Physician Access Policy" },
"paramer": [
{ "name": "patientIds", "valueString": { "reference": "123,456,789" },
]
}
]
}rahul1
06/26/2024, 4:56 AMBased on the discussion here, it seemed liek you were using more of of an organization based model.
https://discord.com/channels/905144809105260605/1244620791253962782
We hear the concern about meta.account being a single field, and we do have an open issue about making this an array
https://github.com/medplum/medplum/issues/3668
154 Views