Provenance gdpr-controller

The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) is a regulation by which the European Parliament, the Council of the European Union and the European Commission intend to strengthen and unify data protection for all individuals within the European Union (EU). The GDPR distinguishes between personal data and special categories of personal data (sensitive data , e.g. healthcare data).

To store information about data sources Provenance resource can be used. In Provenance resource, we should have an element called gdprController where we can represent for every provenance resource and per patient accordingly.

Resource: Provenance
Element: gdprController
cardinality: 0..*
type: Extension (gdpr-controller)

The scope of this extension is to identify gdpr-controller information where the FHIR bunlde is generated and ingested.

An example of the FHIR output:

"resource": {
		"resourceType": "Provenance",
		"id": "ab29add2-f6da-481b-b4d1-c081fd2da21f",
		"extension": [
			{
				"url": "http://roche.com/fhir/rdc/StructureDefinition/gdpr-controller",
				"valueString": "xxxx"
			},
            {
				"url": "http://roche.com/fhir/rdc/StructureDefinition/provenance-source",
				"valueString": "SPOL"
			},
			{
				"url": "http://roche.com/fhir/rdc/StructureDefinition/provenance-channel",
				"valueString": "SPOL - uDTC"
			}
		],
		"target": [{
				"reference": "Device/2"
			},
			{
				"reference": "DeviceComponent/3"
			}
		],