carin_for_blue_button_test_kit 0.16.0 → 0.16.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6d96d5c99e0c8e38c3bb31f61d960bf7b4439e16ace2ddda24e7bd7779d15c85
-  data.tar.gz: 1e4afb65ed86d9421f3f0682349eac2ea1aa3df0be5eefc573c4ee9a9e08b60b
+  metadata.gz: d680d285101a8857f8f62e3e610f0e2179f70b187aa150ca2a2cf89c155a6bba
+  data.tar.gz: c3de78a66e608ba9004a31eb1ee71fda36aaa169604451d2366a5d87ac9c9ca9
 SHA512:
-  metadata.gz: ce35bfb3ca475f9c7bbf2a841644f9ec0d33be3cdb8290d1abbb37f29d30d420c3e2ff486feeb2f0885b59be633388a662715292712f3d3c71c1c893a544997c
-  data.tar.gz: 44e70501266e0ce800c2114dfac2f0a2e3fc8b1cfdeae59a32663cebe4ad4b8b6aa9dae37ad08add77f393dd49f058b87a7ee0e966aeea4ee13a428136b424ae
+  metadata.gz: 54e0235b88ac93056a8052af0079b6f6ff97477afba9de3f56b7fc7ab659abc37525094ef09192f13bf9f8cfedba2501a64349b412c8a7d2571cc98a1967fb17
+  data.tar.gz: 76cafa4ee9fc9da3e048e8bda33ee74eba3aa135c6d3e2879ab60171ecef5497bcdf6a32d0871151e2f6caa952a1f4163da86bf01f5db96378e82c027caa92b8

data/lib/carin_for_blue_button_test_kit/carin_search_test.rb

@@ -423,7 +423,7 @@ module CarinForBlueButtonTestKit
     def matched_base_resources(_resource, referenced_resource_types, returned_resources_all, values_found)
       included_refs = included_refs(returned_resources_all, referenced_resource_types)
 
-      values_found.select do |base_resource_references|
+      values_found.select { |value| value.is_a?(FHIR::Reference) }.select do |base_resource_references|
         included_refs.any? do |referenced_resource|
           reference_match?(base_resource_references.reference, referenced_resource)
         end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_client/authentication.rb

@@ -11,20 +11,43 @@ module CarinForBlueButtonTestKit
     verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@1',
                           'hl7.fhir.us.carin-bb_2.0.0@48'
 
+    input :c4bb_authentication_options,
+          title: 'Uses appropriate authentication',
+          description: %(
+            I attest that the Health IT Module
+              - Directed communication through authenticated, authorized, and secure channels.
+              - Used the SMART App Launch Framework’s standalone launch.
+          ),
+          type: 'radio',
+          default: 'false',
+          options: {
+            list_options: [
+              {
+                label: 'Yes',
+                value: 'true'
+              },
+              {
+                label: 'No',
+                value: 'false'
+              }
+            ]
+          }
+    input :c4bb_authentication_note,
+          title: 'Notes, if applicable:',
+          type: 'textarea',
+          optional: true
+
     run do
-      identifier = SecureRandom.hex(32)
-      wait(
-        identifier:,
-        message: <<~MESSAGE
-          I attest that the Health IT Module
-          - Directed communication through authenticated, authorized, and secure channels.
-          - Used the SMART App Launch Framework’s standalone launch.
+      assert c4bb_authentication_options == 'true', %(
+        The following was not satisfied:
 
-          [Click here](#{resume_pass_url}?token=#{identifier}) if the tester visually confirmed system **meets** these requirements.
+          The Health IT Module must
+          - Direct communication through authenticated, authorized, and secure channels.
+          - Use the SMART App Launch Framework’s standalone launch.
 
-          [Click here](#{resume_fail_url}?token=#{identifier}) if the tester visually confirmed system **does not meet** these requirements.
-        MESSAGE
       )
+      pass c4bb_authentication_note if c4bb_authentication_note.present?
     end
+
   end
-end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_client/last_updated.rb

@@ -13,19 +13,41 @@ module CarinForBlueButtonTestKit
                           'hl7.fhir.us.carin-bb_2.0.0@184',
                           'hl7.fhir.us.carin-bb_2.0.0@188'
 
+    input :c4bb_last_updated_options,
+          title: 'Uses meta.lastUpdated value appropriately',
+          description: %(
+            The developer of the Health IT Module attests that the Health IT Module used the
+              meta.lastUpdated value to determine if the associated data is accurate as of the date of service or as of the current date.
+          ),
+          type: 'radio',
+          default: 'false',
+          options: {
+            list_options: [
+              {
+                label: 'Yes',
+                value: 'true'
+              },
+              {
+                label: 'No',
+                value: 'false'
+              }
+            ]
+          }
+    input :c4bb_last_updated_note,
+          title: 'Notes, if applicable:',
+          type: 'textarea',
+          optional: true
+
     run do
-      identifier = SecureRandom.hex(32)
-      wait(
-        identifier:,
-        message: <<~MESSAGE
-          The developer of the Health IT Module attests that the Health IT Module used the
-          meta.lastUpdated value to determine if the associated data is accurate as of the date of service or as of the current date.
+      assert c4bb_last_updated_options == 'true', %(
+        The following was not satisfied:
 
-          [Click here](#{resume_pass_url}?token=#{identifier}) if the tester visually confirmed system **meets** these requirements.
+          The Health IT Module must use the meta.lastUpdated value to determine if the associated data is
+          accurate as of the date of service or as of the current date.
 
-          [Click here](#{resume_fail_url}?token=#{identifier}) if the tester visually confirmed system **does not meet** these requirements.
-        MESSAGE
       )
+      pass c4bb_last_updated_note if c4bb_last_updated_note.present?
     end
+
   end
-end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_client/must_support_absent_reason.rb

@@ -8,19 +8,40 @@ module CarinForBlueButtonTestKit
 
     verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@8'
 
+    input :c4bb_must_support_absent_reason_options,
+          title: 'Processes Must Support elements that assert missing information',
+          description: %(
+            The developer of the Health IT Module attests that the Health IT Module processed
+              Must Support elements that asserted missing information.
+          ),
+          type: 'radio',
+          default: 'false',
+          options: {
+            list_options: [
+              {
+                label: 'Yes',
+                value: 'true'
+              },
+              {
+                label: 'No',
+                value: 'false'
+              }
+            ]
+          }
+    input :c4bb_must_support_absent_reason_note,
+          title: 'Notes, if applicable:',
+          type: 'textarea',
+          optional: true
+
     run do
-      identifier = SecureRandom.hex(32)
-      wait(
-        identifier:,
-        message: <<~MESSAGE
-          The developer of the Health IT Module attests that the Health IT Module processed
-          Must Support elements that asserted missing information.
+      assert c4bb_must_support_absent_reason_options == 'true', %(
+        The following was not satisfied:
 
-          [Click here](#{resume_pass_url}?token=#{identifier}) if the tester visually confirmed system **meets** this requirement.
+          The Health IT Module must process Must Support elements that assert missing information.
 
-          [Click here](#{resume_fail_url}?token=#{identifier}) if the tester visually confirmed system **does not meet** this requirement.
-        MESSAGE
       )
+      pass c4bb_must_support_absent_reason_note if c4bb_must_support_absent_reason_note.present?
     end
+
   end
-end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_client/must_support_display.rb

@@ -8,19 +8,40 @@ module CarinForBlueButtonTestKit
 
     verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@4'
 
+    input :c4bb_must_support_display_options,
+          title: 'Can display Must Support data elements',
+          description: %(
+            The developer of the Health IT Module attests that the Health IT Module can display all
+              Must Support data elements for human use.
+          ),
+          type: 'radio',
+          default: 'false',
+          options: {
+            list_options: [
+              {
+                label: 'Yes',
+                value: 'true'
+              },
+              {
+                label: 'No',
+                value: 'false'
+              }
+            ]
+          }
+    input :c4bb_must_support_display_note,
+          title: 'Notes, if applicable:',
+          type: 'textarea',
+          optional: true
+
     run do
-      identifier = SecureRandom.hex(32)
-      wait(
-        identifier:,
-        message: <<~MESSAGE
-          The developer of the Health IT Module attests that the Health IT Module can display all
-          Must Support data elements for human use.
+      assert c4bb_must_support_display_options == 'true', %(
+        The following was not satisfied:
 
-          [Click here](#{resume_pass_url}?token=#{identifier}) if the tester visually confirmed system **meets** this requirement.
+          The Health IT Module must be capable of displaying all Must Support data elements.
 
-          [Click here](#{resume_fail_url}?token=#{identifier}) if the tester visually confirmed system **does not meet** this requirement.
-        MESSAGE
       )
+      pass c4bb_must_support_display_note if c4bb_must_support_display_note.present?
     end
+
   end
-end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_client/must_support_missing.rb

@@ -9,19 +9,41 @@ module CarinForBlueButtonTestKit
 
     verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@6'
 
+    input :c4bb_must_support_missing_options,
+          title: 'Interprets missing Must Support data elements',
+          description: %(
+            The developer of the Health IT Module attests that the Health IT Module interpreted missing Must Support
+              data elements within resource instances as data not present in the Health Plan API actors system.
+          ),
+          type: 'radio',
+          default: 'false',
+          options: {
+            list_options: [
+              {
+                label: 'Yes',
+                value: 'true'
+              },
+              {
+                label: 'No',
+                value: 'false'
+              }
+            ]
+          }
+    input :c4bb_must_support_missing_note,
+          title: 'Notes, if applicable:',
+          type: 'textarea',
+          optional: true
+
     run do
-      identifier = SecureRandom.hex(32)
-      wait(
-        identifier:,
-        message: <<~MESSAGE
-          The developer of the Health IT Module attests that the Health IT Module interpreted missing Must Support
-          data elements within resource instances as data not present in the Health Plan API actors system.
+      assert c4bb_must_support_missing_options == 'true', %(
+        The following was not satisfied:
 
-          [Click here](#{resume_pass_url}?token=#{identifier}) if the tester visually confirmed system **meets** this requirement.
+          The Health IT Module must interpret missing Must Support data elements within resource instances as
+          data not present in the Health Plan API actors system.
 
-          [Click here](#{resume_fail_url}?token=#{identifier}) if the tester visually confirmed system **does not meet** this requirement.
-        MESSAGE
       )
+      pass c4bb_must_support_missing_note if c4bb_must_support_missing_note.present?
     end
+
   end
-end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_server/00_authorization_group/attestation_test_requirement_48.rb

@@ -23,12 +23,45 @@ module CarinForBlueButtonTestKit
                           'hl7.fhir.us.carin-bb_2.0.0@55',
                           'hl7.fhir.us.carin-bb_2.0.0@57'
 
+    input :carin_server_requirement_48_57_attestation_options,
+          title: 'Secures data',
+          description: %(
+            I attest that the Health IT Module
+              - Enables members to direct the communication of CARIN4BB data through authenticated, authorized, and secure channels.
+              - Protects CARIN4BB data with proper security and privacy protections to avoid malicious or unintentional exposure of
+                such information.
+              - Secures all consumer-directed payer data exchanges in transit and limits access only to authorized individuals.
+              - Ensures that APIs fully and successfully implement privacy and security features such as, but not limited to, those
+                required to comply with HIPAA privacy and security requirements and other applicable law protecting the privacy and
+                security of protected health information.
+              - Uses either current or the immediately prior release of Transport Level Security (TLS) as specified by the current release
+                of NIST guidelines (SP 800-52).
+              - Supports the FHIR US Core [Patient Privacy and Security requirements](https://www.hl7.org/fhir/us/core/security.html).
+          ),
+          type: 'radio',
+          default: 'false',
+          options: {
+            list_options: [
+              {
+                label: 'Yes',
+                value: 'true'
+              },
+              {
+                label: 'No',
+                value: 'false'
+              }
+            ]
+          }
+    input :carin_server_requirement_48_57_attestation_note,
+          title: 'Notes, if applicable:',
+          type: 'textarea',
+          optional: true
+
     run do
-      identifier = SecureRandom.hex(32)
-      wait(
-        identifier:,
-        message: <<~MESSAGE
-          I attest that the Health IT Module
+      assert carin_server_requirement_48_57_attestation_options == 'true', %(
+        The following was not satisfied:
+
+          The Health IT Module
           - Enables members to direct the communication of CARIN4BB data through authenticated, authorized, and secure channels.
           - Protects CARIN4BB data with proper security and privacy protections to avoid malicious or unintentional exposure of
             such information.
@@ -40,11 +73,9 @@ module CarinForBlueButtonTestKit
             of NIST guidelines (SP 800-52).
           - Supports the FHIR US Core [Patient Privacy and Security requirements](https://www.hl7.org/fhir/us/core/security.html).
 
-          [Click here](#{resume_pass_url}?token=#{identifier}) if the system **meets** these requirements.
-
-          [Click here](#{resume_fail_url}?token=#{identifier}) if the system **does not meet** these requirements.
-        MESSAGE
       )
+      pass carin_server_requirement_48_57_attestation_note if carin_server_requirement_48_57_attestation_note.present?
     end
+
   end
 end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_server/00_authorization_group/attestation_test_requirement_60.rb

@@ -23,11 +23,42 @@ module CarinForBlueButtonTestKit
                           'hl7.fhir.us.carin-bb_2.0.0@66',
                           'hl7.fhir.us.carin-bb_2.0.0@67'
 
+    input :carin_server_requirement_60_67_attestation_options,
+          title: 'Supports SMART Core Capabilities',
+          description: %(
+            The Health IT Module supports the following “SMART Core Capabilities”:
+              - `launch-standalone`: support for SMART’s Standalone Launch mode
+              - `client-public`: support for SMART’s public client profile (no client authentication)
+              - `client-confidential-symmetric`: support for SMART’s confidential client profile
+              - `sso-openid-connect`: support for SMART’s OpenID Connect profile
+              - `context-standalone-patient`: support for patient-level launch context (requested by launch/patient scope, conveyed via patient token parameter)
+              - `permission-offline`: support for refresh tokens (requested by offline_access scope)
+              - `permission-patient`: support for patient-level scopes (e.g. patient Observation.read)
+              - `permission-user`: support for user-level scopes (e.g. user/Appointment.read)
+          ),
+          type: 'radio',
+          default: 'false',
+          options: {
+            list_options: [
+              {
+                label: 'Yes',
+                value: 'true'
+              },
+              {
+                label: 'No',
+                value: 'false'
+              }
+            ]
+          }
+    input :carin_server_requirement_60_67_attestation_note,
+          title: 'Notes, if applicable:',
+          type: 'textarea',
+          optional: true
+
     run do
-      identifier = SecureRandom.hex(32)
-      wait(
-        identifier:,
-        message: <<~MESSAGE
+      assert carin_server_requirement_60_67_attestation_options == 'true', %(
+        The following was not satisfied:
+
           The Health IT Module supports the following “SMART Core Capabilities”:
           - `launch-standalone`: support for SMART’s Standalone Launch mode
           - `client-public`: support for SMART’s public client profile (no client authentication)
@@ -38,11 +69,9 @@ module CarinForBlueButtonTestKit
           - `permission-patient`: support for patient-level scopes (e.g. patient Observation.read)
           - `permission-user`: support for user-level scopes (e.g. user/Appointment.read)
 
-          [Click here](#{resume_pass_url}?token=#{identifier}) if the system **meets** these requirements.
-
-          [Click here](#{resume_fail_url}?token=#{identifier}) if the system **does not meet** these requirements.
-        MESSAGE
       )
+      pass carin_server_requirement_60_67_attestation_note if carin_server_requirement_60_67_attestation_note.present?
     end
+
   end
 end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_server/00_authorization_group/attestation_test_requirement_97.rb

@@ -16,26 +16,55 @@ module CarinForBlueButtonTestKit
 
     verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@97', 'hl7.fhir.us.carin-bb_2.0.0@102'
 
+    input :carin_server_requirement_97_attestation_options,
+          title: 'Responds with appropriate error codes',
+          description: %(
+            I attest that the Health IT Module returns the following response classes:
+              - (Status 400): invalid parameter
+              - (Status 401/4xx): unauthorized request
+              - (Status 403): insufficient scope
+              - (Status 404): unknown resource
+              - (Status 410): deleted resource
+
+              I further attest that the Health IT Module rejects any unauthorized request by returning an HTTP 401 "Unauthorized",
+              HTTP 403 "Forbidden", or HTTP 404 "Not Found".
+          ),
+          type: 'radio',
+          default: 'false',
+          options: {
+            list_options: [
+              {
+                label: 'Yes',
+                value: 'true'
+              },
+              {
+                label: 'No',
+                value: 'false'
+              }
+            ]
+          }
+    input :carin_server_requirement_97_attestation_note,
+          title: 'Notes, if applicable:',
+          type: 'textarea',
+          optional: true
+
     run do
-      identifier = SecureRandom.hex(32)
-      wait(
-        identifier:,
-        message: <<~MESSAGE
-          I attest that the Health IT Module returns the following response classes:
+      assert carin_server_requirement_97_attestation_options == 'true', %(
+        The following was not satisfied:
+
+          The Health IT Module returns the following response classes:
           - (Status 400): invalid parameter
           - (Status 401/4xx): unauthorized request
           - (Status 403): insufficient scope
           - (Status 404): unknown resource
           - (Status 410): deleted resource
 
-          I further attest that the Health IT Module rejects any unauthorized request by returning an HTTP 401 "Unauthorized",
-          HTTP 403 "Forbidden", or HTTP 404 "Not Found".
+          The Health IT Module rejects any unauthorized request by returning an HTTP 401 "Unauthorized", HTTP 403 "Forbidden",
+          or HTTP 404 "Not Found".
 
-          [Click here](#{resume_pass_url}?token=#{identifier}) if the system **meets** these requirements.
-
-          [Click here](#{resume_fail_url}?token=#{identifier}) if the system **does not meet** these requirements.
-        MESSAGE
       )
+      pass carin_server_requirement_97_attestation_note if carin_server_requirement_97_attestation_note.present?
     end
+
   end
 end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_server/01_must_support_group/attestation_test_requirement_10.rb

@@ -9,18 +9,41 @@ module CarinForBlueButtonTestKit
 
     verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@10'
 
+    input :carin_server_requirement_10_attestation_options,
+          title: 'Follows FHIR and US Core guidance when data is unavailable',
+          description: %(
+            I attest that the Health IT Module applies FHIR and US Core guidance
+              when the source system lacks data for required elements with minimum cardinality > 0.
+          ),
+          type: 'radio',
+          default: 'false',
+          options: {
+            list_options: [
+              {
+                label: 'Yes',
+                value: 'true'
+              },
+              {
+                label: 'No',
+                value: 'false'
+              }
+            ]
+          }
+    input :carin_server_requirement_10_attestation_note,
+          title: 'Notes, if applicable:',
+          type: 'textarea',
+          optional: true
+
     run do
-      identifier = SecureRandom.hex(32)
-      wait(
-        identifier:,
-        message: <<~MESSAGE
-          I attest that the Health IT Module applies FHIR and US Core guidance
-          when the source system lacks data for required elements with minimum cardinality > 0.
+      assert carin_server_requirement_10_attestation_options == 'true', %(
+        The following was not satisfied:
+
+          The Health IT Module follows the FHIR core specification and US Core guidance when no data is available
+          for required data elements (minimum cardinality > 0).
 
-          [Click here](#{resume_pass_url}?token=#{identifier}) if the system **meets** this requirement.
-          [Click here](#{resume_fail_url}?token=#{identifier}) if the system **does not meet** this requirement.
-        MESSAGE
       )
+      pass carin_server_requirement_10_attestation_note if carin_server_requirement_10_attestation_note.present?
     end
+
   end
 end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_server/01_must_support_group/attestation_test_requirement_2.rb

@@ -10,20 +10,43 @@ module CarinForBlueButtonTestKit
 
     verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@2'
 
+    input :carin_server_requirement_2_attestation_options,
+          title: 'Returns maintained data',
+          description: %(
+            I attest that the Health IT Module is capable of populating and returning all data elements maintained
+              by the payer as part of the query results, as specified by the CARIN Blue Button Health Plan API
+              CapabilityStatement.
+          ),
+          type: 'radio',
+          default: 'false',
+          options: {
+            list_options: [
+              {
+                label: 'Yes',
+                value: 'true'
+              },
+              {
+                label: 'No',
+                value: 'false'
+              }
+            ]
+          }
+    input :carin_server_requirement_2_attestation_note,
+          title: 'Notes, if applicable:',
+          type: 'textarea',
+          optional: true
+
     run do
-      identifier = SecureRandom.hex(32)
-      wait(
-        identifier:,
-        message: <<~MESSAGE
-          I attest that the Health IT Module is capable of populating and returning all data elements maintained
+      assert carin_server_requirement_2_attestation_options == 'true', %(
+        The following was not satisfied:
+
+          The Health IT Module is capable of populating and returning all data elements maintained
           by the payer as part of the query results, as specified by the CARIN Blue Button Health Plan API
           CapabilityStatement.
 
-          [Click here](#{resume_pass_url}?token=#{identifier}) if the system **meets** this requirement.
-
-          [Click here](#{resume_fail_url}?token=#{identifier}) if the system **does not meet** this requirement.
-        MESSAGE
       )
+      pass carin_server_requirement_2_attestation_note if carin_server_requirement_2_attestation_note.present?
     end
+
   end
 end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_server/01_must_support_group/attestation_test_requirement_5.rb

@@ -10,20 +10,43 @@ module CarinForBlueButtonTestKit
 
     verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@5'
 
+    input :carin_server_requirement_5_attestation_options,
+          title: 'Does not include absent data with unknown reason',
+          description: %(
+            I attest that in situations where information for a particular data element is not present and
+              the reason for its absence is unknown, the Health IT Module does not include the data element in
+              the resource instance returned as part of the query results.
+          ),
+          type: 'radio',
+          default: 'false',
+          options: {
+            list_options: [
+              {
+                label: 'Yes',
+                value: 'true'
+              },
+              {
+                label: 'No',
+                value: 'false'
+              }
+            ]
+          }
+    input :carin_server_requirement_5_attestation_note,
+          title: 'Notes, if applicable:',
+          type: 'textarea',
+          optional: true
+
     run do
-      identifier = SecureRandom.hex(32)
-      wait(
-        identifier:,
-        message: <<~MESSAGE
-          I attest that in situations where information for a particular data element is not present and
+      assert carin_server_requirement_5_attestation_options == 'true', %(
+        The following was not satisfied:
+
+          In situations where information for a particular data element is not present and
           the reason for its absence is unknown, the Health IT Module does not include the data element in
           the resource instance returned as part of the query results.
 
-          [Click here](#{resume_pass_url}?token=#{identifier}) if the system **meets** this requirement.
-
-          [Click here](#{resume_fail_url}?token=#{identifier}) if the system **does not meet** this requirement.
-        MESSAGE
       )
+      pass carin_server_requirement_5_attestation_note if carin_server_requirement_5_attestation_note.present?
     end
+
   end
 end