{
  "resourceType": "ValueSet",
  "id": "security-label-data-examples",
  "meta": {
    "lastUpdated": "2023-03-26T15:21:02.749+11:00",
    "profile": [
      "http://hl7.org/fhir/StructureDefinition/shareablevalueset"
    ]
  },
  "text": {
    "status": "extensions",
    "div": "\u003cdiv xmlns\u003d\"http://www.w3.org/1999/xhtml\"\u003e\u003cp\u003eThis value set includes codes based on the following rules:\u003c/p\u003e\u003cul\u003e\u003cli\u003eInclude these codes as defined in \u003ca href\u003d\"http://terminology.hl7.org/5.1.0/CodeSystem-v3-Confidentiality.html\"\u003e\u003ccode\u003ehttp://terminology.hl7.org/CodeSystem/v3-Confidentiality\u003c/code\u003e\u003c/a\u003e\u003ctable class\u003d\"none\"\u003e\u003ctr\u003e\u003ctd style\u003d\"white-space:nowrap\"\u003e\u003cb\u003eCode\u003c/b\u003e\u003c/td\u003e\u003ctd\u003e\u003cb\u003eDisplay\u003c/b\u003e\u003c/td\u003e\u003ctd\u003e\u003cb\u003eDefinition\u003c/b\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003ca href\u003d\"http://terminology.hl7.org/5.1.0/CodeSystem-v3-Confidentiality.html#v3-Confidentiality-N\"\u003eN\u003c/a\u003e\u003c/td\u003e\u003ctd\u003enormal\u003c/td\u003e\u003ctd\u003ePrivacy metadata indicating the level of protection required to safeguard personal and healthcare information, which if disclosed without authorization, would present a considerable risk of harm to an individual\u0027s reputation and sense of privacy.\u003cbr/\u003e\u003cbr/\u003e*Usage Note:* The level of protection afforded normatively confidential information is dictated by the prevailing normative privacy policies, which are intended to engender patient trust in their healthcare providers.\u003cbr/\u003e\u003cbr/\u003ePrivacy policies mandating normative levels of protection, which preempt less protective privacy policies when the information is used in the delivery and management of healthcare. May be pre-empted by jurisdictional law (e.g., for public health reporting or emergency treatment).\u003cbr/\u003e\u003cbr/\u003eConfidentiality code total order hierarchy: Normal (N) is less protective than *V* and *R*, and subsumes all other protection levels (i.e., *M, L, and U*).\u003cbr/\u003e\u003cbr/\u003e**Map:**Partial Map to ISO 13606-4 Sensitivity Level (3) Clinical Care when purpose of use is treatment: Default for normal clinical care access (i.e., most clinical staff directly caring for the patient should be able to access nearly all of the EHR). Maps to normal confidentiality for treatment information but not to ancillary care, payment and operations.\u003cbr/\u003e\u003cbr/\u003e**Examples:** \u003cbr/\u003e\u003cbr/\u003en the US, this includes what HIPAA identifies as protected health information (PHI) under 45 CFR Section 160.103.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003ca href\u003d\"http://terminology.hl7.org/5.1.0/CodeSystem-v3-Confidentiality.html#v3-Confidentiality-R\"\u003eR\u003c/a\u003e\u003c/td\u003e\u003ctd\u003erestricted\u003c/td\u003e\u003ctd\u003ePrivacy metadata indicating the level of protection required to safeguard potentially stigmatizing information, which if disclosed without authorization, would present a high risk of harm to an individual\u0027s reputation and sense of privacy.\u003cbr/\u003e\u003cbr/\u003e*Usage Note:* The level of protection afforded restricted confidential information is dictated by specially protective organizational or jurisdictional privacy policies, including at an authorized individualâ€™s request, intended to engender patient trust in providers of sensitive services.\u003cbr/\u003e\u003cbr/\u003ePrivacy policies mandating additional levels of protection by restricting information access preempt less protective privacy policies when the information is used in the delivery and management of healthcare. May be pre-empted by jurisdictional law (e.g., for public health reporting or emergency treatment).\u003cbr/\u003e\u003cbr/\u003eConfidentiality code total order hierarchy: Restricted (R) is less protective than *V*, and subsumes all other protection levels (i.e., *N, M, L, and U*).\u003cbr/\u003e\u003cbr/\u003e**Examples:** \u003cbr/\u003e\u003cbr/\u003eIncludes information that is additionally protected such as sensitive conditions mental health, HIV, substance abuse, domestic violence, child abuse, genetic disease, and reproductive health; or sensitive demographic information such as a patientâ€™s standing as an employee or a celebrity. May be used to indicate proprietary or classified information that is not related to an individual (e.g., secret ingredients in a therapeutic substance; or the name of a manufacturer).\u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e\u003c/li\u003e\u003cli\u003eInclude these codes as defined in \u003ca href\u003d\"http://terminology.hl7.org/5.1.0/CodeSystem-v3-ActCode.html\"\u003e\u003ccode\u003ehttp://terminology.hl7.org/CodeSystem/v3-ActCode\u003c/code\u003e\u003c/a\u003e\u003ctable class\u003d\"none\"\u003e\u003ctr\u003e\u003ctd style\u003d\"white-space:nowrap\"\u003e\u003cb\u003eCode\u003c/b\u003e\u003c/td\u003e\u003ctd\u003e\u003cb\u003eDisplay\u003c/b\u003e\u003c/td\u003e\u003ctd\u003e\u003cb\u003eDefinition\u003c/b\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003ca href\u003d\"http://terminology.hl7.org/5.1.0/CodeSystem-v3-ActCode.html#v3-ActCode-ETH\"\u003eETH\u003c/a\u003e\u003c/td\u003e\u003ctd\u003esubstance abuse information sensitivity\u003c/td\u003e\u003ctd\u003ePolicy for handling alcohol or drug-abuse information, which will be afforded heightened confidentiality. Information handling protocols based on organizational policies related to alcohol or drug-abuse information that is deemed sensitive.\u003cbr/\u003e\u003cbr/\u003e*Usage Note:* If there is a jurisdictional mandate, then use the applicable ActPrivacyLaw code system, and specify the law rather than or in addition to this more generic code.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003ca href\u003d\"http://terminology.hl7.org/5.1.0/CodeSystem-v3-ActCode.html#v3-ActCode-PSY\"\u003ePSY\u003c/a\u003e\u003c/td\u003e\u003ctd\u003epsychiatry disorder information sensitivity\u003c/td\u003e\u003ctd\u003ePolicy for handling psychiatry psychiatric disorder information, which is afforded heightened confidentiality.\u003cbr/\u003e\u003cbr/\u003e*Usage Note:* If there is a jurisdictional mandate, then use the applicable ActPrivacyLaw code system, and specify the law rather than or in addition to this more generic code.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003ca href\u003d\"http://terminology.hl7.org/5.1.0/CodeSystem-v3-ActCode.html#v3-ActCode-STD\"\u003eSTD\u003c/a\u003e\u003c/td\u003e\u003ctd\u003esexually transmitted disease information sensitivity\u003c/td\u003e\u003ctd\u003ePolicy for handling sexually transmitted disease information, which will be afforded heightened confidentiality. Information handling protocols based on organizational policies related to sexually transmitted disease information that is deemed sensitive.\u003cbr/\u003e\u003cbr/\u003e*Usage Note:* If there is a jurisdictional mandate, then use the applicable ActPrivacyLaw code system, and specify the law rather than or in addition to this more generic code.\u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e\u003c/li\u003e\u003c/ul\u003e\u003c/div\u003e"
  },
  "extension": [
    {
      "url": "http://hl7.org/fhir/StructureDefinition/structuredefinition-wg",
      "valueCode": "sec"
    }
  ],
  "url": "http://hl7.org/fhir/ValueSet/security-label-data-examples",
  "identifier": [
    {
      "system": "urn:ietf:rfc:3986",
      "value": "urn:oid:2.16.840.1.113883.4.642.3.3013"
    }
  ],
  "version": "5.0.0",
  "name": "SecurityLabelDataExamples",
  "title": "Example set of Data Security Labels",
  "status": "draft",
  "experimental": false,
  "date": "2022-05-10",
  "publisher": "HL7 Security Work Group",
  "contact": [
    {
      "telecom": [
        {
          "system": "url",
          "value": "http://hl7.org/fhir"
        },
        {
          "system": "email",
          "value": "fhir@lists.hl7.org"
        }
      ]
    }
  ],
  "description": "A sample of security labels from [Healthcare Privacy and Security Classification System](security-labels.html#hcs) used on data (.meta.security) to indicate confidentialityCode classification and maybe sensitivity codes.",
  "jurisdiction": [
    {
      "coding": [
        {
          "system": "http://unstats.un.org/unsd/methods/m49/m49.htm",
          "code": "001",
          "display": "World"
        }
      ]
    }
  ],
  "compose": {
    "include": [
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-Confidentiality",
        "concept": [
          {
            "code": "N"
          },
          {
            "code": "R"
          }
        ]
      },
      {
        "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
        "concept": [
          {
            "code": "ETH"
          },
          {
            "code": "PSY"
          },
          {
            "code": "STD"
          }
        ]
      }
    ]
  }
}