FHIR IG analytics

Resources that use this resource

No resources found

Resources that this resource uses

Narrative

Note: links and images are rebased to the (stated) source

                       Usage Note: Access control schemes are the type of access control policy, which is comprised of access control policy rules concerning the provision of the access control service.

                    There are two categories of access control policies, rule-based and identity-based, which are identified in CCITT Rec. X.800 aka ISO 7498-2. Rule-based access control policies are intended to apply to all access requests by any initiator on any target in a security domain. Identity-based access control policies are based on rules specific to an individual initiator, a group of initiators, entities acting on behalf of initiators, or originators acting in a specific role. Context can modify rule-based or identity-based access control policies. Context rules may define the entire policy in effect. Real systems will usually employ a combination of these policy types; if a rule-based policy is used, then an identity-based policy is usually in effect also.

                    An access control scheme may be based on access control lists, capabilities, labels, and context or a combination of these.  An access control scheme is a component of an access control mechanism or "service") along with the supporting mechanisms required by that scheme to provide access control decision information (ADI) supplied by the scheme to the access decision facility (ADF also known as a PDP). (Based on ISO/IEC 10181-3:1996)

                    
                       Examples: 
                    

                    
                       Attribute Based Access Control (ABAC)
                       Discretionary Access Control (DAC)
                       History Based Access Control (HBAC)
                       Identity Based Access Control (IBAC)
                       Mandatory Access Control (MAC)
                       Organization Based Access Control (OrBAC)
                       Relationship Based Access Control (RelBac)
                       Responsibility Based Access Control (RespBAC)
                       Risk Adaptable Access Control (RAdAC)
                    >

                    A positive authorisation policy defines the actions that a subject is permitted to perform on a target. A negative authorisation policy specifies the actions that a subject is forbidden to perform on a target. Positive authorisation policies may also include filters to transform the parameters associated with their actions.  (Based on PONDERS)

                    Delegation policies are aimed at subjects delegating rights to servers or third parties to perform actions on their behalf and are not meant to be the means by which security administrators would assign rights to subjects. A negative delegation policy identifies what delegations are forbidden.

                    A Delegation policy specifies the authorisation policy from which delegated rights are derived, the grantors, which are the entities which can delegate these access rights, and the grantees, which are the entities to which the access rights can be delegated. There are two types of delegation policy, positive and negative. (Based on PONDERS)

                       Usage Notes: A mathematical transposition of a file or data stream so that it cannot be deciphered at the receiving end without the proper key. Encryption is a security feature that assures that only the parties who are supposed to be participating in a videoconference or data transfer are able to do so. It can include a password, public and private keys, or a complex combination of all.  (Per Infoway.)

                       Usage Note: In security systems, security policy label assignments do not change, they may supersede prior assignments, and such reassignments are always tracked for auditing and other purposes.

                       Usage Note: Limiting the information available for access and disclosure to that an authorized user or receiver "needs to know" in order to perform permitted workflow or purpose of use.

                       Usage Note: The information may be labeled with the ActInformationSensitivity TBOO code, triggering application of this RefrainPolicy code as a handling caveat controlling access.

                    Maps to FHIR NOPAT: Typically, this is used on an Alert resource, when the alert records information on patient abuse or non-compliance.

                    FHIR print name is "keep information from patient". Maps to the French realm - code: INVISIBLE_PATIENT.

                    
                       displayName: Document non visible par le patient
                       codingScheme: 1.2.250.1.213.1.1.4.13
                    
                    French use case:  A label for documents that the author  chose to hide from the patient until the content can be disclose to the patient in a face to face meeting between a healthcare professional and the patient (in French law some results like cancer diagnosis or AIDS diagnosis must be announced to the patient by a healthcare professional and should not be find out by the patient alone).

                       Usage Notes: Per ISO 22600-2, ObligationPolicy instances 'are event-triggered and define actions to be performed by manager agent'. Per HL7 Composite Security and Privacy Domain Analysis Model:  This value set refers to the action required to receive the permission specified in the privacy rule. Per OASIS XACML, an obligation is an operation specified in a policy or policy that is performed in conjunction with the enforcement of an access control decision.

                    Map:  Aligns with ISO 22600-3 Section A.3.4.3 description of privacy mark:  "If present, the privacy-mark is not used for access control. The content of the privacy-mark may be defined by the security policy in force (identified by the security-policy-identifier) which may define a list of values to be used. Alternately, the value may be determined by the originator of the security-label."

                       Usage Notes: ISO 22600-2 species that a Refrain Policy "defines actions the subjects must refrain from performing".  Per HL7 Composite Security and Privacy Domain Analysis Model:  May be used to indicate that a specific action is prohibited based on specific access control attributes e.g., purpose of use, information type, user role, etc.

                       Examples:
                    

                    
                       obligation to encrypt
                       refrain from redisclosure without consent

                       Map: Partially Maps to ISO 14265 Classification Term "Emergency care provision to an individual subject of care" described as "To inform persons needing to provide health care services to the subject of care urgently, possibly needing to over-ride the  policies and consents pertaining to Purpose 1 above." Purpose 1 is equivalent to HL7 treatment purpose of use: "Clinical care provision to an individual subject of care" described as "To inform persons or processes responsible for providing health care services to the subject of care."

                       Usage Note: The concept of care management is narrower than the list of activities related to more general organizational objectives such as provider profiling, education of healthcare and non-healthcare professionals; insurance underwriting, premium rating, reinsurance; organizational legal, medical review, auditing, compliance and fraud and abuse detection; business planning, development, and restructuring; fund-raising; and customer service.

                    
                       Map: Maps to ISO 14265 Classification Term "Health service management and quality assurance" described as "To inform persons or processes responsible for determining the availability, quality, safety, equity and cost-effectiveness of health care services." 

                    There is a semantic gap in concepts.  This classification term  is described as activities, i.e., "to inform persons" or "to inform processes" rather than the rationale for performing actions/operations on information related to the activity.

                       Usage Note: Use when describing these functions: 1. Monitoring a person’s goals, needs, and preferences.   2. Acting as the communication link between two or more participants concerned with a person's health and wellness.  3. Organizing and facilitating care activities and promoting self-management by advocating for, empowering, and educating a person.  4. Ensuring safe, appropriate, non-duplicative, and effective integrated care.

                    The goal is to clearly differentiate this type of coordination of care from HIPAA Operations by specifying that these actions on information are undertaken in the provision of healthcare treatment.

                    For similar uses of this concept, see SAMHSA Confidentiality of Substance Use Disorder Patient Records Supplemental notice of proposed rulemaking, which differentiates concepts of care coordination and case management for the provision of treatment as specifically distinct from activities related to health care delivery management and the operations of organizational entities involved in the delivery of healthcare.

                    
                       Map: Maps to ISO 14265 Classification Terms: "Support of care activities within the provider organisation for an individual subject of care" described as "To inform persons or processes enabling others to provide health care services to the subject of care."  "Subject of Care Uses" described as "To inform the subject of care in support of his or her own interests."

                    Map:Partially Maps to ISO 14265 Classification Term "Emergency care provision to an individual subject of care" described as "To inform persons needing to provide health care services to the subject of care urgently, possibly needing to over-ride the  policies and consents pertaining to Purpose 1 above." Purpose 1 is equivalent to HL7 treatment purpose of use: "Clinical care provision to an individual subject of care" described as "To inform persons or processes responsible for providing health care services to the subject of care."

                    The ISO description conflates both of the proposed specializations of HL7 ETREAT: break the glass and the typically broader access to health information normally available to providers who are provisioned for emergency workflows on a regular basis, e.g., Emergency Room providers. Examples of greater access than is normally accessible by providers based on the need to know are access to sensitive information for which access typically requires a patient's consent.  This is not an override of a patient's dissent to disclose sensitive information in cases where the applicable policy waives the need for that consent to access this information. In US, Title 38 Section 7332 and 42 CFR Part 2 both permit emergency access without the need to override a patient's consent directive; rather, this access is a limitation to the patient's right to dissent from disclosure. 

                    There is a semantic gap in concepts.  This classification term is described as activities “to inform persons� rather than the rationale for performing actions/operations on information related to the activity.

                       Examples: 
                    

                    
                       facility
                       enterprise
                       payer
                       health information exchange patient directory

                       Usage Note: Examples of activities conducted under this purpose of use: provider profiling, risk adjustment, underwriting, fraud and abuse, quality improvement population health and care management. Aligns with HIPAA Operation POU minus coordination of care or other treatment related activities. Similar to the description in SAMHSA Confidentiality of Substance Use Disorder Patient Records Supplemental notice of proposed rulemaking.

                    
                       Map: Maps to ISO 14265 Classification Term  "Administration of care for an individual subject of care" described as "To inform persons or processes responsible for enabling the availability of resources or funding or permissions for providing health care services to the subject of care."

                    However, this classification term is described as activities, i.e., "to inform persons" or "to inform processes" rather than the rationale for performing actions/operations on information related to the activity.

                       Usage Note: Data marked with a HTEST security label enables an access control system to permit interfacing systems or end users provisioned with a clearance, which includes a HTEST purpose of use attribute, to test, verify, or validate that a system or application will operate in production as intended based on design specifications.

                    Label management includes classification of target data by constructing and binding of a label set per applicable policies, security policy information file semantics, and classification guides.  Label management also includes process and procedures for subsequent revision of a label for, e.g., reclassification, downgrading classification, and declassification.

                    Label revisions may be triggered by, e.g., expiry of classification period; changes in applicable policy, e.g., revocation of a consent directive; or changes in the governing policy domain in which the data is relocated or a copy of the data is sent.  If a label is revised, an audit log should be kept and the provenance of the label changes should be tracked.

                       Usage Notes: The rationale or purpose for an act relating to the management of personal health information, such as collecting personal health information for research or public health purposes.

Source1

{
  "resourceType": "ValueSet",
  "id": "R4-v3-SecurityControlObservationValue-for-R5",
  "text": {
    "status": "generated",
    "div": "<!-- snip (see above) -->"
  },
  "extension": [
    {
      "url": "http://hl7.org/fhir/StructureDefinition/structuredefinition-fmm",
      "valueInteger": 0
    },
    {
      "url": "http://hl7.org/fhir/StructureDefinition/structuredefinition-wg",
      "valueCode": "fhir"
    },
    {
      "extension": [
        {
          "url": "packageId",
          "valueId": "hl7.fhir.uv.xver-r4.r5"
        },
        {
          "url": "version",
          "valueString": "0.1.0"
        },
        {
          "url": "uri",
          "valueUri": "http://hl7.org/fhir/uv/xver/ImplementationGuide/hl7.fhir.uv.xver-r4.r5"
        }
      ],
      "url": "http://hl7.org/fhir/StructureDefinition/package-source"
    },
    {
      "url": "http://hl7.org/fhir/StructureDefinition/structuredefinition-standards-status",
      "valueCode": "trial-use",
      "_valueCode": {
        "extension": [
          {
            "url": "http://hl7.org/fhir/StructureDefinition/structuredefinition-conformance-derivedFrom",
            "valueCanonical": "http://hl7.org/fhir/uv/xver/ImplementationGuide/hl7.fhir.uv.xver-r4.r5"
          }
        ]
      }
    }
  ],
  "url": "http://hl7.org/fhir/uv/xver/ValueSet/R4-v3-SecurityControlObservationValue-for-R5",
  "version": "0.1.0",
  "name": "R4V3SecurityControlObservationValueForR5",
  "title": "Cross-version ValueSet R4.v3.SecurityControlObservationValue for use in FHIR R5",
  "status": "active",
  "experimental": false,
  "date": "2026-03-17T21:02:03.8104715+00:00",
  "publisher": "FHIR Infrastructure",
  "contact": [
    {
      "name": "FHIR Infrastructure",
      "telecom": [
        {
          "system": "url",
          "value": "http://www.hl7.org/Special/committees/fiwg"
        }
      ]
    }
  ],
  "description": "This cross-version ValueSet represents content from `http://terminology.hl7.org/ValueSet/v3-SecurityControlObservationValue|2014-03-26` for use in FHIR R5.",
  "jurisdiction": [
    {
      "coding": [
        {
          "system": "http://unstats.un.org/unsd/methods/m49/m49.htm",
          "code": "001",
          "display": "World"
        }
      ]
    }
  ],
  "purpose": "This value set is part of the cross-version definitions generated to enable use of the\r\nvalue set `http://terminology.hl7.org/ValueSet/v3-SecurityControlObservationValue|2014-03-26` as defined in FHIR R4\r\nin FHIR R5.\r\n\r\nThe source value set is bound to the following FHIR R4 elements:\r\n* \r\n\r\nNote that all concepts are included in this cross-version definition because no concepts have compatible representations\r\n\r\nFollowing are the generation technical comments:\r\n\nFHIR ValueSet `http://terminology.hl7.org/ValueSet/v3-SecurityControlObservationValue|2014-03-26`, defined in FHIR R4 does not have any mapping to FHIR R5",
  "compose": {
    "include": [
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "concept": [
          {
            "code": "ACCESSCONSCHEME",
            "display": "access control scheme"
          },
          {
            "code": "ANONY",
            "display": "anonymize"
          },
          {
            "code": "AOD",
            "display": "accounting of disclosure"
          },
          {
            "code": "AUDIT",
            "display": "audit"
          },
          {
            "code": "AUDTR",
            "display": "audit trail"
          },
          {
            "code": "AUTHPOL",
            "display": "authorization policy"
          },
          {
            "code": "CPLYCC",
            "display": "comply with confidentiality code"
          },
          {
            "code": "CPLYCD",
            "display": "comply with consent directive"
          },
          {
            "code": "CPLYJPP",
            "display": "comply with jurisdictional privacy policy"
          },
          {
            "code": "CPLYOPP",
            "display": "comply with organizational privacy policy"
          },
          {
            "code": "CPLYOSP",
            "display": "comply with organizational security policy"
          },
          {
            "code": "CPLYPOL",
            "display": "comply with policy"
          },
          {
            "code": "DECLASSIFYLABEL",
            "display": "declassify security label"
          },
          {
            "code": "DEID",
            "display": "deidentify"
          },
          {
            "code": "DELAU",
            "display": "delete after use"
          },
          {
            "code": "DELEPOL",
            "display": "delegation policy"
          },
          {
            "code": "DOWNGRDLABEL",
            "display": "downgrade security label"
          },
          {
            "code": "DRIVLABEL",
            "display": "derive security label"
          },
          {
            "code": "ENCRYPT",
            "display": "encrypt"
          },
          {
            "code": "ENCRYPTR",
            "display": "encrypt at rest"
          },
          {
            "code": "ENCRYPTT",
            "display": "encrypt in transit"
          },
          {
            "code": "ENCRYPTU",
            "display": "encrypt in use"
          },
          {
            "code": "HUAPRV",
            "display": "human approval"
          },
          {
            "code": "LABEL",
            "display": "assign security label"
          },
          {
            "code": "MASK",
            "display": "mask"
          },
          {
            "code": "MINEC",
            "display": "minimum necessary"
          },
          {
            "code": "NOAUTH",
            "display": "no disclosure without subject authorization"
          },
          {
            "code": "NOCOLLECT",
            "display": "no collection"
          },
          {
            "code": "NODSCLCD",
            "display": "no disclosure without consent directive"
          },
          {
            "code": "NODSCLCDS",
            "display": "no disclosure without information subject's consent directive"
          },
          {
            "code": "NOINTEGRATE",
            "display": "no integration"
          },
          {
            "code": "NOLIST",
            "display": "no unlisted entity disclosure"
          },
          {
            "code": "NOMOU",
            "display": "no disclosure without MOU"
          },
          {
            "code": "NOORGPOL",
            "display": "no disclosure without organizational authorization"
          },
          {
            "code": "NOPAT",
            "display": "no disclosure to patient, family or caregivers without attending provider's authorization"
          },
          {
            "code": "NOPERSISTP",
            "display": "no collection beyond purpose of use"
          },
          {
            "code": "NORDSCLCD",
            "display": "no redisclosure without consent directive"
          },
          {
            "code": "NORDSCLCDS",
            "display": "no redisclosure without information subject's consent directive"
          },
          {
            "code": "NORDSCLW",
            "display": "no disclosure without jurisdictional authorization"
          },
          {
            "code": "NORELINK",
            "display": "no relinking"
          },
          {
            "code": "NOREUSE",
            "display": "no reuse beyond purpose of use"
          },
          {
            "code": "NOVIP",
            "display": "no unauthorized VIP disclosure"
          },
          {
            "code": "ORCON",
            "display": "no disclosure without originator authorization"
          },
          {
            "code": "ObligationPolicy",
            "display": "obligation policy"
          },
          {
            "code": "PERSISTLABEL",
            "display": "persist security label"
          },
          {
            "code": "PRIVMARK",
            "display": "privacy mark"
          },
          {
            "code": "PSEUD",
            "display": "pseudonymize"
          },
          {
            "code": "REDACT",
            "display": "redact"
          },
          {
            "code": "RefrainPolicy",
            "display": "refrain policy"
          },
          {
            "code": "SecurityPolicy",
            "display": "security policy"
          },
          {
            "code": "UPGRDLABEL",
            "display": "upgrade security label"
          }
        ]
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "concept": [
          {
            "code": "BIORCH",
            "display": "biomedical research"
          },
          {
            "code": "BTG",
            "display": "break the glass"
          },
          {
            "code": "CAREMGT",
            "display": "care management"
          },
          {
            "code": "CLINTRCH",
            "display": "clinical trial research"
          },
          {
            "code": "CLINTRCHNPC",
            "display": "clinical trial research without patient care"
          },
          {
            "code": "CLINTRCHPC",
            "display": "clinical trial research with patient care"
          },
          {
            "code": "CLINTRL",
            "display": "clinical trial"
          },
          {
            "code": "CLMATTCH",
            "display": "claim attachment"
          },
          {
            "code": "COC",
            "display": "coordination of care"
          },
          {
            "code": "COVAUTH",
            "display": "coverage authorization"
          },
          {
            "code": "COVERAGE",
            "display": "coverage under policy or program"
          },
          {
            "code": "DISASTER",
            "display": "disaster"
          },
          {
            "code": "DONAT",
            "display": "donation"
          },
          {
            "code": "DSRCH",
            "display": "disease specific healthcare research"
          },
          {
            "code": "ELIGDTRM",
            "display": "eligibility determination"
          },
          {
            "code": "ELIGVER",
            "display": "eligibility verification"
          },
          {
            "code": "ENROLLM",
            "display": "enrollment"
          },
          {
            "code": "ERTREAT",
            "display": "emergency room treatment"
          },
          {
            "code": "ETREAT",
            "display": "Emergency Treatment"
          },
          {
            "code": "FAMRQT",
            "display": "family requested"
          },
          {
            "code": "FRAUD",
            "display": "fraud"
          },
          {
            "code": "GOV",
            "display": "government"
          },
          {
            "code": "HACCRED",
            "display": "health accreditation"
          },
          {
            "code": "HCOMPL",
            "display": "health compliance"
          },
          {
            "code": "HDECD",
            "display": "decedent"
          },
          {
            "code": "HDIRECT",
            "display": "directory"
          },
          {
            "code": "HDM",
            "display": "healthcare delivery management"
          },
          {
            "code": "HLEGAL",
            "display": "legal"
          },
          {
            "code": "HMARKT",
            "display": "healthcare marketing"
          },
          {
            "code": "HOPERAT",
            "display": "healthcare operations"
          },
          {
            "code": "HOUTCOMS",
            "display": "health outcome measure"
          },
          {
            "code": "HPAYMT",
            "display": "healthcare payment"
          },
          {
            "code": "HPRGRP",
            "display": "health program reporting"
          },
          {
            "code": "HQUALIMP",
            "display": "health quality improvement"
          },
          {
            "code": "HRESCH",
            "display": "healthcare research"
          },
          {
            "code": "HSYSADMIN",
            "display": "health system administration"
          },
          {
            "code": "HTEST",
            "display": "test health data"
          },
          {
            "code": "LABELING",
            "display": "labeling"
          },
          {
            "code": "MEMADMIN",
            "display": "member administration"
          },
          {
            "code": "METAMGT",
            "display": "metadata management"
          },
          {
            "code": "MILCDM",
            "display": "military command"
          },
          {
            "code": "MILDCRG",
            "display": "military discharge"
          },
          {
            "code": "PATADMIN",
            "display": "patient administration"
          },
          {
            "code": "PATRQT",
            "display": "patient requested"
          },
          {
            "code": "PATSFTY",
            "display": "patient safety"
          },
          {
            "code": "PERFMSR",
            "display": "performance measure"
          },
          {
            "code": "POARCH",
            "display": "population origins or ancestry healthcare research"
          },
          {
            "code": "POPHLTH",
            "display": "population health"
          },
          {
            "code": "PRECLINTRCH",
            "display": "preclinical trial research"
          },
          {
            "code": "PUBHLTH",
            "display": "public health"
          },
          {
            "code": "PWATRNY",
            "display": "power of attorney"
          },
          {
            "code": "PurposeOfUse",
            "display": "purpose of use"
          },
          {
            "code": "RECORDMGT",
            "display": "records management"
          },
          {
            "code": "REMITADV",
            "display": "remittance advice"
          },
          {
            "code": "SUPNWK",
            "display": "support network"
          },
          {
            "code": "SYSDEV",
            "display": "system development"
          },
          {
            "code": "THREAT",
            "display": "threat"
          },
          {
            "code": "TRAIN",
            "display": "training"
          },
          {
            "code": "TRANSRCH",
            "display": "translational healthcare research"
          },
          {
            "code": "TREAT",
            "display": "treatment"
          }
        ]
      }
    ]
  },
  "expansion": {
    "timestamp": "2026-03-17T21:02:03.8104715+00:00",
    "contains": [
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "ACCESSCONSCHEME",
        "display": "access control scheme"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "ANONY",
        "display": "anonymize"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "AOD",
        "display": "accounting of disclosure"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "AUDIT",
        "display": "audit"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "AUDTR",
        "display": "audit trail"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "AUTHPOL",
        "display": "authorization policy"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "CPLYCC",
        "display": "comply with confidentiality code"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "CPLYCD",
        "display": "comply with consent directive"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "CPLYJPP",
        "display": "comply with jurisdictional privacy policy"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "CPLYOPP",
        "display": "comply with organizational privacy policy"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "CPLYOSP",
        "display": "comply with organizational security policy"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "CPLYPOL",
        "display": "comply with policy"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "DECLASSIFYLABEL",
        "display": "declassify security label"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "DEID",
        "display": "deidentify"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "DELAU",
        "display": "delete after use"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "DELEPOL",
        "display": "delegation policy"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "DOWNGRDLABEL",
        "display": "downgrade security label"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "DRIVLABEL",
        "display": "derive security label"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "ENCRYPT",
        "display": "encrypt"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "ENCRYPTR",
        "display": "encrypt at rest"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "ENCRYPTT",
        "display": "encrypt in transit"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "ENCRYPTU",
        "display": "encrypt in use"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "HUAPRV",
        "display": "human approval"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "LABEL",
        "display": "assign security label"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "MASK",
        "display": "mask"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "MINEC",
        "display": "minimum necessary"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "NOAUTH",
        "display": "no disclosure without subject authorization"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "NOCOLLECT",
        "display": "no collection"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "NODSCLCD",
        "display": "no disclosure without consent directive"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "NODSCLCDS",
        "display": "no disclosure without information subject's consent directive"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "NOINTEGRATE",
        "display": "no integration"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "NOLIST",
        "display": "no unlisted entity disclosure"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "NOMOU",
        "display": "no disclosure without MOU"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "NOORGPOL",
        "display": "no disclosure without organizational authorization"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "NOPAT",
        "display": "no disclosure to patient, family or caregivers without attending provider's authorization"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "NOPERSISTP",
        "display": "no collection beyond purpose of use"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "NORDSCLCD",
        "display": "no redisclosure without consent directive"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "NORDSCLCDS",
        "display": "no redisclosure without information subject's consent directive"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "NORDSCLW",
        "display": "no disclosure without jurisdictional authorization"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "NORELINK",
        "display": "no relinking"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "NOREUSE",
        "display": "no reuse beyond purpose of use"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "NOVIP",
        "display": "no unauthorized VIP disclosure"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "ORCON",
        "display": "no disclosure without originator authorization"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "ObligationPolicy",
        "display": "obligation policy"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "PERSISTLABEL",
        "display": "persist security label"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "PRIVMARK",
        "display": "privacy mark"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "PSEUD",
        "display": "pseudonymize"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "REDACT",
        "display": "redact"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "RefrainPolicy",
        "display": "refrain policy"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "SecurityPolicy",
        "display": "security policy"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "version": "2018-08-12",
        "code": "UPGRDLABEL",
        "display": "upgrade security label"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "BIORCH",
        "display": "biomedical research"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "BTG",
        "display": "break the glass"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "CAREMGT",
        "display": "care management"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "CLINTRCH",
        "display": "clinical trial research"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "CLINTRCHNPC",
        "display": "clinical trial research without patient care"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "CLINTRCHPC",
        "display": "clinical trial research with patient care"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "CLINTRL",
        "display": "clinical trial"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "CLMATTCH",
        "display": "claim attachment"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "COC",
        "display": "coordination of care"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "COVAUTH",
        "display": "coverage authorization"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "COVERAGE",
        "display": "coverage under policy or program"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "DISASTER",
        "display": "disaster"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "DONAT",
        "display": "donation"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "DSRCH",
        "display": "disease specific healthcare research"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "ELIGDTRM",
        "display": "eligibility determination"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "ELIGVER",
        "display": "eligibility verification"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "ENROLLM",
        "display": "enrollment"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "ERTREAT",
        "display": "emergency room treatment"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "ETREAT",
        "display": "Emergency Treatment"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "FAMRQT",
        "display": "family requested"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "FRAUD",
        "display": "fraud"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "GOV",
        "display": "government"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "HACCRED",
        "display": "health accreditation"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "HCOMPL",
        "display": "health compliance"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "HDECD",
        "display": "decedent"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "HDIRECT",
        "display": "directory"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "HDM",
        "display": "healthcare delivery management"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "HLEGAL",
        "display": "legal"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "HMARKT",
        "display": "healthcare marketing"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "HOPERAT",
        "display": "healthcare operations"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "HOUTCOMS",
        "display": "health outcome measure"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "HPAYMT",
        "display": "healthcare payment"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "HPRGRP",
        "display": "health program reporting"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "HQUALIMP",
        "display": "health quality improvement"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "HRESCH",
        "display": "healthcare research"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "HSYSADMIN",
        "display": "health system administration"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "HTEST",
        "display": "test health data"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "LABELING",
        "display": "labeling"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "MEMADMIN",
        "display": "member administration"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "METAMGT",
        "display": "metadata management"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "MILCDM",
        "display": "military command"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "MILDCRG",
        "display": "military discharge"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "PATADMIN",
        "display": "patient administration"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "PATRQT",
        "display": "patient requested"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "PATSFTY",
        "display": "patient safety"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "PERFMSR",
        "display": "performance measure"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "POARCH",
        "display": "population origins or ancestry healthcare research"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "POPHLTH",
        "display": "population health"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "PRECLINTRCH",
        "display": "preclinical trial research"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "PUBHLTH",
        "display": "public health"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "PWATRNY",
        "display": "power of attorney"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "PurposeOfUse",
        "display": "purpose of use"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "RECORDMGT",
        "display": "records management"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "REMITADV",
        "display": "remittance advice"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "SUPNWK",
        "display": "support network"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "SYSDEV",
        "display": "system development"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "THREAT",
        "display": "threat"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "TRAIN",
        "display": "training"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "TRANSRCH",
        "display": "translational healthcare research"
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "version": "2018-08-12",
        "code": "TREAT",
        "display": "treatment"
      }
    ]
  }
}