Implementing Fine-Grained Data Access Control with FHIR and HealthLake
Using fine-grained authorization with a SMART on FHIR enabled HealthLake
AWS demonstrated how to implement fine-grained authorization for SMART on FHIR applications using HealthLake.
Summary
This guide explains how to implement fine-grained authorization within an AWS HealthLake environment using SMART on FHIR. This capability allows for granular control over which specific patients or data a user is authorized to access, going beyond simple scope definitions.
Key Players
Details
This document serves as a technical guide detailing advanced data security implementation in AWS HealthLake. Recognizing that standard OAuth scopes are insufficient for precise data access limitations, the system provides fine-grained authorization functionality. To enable this feature, one must set `FineGrainedAuthorizationEnabled` to True within the `IdentityProviderConfiguration` parameter of the `CreateFHIRDatastore` request. When operational, the authorization server issues an ID token containing a `fhirUser` scope and also provides an access token. Client applications should treat the `fhirUser` claim as the URI for the current user's FHIR resource (e.g., Patient, Practitioner). Furthermore, the accompanying `user/scope` defines precisely what data the user can access. For instance, if the `fhirUser` is a Practitioner, access can be restricted only to patients where that practitioner is explicitly listed as the General Practitioner. This mechanism leverages FHIR's reference and link structures to define highly specific permissions, which is crucial for maintaining privacy while enabling complex data utilization in advanced healthcare IT systems. (Source: AWS HealthLake Developer Guide)
Technology Note
FHIR（Fast Healthcare Interoperability Resources）は医療データ交換の国際標準。このエントリの関連技術: SMART ON FHIR
Original content copyright by respective publishers