Implementation Guidance Index > Data Consumer Responsibility

Data Consumer Responsibility

Privacy and Security

Prior to implementing this guide, an organization shall complete security and privacy risk assessments and address the recommendations of those assessments. Care should be taken to ensure the confidentiality, security, and integrity of Personal Health Information in transit and at rest is maintained in accordance with the Personal Health Information Protection Act, 2004 (PHIPA).

The information which adopters receive when querying DHDR is considered Personal Health Information (PHI). As a result, access to this information must be provisioned in accordance with PHIPA and applicable agreements.

User Credentials

In order to meet the privacy obligations, the audit records maintained at the service level need to know the details of the consumer application and the user making the request. The sending application is expected to create a JSON Web Token with the relevant information and embed within the FHIR® request as http header.

Message Validation

The consumer shall implement request messages that are well-formed and conform to this specification.