Hi all, When I submit a QuestionnaireResponse as a Patient from the medplum UI, the Patient reference does not get added to the

meta.compartment[]

, only the Project reference. Is there any way to add this automatically when a form is submitted from the UI so policies work? 1) New self hosted install 2) Create project-scoped admin Practitioner 3) Login as project-scoped admin Practitioner and create a Questionnaire 4) Invite project-scoped Patient to project 5) On separate browser session, login as the project-scoped Patient 6) Go to /forms/ and submit 7) Back to the project-scoped admin Practitioner window, view the QuestionnaireResponse (see below) I added

Patient

to the

subjectType

in the Questionnaire - are there any other tricks to automatically get the Patient reference into the compartment? Any help would be great Thanks Simon QuestionnaireResponse

{
  "resourceType": "QuestionnaireResponse",
  "questionnaire": "Questionnaire/d99c3d16-9c94-4c9a-8d39-3710bf583630",
  "item": [
    {
      "id": "id-1",
      "linkId": "q1",
      "text": "Question",
      "answer": [
        {
          "valueString": "two"
        }
      ]
    }
  ],
  "status": "completed",
  "source": {
    "reference": "Patient/5c4b6c0d-78d6-4220-9430-6e9c639f01e0",
    "display": "TestWed TestWed"
  },
  "authored": "2025-10-01T15:58:35.570Z",
  "id": "8171e329-73c0-43cd-b2bc-d464d1436e47",
  "meta": {
    "versionId": "77e175c4-2d0c-4b1e-92dc-f1b0c5825a99",
    "lastUpdated": "2025-10-01T15:58:35.583Z",
    "author": {
      "reference": "Patient/5c4b6c0d-78d6-4220-9430-6e9c639f01e0",
      "display": "TestWed TestWed"
    },
    "project": "e0f70381-14a0-40c2-b6de-3918c9fc3d90",
    "compartment": [
      {
        "reference": "Project/e0f70381-14a0-40c2-b6de-3918c9fc3d90"
      }
    ]
  }
}

Hi @simonj ! You will have to [set the

subject

or

author

field of the QuestionnaireResponse](https://build.fhir.org/compartmentdefinition-patient.html) in order for the patient compartment to be set properly. Our app.medplum.com QuestionnaireForm implementation does not propagate these automatically; however, the QuestionnaireForm does include the subject and author as props, so you could implement your own QuestionnaireForm UI that automatically populates these fields. Alternatively, you can also use bots running on subscriptions to populate these fields on submission, or use some kind of client-side onSubmit handler to do so

<QuestionnaireForm
  questionnaire={questionnaire}
  subject={{ reference: `Patient/${patientId}` }}
  onSubmit={(qr) =>
    medplum.createResource({
      ...qr,
      author: createReference(medplum.getProfile()!),
    })
  }
/>

Hey @Maddy thanks for your help and the example - that all makes sense and is great to know! Taking another tack, I tried instead adding the source to my access policy criteria as below 👇 - is that an OK approach?

{
      "resourceType": "Patient",
      "criteria": "Patient?_compartment=%patient"
    },
    {
      "resourceType": "Questionnaire",
      "readonly": true
    },
    {
      "resourceType": "QuestionnaireResponse",
      "criteria": "QuestionnaireResponse?source=%patient"
    },

And one more related question if you have a moment: For criteria queries in the docs it says Chained searches are not allowed. https://www.medplum.com/docs/access/access-policies#criteria-based-access-control But this appears to work (ie provide access to all sub org practitioners)

{
      "resourceType": "Practitioner",
      "criteria": "Practitioner?_has:PractitionerRole:practitioner:organization=%root_organization"
    },
    {
      "resourceType": "Practitioner",
      "criteria": "Practitioner?_has:PractitionerRole:practitioner:organization.partof:below=%root_organization"
    },

Is this bad practice ☝️ ? should I instead have a line for every single sub org? Thanks!

Ah I see, is the compartment just used to help determine if a patient should have access to it or not? If so, your filter on the AccessPolicy itself is very reasonable

Yep exactly! Just so a Patient can only access their own QuestionnaireResponses. OK great thanks!

@simonj as for your second question, chained searching is technically not allowed (there's a code path that won't follow the chain in the search). Is there a chance you could share the practitioner resources you are filtering on?

Thanks @Maddy - right gotcha! So this came about because we tried to follow these instructions here: https://www.medplum.com/docs/access/multi-tenant-access-policy#1-create-the-access-policy

{
            "resourceType": "Practitioner",
            "criteria": "Practitioner?organization=%current_organization"
        },

But we got an error "Unknown search parameter: organization". So we added chaining to

PractitionerRole:practitioner:organization=%current_organization

instead which worked with the Practioner below.

{
  "resourceType": "Practitioner",
  "meta": {
    "project": "f6f0a5ac-f02e-426d-bd1c-3c78cd5d24f8",
    "versionId": "be76f502-cdb2-4b04-936e-bd8f9a648b15",
    "lastUpdated": "2025-10-03T15:07:21.063Z",
    "author": {
      "reference": "system"
    },
    "compartment": [
      {
        "reference": "Project/f6f0a5ac-f02e-426d-bd1c-3c78cd5d24f8"
      }
    ]
  },
  "name": [
    {
      "given": [
        "CardiologyPrac"
      ],
      "family": "CardiologyPrac"
    }
  ],
  "telecom": [
    {
      "system": "email",
      "use": "work",
      "value": "cardiology-prac@example.com"
    }
  ],
  "id": "ef565021-4575-4024-bac4-7f794d423049"
}

What's the best criteria query to restrict Practitioner resource access to an Organization? Do we need to add the org IDs to meta.accounts?