The following content has been modified for better visualization. Validation will be performed on original content
| 1 |
<PolicySet xmlns="urn:oasis:names:tc:xacml:2.0:policy:schema:os" xmlns:hl7="urn:hl7-org:v3" PolicyCombiningAlgId="urn:oasis:names:tc:xacml:1.0:policy-combining-algorithm:deny-overrides" PolicySetId="urn:uuid:d02e0b1b-6a4c-42b2-9d80-e287ed089674">
|
| 2 |
<Description>APPC Other Use Case - Custom policy: permit physician in Facility A for treatment documents, deny nurse role, validity period applied.</Description>
|
| 3 |
<Target>
|
| 4 |
<Resources>
|
| 5 |
<Resource>
|
| 6 |
<ResourceMatch MatchId="urn:hl7-org:v3:function:II-equal">
|
| 7 |
<AttributeValue DataType="urn:hl7-org:v3#II">
|
| 8 |
<hl7:InstanceIdentifier extension="IHEBLUE-1234" root="1.3.6.1.4.1.21367.2017.7.2"/>
|
| 9 |
</AttributeValue>
|
| 10 |
<ResourceAttributeDesignator AttributeId="urn:ihe:iti:ser:2016:patient-id" DataType="urn:hl7-org:v3#II"/>
|
| 11 |
</ResourceMatch>
|
| 12 |
</Resource>
|
| 13 |
</Resources>
|
| 14 |
</Target>
|
| 15 |
<Policy PolicyId="rule-0" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides">
|
| 16 |
<Target/>
|
| 17 |
<Rule Effect="Permit" RuleId="rule-0-permit">
|
| 18 |
<Target>
|
| 19 |
<Subjects>
|
| 20 |
<Subject>
|
| 21 |
<SubjectMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
|
| 22 |
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">physician</AttributeValue>
|
| 23 |
<SubjectAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:2.0:subject:role" DataType="http://www.w3.org/2001/XMLSchema#string"/>
|
| 24 |
</SubjectMatch>
|
| 25 |
</Subject>
|
| 26 |
<Subject>
|
| 27 |
<SubjectMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
|
| 28 |
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:uuid:a3eb03db-0094-4059-9156-8de081cb5885</AttributeValue>
|
| 29 |
<SubjectAttributeDesignator AttributeId="urn:oasis:names:tc:xspa:1.0:subject:organization-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
|
| 30 |
</SubjectMatch>
|
| 31 |
</Subject>
|
| 32 |
<Subject>
|
| 33 |
<SubjectMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
|
| 34 |
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">TREATMENT</AttributeValue>
|
| 35 |
<SubjectAttributeDesignator AttributeId="urn:oasis:names:tc:xspa:1.0:subject:purposeofuse" DataType="http://www.w3.org/2001/XMLSchema#string"/>
|
| 36 |
</SubjectMatch>
|
| 37 |
</Subject>
|
| 38 |
</Subjects>
|
| 39 |
<Resources>
|
| 40 |
<Resource>
|
| 41 |
<ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
|
| 42 |
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">18842-5</AttributeValue>
|
| 43 |
<ResourceAttributeDesignator AttributeId="urn:ihe:iti:xds-b:2007:classCode" DataType="http://www.w3.org/2001/XMLSchema#string"/>
|
| 44 |
</ResourceMatch>
|
| 45 |
</Resource>
|
| 46 |
</Resources>
|
| 47 |
</Target>
|
| 48 |
</Rule>
|
| 49 |
</Policy>
|
| 50 |
<Policy PolicyId="rule-1" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides">
|
| 51 |
<Target/>
|
| 52 |
<Rule Effect="Deny" RuleId="rule-1-deny">
|
| 53 |
<Target>
|
| 54 |
<Subjects>
|
| 55 |
<Subject>
|
| 56 |
<SubjectMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
|
| 57 |
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">nurse</AttributeValue>
|
| 58 |
<SubjectAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:2.0:subject:role" DataType="http://www.w3.org/2001/XMLSchema#string"/>
|
| 59 |
</SubjectMatch>
|
| 60 |
</Subject>
|
| 61 |
</Subjects>
|
| 62 |
</Target>
|
| 63 |
</Rule>
|
| 64 |
</Policy>
|
| 65 |
<Policy PolicyId="validity" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides">
|
| 66 |
<Target/>
|
| 67 |
<Rule Effect="Deny" RuleId="deny-before-validity">
|
| 68 |
<Target>
|
| 69 |
<Environments>
|
| 70 |
<Environment>
|
| 71 |
<EnvironmentMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:dateTime-greater-than">
|
| 72 |
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#dateTime">2026-03-23T00:00:00</AttributeValue>
|
| 73 |
<EnvironmentAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime" DataType="http://www.w3.org/2001/XMLSchema#dateTime"/>
|
| 74 |
</EnvironmentMatch>
|
| 75 |
</Environment>
|
| 76 |
</Environments>
|
| 77 |
</Target>
|
| 78 |
</Rule>
|
| 79 |
<Rule Effect="Deny" RuleId="deny-after-validity">
|
| 80 |
<Target>
|
| 81 |
<Environments>
|
| 82 |
<Environment>
|
| 83 |
<EnvironmentMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:dateTime-less-than">
|
| 84 |
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#dateTime">2026-09-23T23:59:59</AttributeValue>
|
| 85 |
<EnvironmentAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime" DataType="http://www.w3.org/2001/XMLSchema#dateTime"/>
|
| 86 |
</EnvironmentMatch>
|
| 87 |
</Environment>
|
| 88 |
</Environments>
|
| 89 |
</Target>
|
| 90 |
</Rule>
|
| 91 |
</Policy>
|
| 92 |
</PolicySet>
|