Accounts vs Compartments
# support
n
Hey medplum team- we had a question about what's the proper way to handle compartments in the current version of medplum (v4.1.5 as of writing). We recently aborted an upgrade from v3.2.24 -> v4.1.4 after discovering the removal of [user defined compartments](https://github.com/medplum/medplum/issues/5124). We have a use where we would add an
Organization
compartment on a
Task
resource so that it could be used as a filter in a graphql query. It appears that was removed in [4.0.4](https://github.com/medplum/medplum/pull/6145) in favor of using the
meta.accounts
key to apply arbitrary compartments wherever the [patient compartment](https://hl7.org/fhir/R4/compartmentdefinition-patient.html) is also applied. Since `Task`s don't have an inclusion criteria for the patient compartment, is there a recommended way to achieve the same functionality? If I recall correctly, we had at one time used
_tag
as a filter for graphql queries but noticed relatively slow performance. Memory of that is a bit hazy though.
f
Hey @nathan-watkins-unityai , good question! The desired behavior of compartments and accounts is something we are actively working on and trying to make more clear, so it is interesting to hear your approach. Let me try to answer parts of this one at a time. "we had at one time used _tag as a filter for graphql queries but noticed relatively slow performance. Memory of that is a bit hazy though" [Here](https://www.medplum.com/docs/search/advanced-search-parameters#_tag) are some docs about the _tag search param. One solution could be to just add the Organization as a tag, and then you could filter as intended. It will be less performant than _compartment because _tag searching over any type of text where _compartment is searching over ids (resource references). The current behavior of writing to the meta.compartment of a Task resource would be to just specify the references that you want in the meta.accounts when updating that resource. ex.
R4/Task/123
PUT
Copy code
{
  "resourceType": "Task",
  "status": "accepted",
  "intent": "unknown",
  "id": "123",
  "meta": {
    "project": "123",
    "compartment": [
      {
        "reference": "Project/123"
      }
    ],
    "accounts": [
      {
        "reference": "Organization/123"
      }
    ],
//...
}
and then that Organization will be added to meta.compartment Please let me know if I am wrong here, but I assume that the ideal behavior for you would be for you to add the Organization to the compartment of the Patient, and then it automatically updates all the compartment of the resources in the [patient compartment ](https://hl7.org/fhir/R4/compartmentdefinition-patient.html). Then, you could manage the compartments for all the other resources by just updating the Patient, and your queries would all look the same:
Copy code
await medplum.searchResources('<ResourceType>', {
  _compartment: 'Organization/<your-org-id>',
});
This is currently achievable for all the resources in the Patient's compartment definition using the patient [$set-accounts](https://www.medplum.com/docs/api/fhir/operations/patient-set-accounts) operation. As you noted, unfortunately, the Task resource is not in the Patient compartment definition. Interestingly, it did get included in the [Patient R5 CompartmentDefinition](https://hl7.org/fhir/R5/compartmentdefinition-patient.html), so this must be a use case that others have come across. In the future, this is something we could add to the automatic propagation.
n
Thank you for the thorough response! This helps us significantly on how to approach this. Your assumption is correct on what we would view as the ideal behavior. One last point of clarification- does the
$set-accounts
operation always have to be called to propagate a patient's accounts -> compartments? Or is that for retroactively applying them? In other words, if the
Patient.accounts
is populated with an
Organization
reference (for example), do subsequently created resources within the compartment definition automatically add it to the compartments or only after the
$set-accounts
operation is run?
f
"do subsequently created resources within the compartment definition automatically add it to the compartments or only after the $set-accounts operation is run?" On new resource creations within the compartment , yes they are automatically applied. No need to call $set-accounts (Ex. creating a DiagnosticReport that's subject field points to a patient. The DiagnosticReport.meta.accounts will be automatically inherited from the Patient.meta.accounts For updates, this is where most of the confusion comes from, and please note, this behavior may change very soon. If you are updating a resource in the Patient's compartment as an admin, and do not specify the meta field, it will inherit the meta.accounts, but if you do specify the meta field, then it will overwrite them. This is why we suggest the $set-accounts when you need to change something in the meta.accounts of a resource within the Patient's compartment.
For a reference implementation on how to use this concept, I wrote a blog post [here](https://www.medplum.com/blog/multi-tenant-mso#organizationally-contained-access-restrictions) that shows how you can add an Organization to a Patient's meta.compartment and propagate it to the rest of the resources in it's compartment definition.
And there is an example app [here](https://github.com/medplum/medplum-mso-demo) as well that makes use of it
156 Views