Hi all,
Thank you all for the very nice discussion. I find it a very interesting
one. I think it might be time for an 'interim score' (which is a Dutch
expression (tussenstand) to say that you make some sort of conclusion
halfway in the procedure to help further the proces).
1. 'Author Access Control' is the concept I believe we're talking
about (instead of Author Mandate).
This doesn't imply at all that a patient cannot request to see
the 'private' information. It is the author that must hand over
the info, so the author has the access control. Now, the
'architecture overview' document section 7 only / mostly(?) speaks
about patient access control.
2. I think that there's agreement on the desirability on having
author acces control modelled in the open EHR architecture. Arguments:
1. It's advisable to put all possible requirements in, even
when some countries have the policy not to accomandate for
private notes. Policies change. (see Dipak's contribution).
And allready it seems to be normal policy in Germany (as
Karsten pointed out).
2. Plus: private comments are part of the health care proces
(as many of you pointed out). Health care providers want to
make comments, or put in reminders that shouldn't be
disclosed to a patient instantly. These comments need to be
recorded too, connected to (or part of?) the patients record.
/And I think also in the EHR, because (as Gerard pointed
out) when a patient requests it these comments must be
shown. So they must be sharable. And some comments (like the
ones Shinji mentioned) want to be shared amongst healt
ptoviders. What other place should it be recorded than
within the EHR? [As I understand it, the EHR is the whole
complex of medical information, with the EPR being a subpart
of it. Is this correct?]
/
3. The question remains on how author access control should be
covered by openEHR.
1. There is an existing standard (EN 13606 Part 4) that is 'a
logical model to represent the domain of plausible access
policy decisions (rules)' (Dipak) and covers '95% of all use
cases' (Gerard). Are there any objections on using this
standard within openEHR?
2. What is the best way to handle access control? By creating
an Access Control Archetype or templates (as Gerard
suggests), or by modelling it as meta-data in the Reference
Model (as Ian suggests)?
/I think author comments should have a different status than
objective patient information. It seems better to provide
for this by adding an author controlled comment section
separately to the EPR part. This means that it would be
better to create archetyped meta-data in the RM, and not on
ENTRY level. Does this line of thinking make sense?
/
4. How to go from here?
1. The Architecture Overview chapter 7 treats access control
mainly as patient access control. (That's where ROLE comes
in.) We want a section speaking about author control, too?
2. Will openEHR pick our 'recommendations' up, or should we
make an official request?
3. Is there a committe that does the 'official' thinking, or
are we, as the community, doing that?
4. Would it be advisable to form some sort of working group,
getting other people (specialists) involved too? (like Ian's
contact).
I'm very much looking forward to your reactions!
Take care,
Josina
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.openehr.org/mailman/private/openehr-clinical_lists.openehr.org/attachments/20071218/e02f634d/attachment.html>
