We run a self hosted version of Medplum, currently on Version 5.1.0. For our usecase we require that Patients can login and send data to the fhir server. Patients are invited by a project admin via the Admin interface. According to documentation it should be possible to set a default access policy for patients in the project. I created an access policy that allows patients to only see resources in their own compartment. When i invite a new Patient this access policy is not applied in the ProjectMembership. When the patient logs in he can see all other patients data which is not ideal. When i manually apply the access policy to the projectmembership of the patient it works as expected. A possible workaround for us would be to setup a bot that applies access policies to newly created projectmemberships. This is not ideal because it does not restrict access by default. This raises a few questions for me: 1) Why is the default access policy never applied? Is this a bug? 2) Why is it possible for a patient with no access policy, to see data of other patients? This seems like a design flaw, a patient should never be able to see other patients data, unless it is specifically granted to them. 3) Why is it not possible to restrict access to all resources to non admin users by default unless an access policy grants them access. In my eyes this would provide more data security if needed.

Hello there! You'll need to set the patient access policy as the default on your project settings in order to get those to propagate https://www.medplum.com/docs/user-management/open-patient-registration

Thanks for the answer, Sadly this is part of my problem. I already set the patient access policy as the default in the project settings but it does not automatically get applied to newly invited patients.

Hey there! Thanks for bringing this to our attention. This is a gap we'll need to fix on our end -- I've filed the issue here: https://github.com/medplum/medplum/issues/8843. Current state is that the default patient access policy applies only when patients sign up via the open patient registration flow, not when they're invited via the admin interface. Invites through the admin interface only get an access policy applied if one is explicitly set on the invite (or added on ProjectMembership afterward), which is why all your invited patients had full access.

Just adding my 👍 to needing this. Its a bit of a foot gun and can leave people without the expected access controls