Identifying the calling organization?

[Farhan Ahmad]

Hi,

What is the suggested method for identifying the organization that the user might be using a FHIR app from?  I looked at Person.managingOrganization, Patient.managingOrganization and Patient.contact, but none of these are populated for the test patients.  Or, are we supposed to create a mapping based on what seems to be a UUID in the AccessToken.tenant?

Thanks!

Farhan Ahmad

CTO & Chief of Staff, HealthDecision

http://www.healthdecision.org

[Jenni Syed]

Hi Farhan,

When you state "organization" the references above make me think you're referring to the FHIR Organization. However, this is likely *not* the same thing as the business that purchased or who is launching the application.

Are you trying to infer where the app is running? IE: from what facility or doctors office? That may be more complicated, as some apps run off of iPads and other personal devices.

Even using the "managingOrganization" on the patient may not be getting what you expect - it can vary by patient, and may not be the same as the organization that the app is running at.

If you can describe what exactly the app needs (running, owning, launching), we may be able to determine if that's a concept represented in SMART or FHIR.

~ Jenni

[Farhan Ahmad]

Thanks for the response, Jenni.  The goal is to find the business (i.e. the healthcare system) that licensed our product.

- Farhan

[Jenni Syed]

The closest you'll get to that is likely the tenant in the SMART response. We allow or disallow applications access at that level.

~ Jenni

[Farhan Ahmad]

I did notice the tenant at one point.  Is that a unique identifier per healthcare system that Cerner has licensed?  Can we get any more details about it, or will that be a number that we will have to map internally?

Thanks,

Farhan

[Jenni Syed]

It's a unique identifier that you would need to map internally, at least currently. It may not be equivalent to healthcare system (because of mergers and other business adjustments) - you may want to allow more than one tenant per "healthcare system" because of these types of situations.

The OAuth setup itself (client id, redirect) wouldn't need to change per tenant since that approval and onboarding is done centrally for our server. Your application would need to be granted access to each tenant separately (essentially whitelisted) - though the system that licenses your application would let us know where to whitelist it if they had several tenants they were going to bring live on the application at the same time. 

~ Jenni

[Farhan Ahmad]

Sounds good.  Thanks for all the info!

- Farhan