FHIR IG analytics

Resources that use this resource

No resources found

Resources that this resource uses

No resources found

Narrative

Note: links and images are rebased to the (stated) source

Source1

{
  "resourceType": "Requirements",
  "id": "CMHAFFR2-APU.2",
  "meta": {
    "profile": [
      "http://hl7.org/ehrs/uv/cmhaffr2/StructureDefinition/FMHeader"
    ]
  },
  "text": {
    "status": "extensions",
    "div": "<!-- snip (see above) -->"
  },
  "extension": [
    {
      "url": "http://hl7.org/fhir/StructureDefinition/structuredefinition-wg",
      "valueCode": "mobile"
    }
  ],
  "url": "http://hl7.org/ehrs/uv/cmhaffr2/Requirements/CMHAFFR2-APU.2",
  "version": "2.0.1",
  "name": "APU_2_User_Authorizations",
  "title": "APU.2 User Authorizations (Header)",
  "status": "active",
  "date": "2026-08-27T10:32:57+00:00",
  "publisher": "HL7 International / Mobile Health",
  "contact": [
    {
      "telecom": [
        {
          "system": "url",
          "value": "http://www.hl7.org/Special/committees/mobile"
        }
      ]
    }
  ],
  "description": "This category is about personal data collection and use, including access to device features, being understood and explicitly\nauthorized (consented to) by the users of the app.",
  "jurisdiction": [
    {
      "coding": [
        {
          "system": "http://unstats.un.org/unsd/methods/m49/m49.htm",
          "code": "001",
          "display": "World"
        }
      ]
    }
  ],
  "statement": [
    {
      "extension": [
        {
          "url": "http://hl7.org/ehrs/uv/cmhaffr2/StructureDefinition/requirements-dependent",
          "valueBoolean": false
        }
      ],
      "key": "CMHAFFR2-APU.2-66",
      "label": "APU.2#66",
      "conformance": [
        "SHALL"
      ],
      "conditionality": false,
      "requirement": "The app SHALL NOT use smartphone functionality and data sources unless essential to perform specific functions of the app (including, but not limited to, location services, camera, microphone, accelerometer and other sensors, contact lists, calendars)."
    },
    {
      "extension": [
        {
          "url": "http://hl7.org/ehrs/uv/cmhaffr2/StructureDefinition/requirements-dependent",
          "valueBoolean": false
        }
      ],
      "key": "CMHAFFR2-APU.2-67",
      "label": "APU.2#67",
      "conformance": [
        "SHALL"
      ],
      "conditionality": false,
      "requirement": "The app SHALL ask app users for permission before using select smartphone functions and data sources for the first time, and SHALL allow permissions for each function, data source, and user tracking activity controlled by the app to be individually specified by the user."
    },
    {
      "extension": [
        {
          "url": "http://hl7.org/ehrs/uv/cmhaffr2/StructureDefinition/requirements-dependent",
          "valueBoolean": false
        }
      ],
      "key": "CMHAFFR2-APU.2-68",
      "label": "APU.2#68",
      "conformance": [
        "SHALL"
      ],
      "conditionality": false,
      "requirement": "The app SHALL ask the app user for permission to transmit data before exporting data from the smartphone or from any integrated device, explaining what data is being transmitted and to which recipients for what purposes, requesting permission before the first potential transmission, and re-requesting permission when additional data elements are sent, but not requesting at every transmission if the scope of exported data remains unchanged."
    },
    {
      "extension": [
        {
          "url": "http://hl7.org/ehrs/uv/cmhaffr2/StructureDefinition/requirements-dependent",
          "valueBoolean": false
        }
      ],
      "key": "CMHAFFR2-APU.2-69",
      "label": "APU.2#69",
      "conformance": [
        "SHALL"
      ],
      "conditionality": true,
      "requirement": "IF the app requests permission to use data generated by the app after it is de-identified THEN the app SHALL inform the account holder of who would have access to the de-identified data and for what purpose."
    },
    {
      "extension": [
        {
          "url": "http://hl7.org/ehrs/uv/cmhaffr2/StructureDefinition/requirements-dependent",
          "valueBoolean": false
        }
      ],
      "key": "CMHAFFR2-APU.2-70",
      "label": "APU.2#70",
      "conformance": [
        "SHALL"
      ],
      "conditionality": true,
      "requirement": "IF the app requests permission to use data generated by the app after it is de-identified THEN the app SHALL inform the account holder of the possibility that de-identified data can potentially be re-identified and steps the app sponsor takes to prevent re-identification."
    },
    {
      "extension": [
        {
          "url": "http://hl7.org/ehrs/uv/cmhaffr2/StructureDefinition/requirements-dependent",
          "valueBoolean": false
        }
      ],
      "key": "CMHAFFR2-APU.2-71",
      "label": "APU.2#71",
      "conformance": [
        "SHALL"
      ],
      "conditionality": true,
      "requirement": "IF the user gives permission for data generated by the app to be de-identified and used THEN the app SHALL ensure data de-identification follows, at minimum, realm-specific rules (e.g., HIPAA safe-harbor in USA)."
    },
    {
      "extension": [
        {
          "url": "http://hl7.org/ehrs/uv/cmhaffr2/StructureDefinition/requirements-dependent",
          "valueBoolean": false
        }
      ],
      "key": "CMHAFFR2-APU.2-72",
      "label": "APU.2#72",
      "conformance": [
        "SHALL"
      ],
      "conditionality": true,
      "requirement": "IF in-app payments exist THEN the app SHALL NOT trigger in-app payments in such a way that can expose healthcare-related information to payment organizations."
    },
    {
      "extension": [
        {
          "url": "http://hl7.org/ehrs/uv/cmhaffr2/StructureDefinition/requirements-dependent",
          "valueBoolean": false
        }
      ],
      "key": "CMHAFFR2-APU.2-73",
      "label": "APU.2#73",
      "conformance": [
        "SHALL"
      ],
      "conditionality": true,
      "requirement": "IF the app uses in-app advertising THEN the app SHALL disclose to the user potential use of PHI or PII to personalize advertisements and SHALL give the user the opportunity to consent or decline."
    },
    {
      "extension": [
        {
          "url": "http://hl7.org/ehrs/uv/cmhaffr2/StructureDefinition/requirements-dependent",
          "valueBoolean": false
        }
      ],
      "key": "CMHAFFR2-APU.2-74",
      "label": "APU.2#74",
      "conformance": [
        "SHALL"
      ],
      "conditionality": false,
      "requirement": "The app SHALL permit an app user to choose to permit some, but not all, requested data to be exported from a smartphone or associated device, and SHALL inform the user how the choice to limit data affects the functionality of the app."
    },
    {
      "extension": [
        {
          "url": "http://hl7.org/ehrs/uv/cmhaffr2/StructureDefinition/requirements-dependent",
          "valueBoolean": false
        }
      ],
      "key": "CMHAFFR2-APU.2-75",
      "label": "APU.2#75",
      "conformance": [
        "SHALL"
      ],
      "conditionality": true,
      "requirement": "IF an app user denies a permission requested by the app THEN the app SHALL inform the app user of the consequence of not extending the permission and SHALL give a second chance to extend the permission."
    },
    {
      "extension": [
        {
          "url": "http://hl7.org/ehrs/uv/cmhaffr2/StructureDefinition/requirements-dependent",
          "valueBoolean": false
        }
      ],
      "key": "CMHAFFR2-APU.2-76",
      "label": "APU.2#76",
      "conformance": [
        "SHALL"
      ],
      "conditionality": true,
      "requirement": "IF data is shared with social networks THEN the app SHALL NOT commence data sharing until after obtaining and recording explicit user consent.[1]"
    }
  ]
}