davinci_crd_test_kit 0.14.1 → 0.14.2

data/lib/davinci_crd_test_kit/cross_suite/requests_logical_model_validation.rb

@@ -13,15 +13,10 @@ module DaVinciCRDTestKit
       'Practitioner', 'PractitionerRole'
     ].freeze
 
-    def validate_request_against_logical_model(request_body, request_index, ig_semver)
-      if ig_semver == '2.2.1'
-        check_logical_model_conformance_no_resource_checks(request_body, request_index, ig_semver)
-      else
-        conforms_to_logical_model?(request_body, "#{CRD_CDS_HOOK_REQUEST_MODEL_URL}|#{ig_semver}",
-                                   message_prefix: "(Request #{request_index + 1}) ")
-      end
+    def validate_request_against_logical_model(request_body, request_index, ig_semver, validator: :default)
+      check_logical_model_conformance_no_resource_checks(request_body, request_index, ig_semver, validator:)
 
-      perform_version_specific_additional_verification(request_body, request_index, ig_semver)
+      perform_version_specific_additional_verification(request_body, request_index, ig_semver, validator:)
     end
 
     private
@@ -30,84 +25,88 @@ module DaVinciCRDTestKit
     # Additional Validation to cover areas not checked or checked incorrectly by the logical models
     # -------------------------------------------------------------------------
 
-    def perform_version_specific_additional_verification(request_body, request_index, ig_semver)
+    def perform_version_specific_additional_verification(request_body, request_index, ig_semver, validator: :default)
       case ig_semver
       when '2.2.1'
-        perform_v221_additional_verification(request_body, request_index)
+        perform_v221_additional_verification(request_body, request_index, validator:)
       end
     end
 
-    def perform_v221_additional_verification(request_body, request_index)
+    def perform_v221_additional_verification(request_body, request_index, validator: :default)
       check_context_resources_for_ids(request_body, request_index)
       check_relative_references(request_body, request_index)
-      check_context_resource_profiles(request_body, request_index, '2.2.1')
+      check_context_resource_profiles(request_body, request_index, '2.2.1', validator:)
     end
 
     # -------------------------------------------------------------------------
     # Context resources profile check (not working in v2.2.1 logical models)
     # -------------------------------------------------------------------------
 
-    def check_logical_model_conformance_no_resource_checks(request_body, request_index, ig_semver)
+    def check_logical_model_conformance_no_resource_checks(request_body, request_index, ig_semver, validator: :default)
       validation_issues = []
       conforms_to_logical_model?(request_body, "#{CRD_CDS_HOOK_REQUEST_MODEL_URL}|#{ig_semver}",
-                                 add_messages_to_runnable: false, validator_response_details: validation_issues)
+                                 add_messages_to_runnable: false, validator_response_details: validation_issues,
+                                 validator:)
 
-      reject_resource_issues(validation_issues).each do |issue|
+      filtered_issues = reject_resource_issues(validation_issues)
+      filter_logical_model_extension_issues(filtered_issues, validator)
+      filtered_issues.each do |issue|
         next if issue.filtered
 
         add_message(issue.severity, "(Request #{request_index + 1}) #{issue.message}")
       end
     end
 
-    def check_context_resource_profiles(request_body, request_index, ig_semver)
+    def check_context_resource_profiles(request_body, request_index, ig_semver, validator: :default)
       case request_body['hook']
       when 'order-sign', 'order-select'
-        draft_orders_conform_to_profiles?(request_body, request_index, ig_semver)
+        draft_orders_conform_to_profiles?(request_body, request_index, ig_semver, validator:)
       when 'order-dispatch'
         request_body.dig('context', 'fulfillmentTasks')&.each_with_index do |task, index|
           resource = FHIR.from_contents(task.to_json)
           resource_is_valid?(resource:, profile_url: "http://hl7.org/fhir/us/davinci-crd/StructureDefinition/profile-task-dispatch|#{ig_semver}",
-                             message_prefix: "(Request #{request_index + 1}) " \
-                                             "context.fulfillmentTasks entry #{index + 1} - ")
+                             validator:, message_prefix: "(Request #{request_index + 1}) " \
+                                                         "context.fulfillmentTasks entry #{index + 1} - ")
         end
       when 'appointment-book'
-        check_appointments_profiles(request_body, request_index, ig_semver)
+        check_appointments_profiles(request_body, request_index, ig_semver, validator:)
       end
     rescue JSON::ParserError
       nil # no resource to validate - error found elsewhere
     end
 
-    def draft_orders_conform_to_profiles?(request_body, request_index, ig_semver)
+    def draft_orders_conform_to_profiles?(request_body, request_index, ig_semver, validator: :default)
       draft_orders = request_body.dig('context', 'draftOrders').to_json
       resource = FHIR.from_contents(draft_orders)
       resource_is_valid?(resource:, profile_url: "http://hl7.org/fhir/us/davinci-crd/StructureDefinition/profile-bundle-request|#{ig_semver}",
-                         message_prefix: "(Request #{request_index + 1}) context.draftOrders - ")
+                         message_prefix: "(Request #{request_index + 1}) context.draftOrders - ", validator:)
     end
 
     # -------------------------------------------------------------------------
     # Appointment conformance (requires extra help to decide profile and check profile-based slicing)
     # -------------------------------------------------------------------------
 
-    def check_appointments_profiles(request_body, request_index, ig_semver)
+    def check_appointments_profiles(request_body, request_index, ig_semver, validator: :default)
       resource = FHIR.from_contents(request_body.dig('context', 'appointments')&.to_json)
       return unless resource.is_a?(FHIR::Bundle)
 
       check_bundle_non_entry_resource_conformance(resource,
                                                   "(Request #{request_index + 1}) context.appointments - ",
-                                                  ig_semver)
+                                                  ig_semver,
+                                                  validator:)
 
       resource.entry.each_with_index do |entry, entry_index|
         next unless entry.resource.present? # error caught on Bundle validation
 
         error_prefix = "(Request #{request_index + 1}) context.appointments entry #{entry_index + 1} - "
-        check_appointment_conformance(entry.resource, request_body, error_prefix, ig_semver)
+        check_appointment_conformance(entry.resource, request_body, error_prefix, ig_semver, validator:)
       end
     end
 
-    def check_bundle_non_entry_resource_conformance(bundle, error_prefix, ig_semver)
+    def check_bundle_non_entry_resource_conformance(bundle, error_prefix, ig_semver, validator: :default)
       validation_issues = []
       resource_is_valid?(resource: bundle, profile_url: "http://hl7.org/fhir/us/davinci-crd/StructureDefinition/profile-bundle-base|#{ig_semver}",
-                         add_messages_to_runnable: false, validator_response_details: validation_issues)
+                         add_messages_to_runnable: false, validator_response_details: validation_issues, validator:)
 
       reject_entry_resource_issues(validation_issues).each do |issue|
         add_message(issue.severity, "#{error_prefix}#{issue.message}")

data/lib/davinci_crd_test_kit/cross_suite/response_logical_model_validation.rb

@@ -39,21 +39,24 @@ module DaVinciCRDTestKit
       "#{CRD_LOGICAL_MODEL_BASE}/#{profile_name}"
     end
 
-    def perform_response_logical_model_validation(cards, system_actions, request_body, response_index, ig_semver)
+    def perform_response_logical_model_validation(cards, system_actions, request_body, response_index, ig_semver,
+                                                  validator: :default)
       if cards.is_a?(Array)
         cards.each_with_index do |card, card_index|
-          validate_card_against_logical_model(card, response_index, request_body, card_index, ig_semver)
+          validate_card_against_logical_model(card, response_index, request_body, card_index, ig_semver, validator:)
         end
       end
 
       return unless system_actions.is_a?(Array)
 
       system_actions.each_with_index do |action, action_index|
-        validate_system_action_against_logical_model(action, response_index, request_body, action_index, ig_semver)
+        validate_system_action_against_logical_model(action, response_index, request_body, action_index, ig_semver,
+                                                     validator:)
       end
     end
 
-    def validate_card_against_logical_model(card, response_index, request_body, card_index, ig_semver)
+    def validate_card_against_logical_model(card, response_index, request_body, card_index, ig_semver,
+                                            validator: :default)
       label = logical_model_entity_label(response_index, card_index, 'card')
       unless card.is_a?(Hash)
         add_message('error', "#{label} is not a JSON object; skipping logical model validation.")
@@ -71,7 +74,8 @@ module DaVinciCRDTestKit
 
       validation_issues = []
       conforms_to_logical_model?({ 'cards' => [card] }, logical_model_url(profile_name),
-                                 add_messages_to_runnable: false, validator_response_details: validation_issues)
+                                 add_messages_to_runnable: false, validator_response_details: validation_issues,
+                                 validator:)
 
       validate_summary_length(card, label)
       validate_suggestion_uuid_presence(card, label) unless ['v201', '2.0.1'].include? ig_semver
@@ -79,7 +83,8 @@ module DaVinciCRDTestKit
 
       error_prefix = "#{label} (#{card_type || 'uncategorized'}): "
       filtered_issues = manually_check_card_specific_errors(card, validation_issues, card_type,
-                                                            request_body, error_prefix, ig_semver)
+                                                            request_body, error_prefix, ig_semver, validator:)
+      filter_logical_model_extension_issues(filtered_issues, validator)
       add_messages_not_excluded(filtered_issues, error_prefix)
     end
 
@@ -123,7 +128,8 @@ module DaVinciCRDTestKit
       )
     end
 
-    def validate_system_action_against_logical_model(action, response_index, request_body, action_index, ig_semver)
+    def validate_system_action_against_logical_model(action, response_index, request_body, action_index, ig_semver,
+                                                     validator: :default)
       label = logical_model_entity_label(response_index, action_index, 'systemAction')
       unless action.is_a?(Hash)
         add_message('error', "#{label} is not a JSON object; skipping logical model validation.")
@@ -146,11 +152,12 @@ module DaVinciCRDTestKit
 
       validation_issues = []
       conforms_to_logical_model?({ 'systemActions' => [action] }, logical_model_url(profile_name),
-                                 add_messages_to_runnable: false, validator_response_details: validation_issues)
+                                 add_messages_to_runnable: false, validator_response_details: validation_issues,
+                                 validator:)
 
       validation_issues
         .reject! do |issue|
-          issue.message.match?(%r{The extension definition http://hl7\.org/fhir/us/davinci-crd/StructureDefinition/CDSHookServiceResponseExtensionIfNoneExist|2\.2\.1 defines the contexts of use as.*CDSHooksResponse.systemActions.extension\z}) # rubocop:disable Layout/LineLength
+          issue.message.match?(%r{CDSHooksResponse\.systemActions\[\d+\]\.extension: The extension definition http://hl7\.org/fhir/us/davinci-crd/StructureDefinition/CDSHookServiceResponseExtensionIfNoneExist\|2\.2\.1 defines the contexts of use as}) # rubocop:disable Layout/LineLength
         end
 
       if action_type == CardsIdentification::COVERAGE_INFORMATION_RESPONSE_TYPE
@@ -158,7 +165,8 @@ module DaVinciCRDTestKit
       end
       error_prefix = "#{label} (#{action_type || 'uncategorized'}): "
       filtered_issues = manually_check_action_specific_errors(action, validation_issues, action_type,
-                                                              request_body, error_prefix, ig_semver)
+                                                              request_body, error_prefix, ig_semver, validator:)
+      filter_logical_model_extension_issues(filtered_issues, validator)
       add_messages_not_excluded(filtered_issues, error_prefix)
     end
 
@@ -253,7 +261,7 @@ module DaVinciCRDTestKit
 
     def add_messages_not_excluded(issues, error_prefix)
       issues.each do |issue|
-        next if issue.filtered || logical_model_extension_issue?(issue)
+        next if issue.filtered
 
         add_message(issue.severity, "#{error_prefix}#{issue.message}")
       end
@@ -267,21 +275,17 @@ module DaVinciCRDTestKit
     # Validator Filtering and Manual Checks Depending on the Card Type
     # -------------------------------------------------------------------------
 
-    def logical_model_extension_issue?(issue)
-      issue.message.match(/\.extension: Unrecognized property/).present?
-    end
-
     def manually_check_card_specific_errors(card, validation_issues, card_type, request_body, error_prefix,
-                                            ig_semver)
+                                            ig_semver, validator: :default)
       case card_type
       when CardsIdentification::FORM_COMPLETION_RESPONSE_TYPE
-        manually_check_form_completion_errors(card, validation_issues, error_prefix)
+        manually_check_form_completion_errors(card, validation_issues, error_prefix, validator:)
       when CardsIdentification::PROPOSE_ALTERNATIVE_REQUEST_RESPONSE_TYPE
         manually_check_propose_alternative_errors(card, validation_issues, request_body,
-                                                  error_prefix, ig_semver)
+                                                  error_prefix, ig_semver, validator:)
       when CardsIdentification::ADDITIONAL_ORDERS_RESPONSE_TYPE
         manually_check_additional_orders_errors(card, validation_issues, request_body,
-                                                error_prefix, ig_semver)
+                                                error_prefix, ig_semver, validator:)
       when CardsIdentification::LAUNCH_SMART_APP_RESPONSE_TYPE
         manually_check_launch_smart_app_errors(validation_issues)
       else
@@ -290,26 +294,26 @@ module DaVinciCRDTestKit
     end
 
     def manually_check_action_specific_errors(action, validation_issues, action_type, request_body,
-                                              error_prefix, ig_semver)
+                                              error_prefix, ig_semver, validator: :default)
       case action_type
       when DaVinciCRDTestKit::CardsIdentification::COVERAGE_INFORMATION_RESPONSE_TYPE
         manually_check_coverage_information_errors(action, validation_issues, request_body,
-                                                   error_prefix, ig_semver)
+                                                   error_prefix, ig_semver, validator:)
       when DaVinciCRDTestKit::CardsIdentification::CREATE_OR_UPDATE_COVERAGE_RESPONSE_TYPE
         manually_check_update_coverage_action_errors(action, validation_issues,
-                                                     error_prefix, ig_semver)
+                                                     error_prefix, ig_semver, validator:)
       when DaVinciCRDTestKit::CardsIdentification::FORM_COMPLETION_RESPONSE_TYPE
         manually_check_form_completion_action_errors(action, validation_issues,
-                                                     error_prefix, ig_semver)
+                                                     error_prefix, ig_semver, validator:)
       else
         validation_issues
       end
     end
 
-    def manually_check_form_completion_errors(card, validation_issues, error_prefix)
+    def manually_check_form_completion_errors(card, validation_issues, error_prefix, validator: :default)
       validation_issues.reject do |issue|
         if issue.message.match?(/The type 'Questionnaire' is not valid - must be Task/)
-          check_questionnaire_actions(card, issue.message, error_prefix)
+          check_questionnaire_actions(card, issue.message, error_prefix, validator:)
           true
         else
           false
@@ -317,7 +321,7 @@ module DaVinciCRDTestKit
       end
     end
 
-    def check_questionnaire_actions(card, error_message, error_prefix)
+    def check_questionnaire_actions(card, error_message, error_prefix, validator: :default)
       extracted_indexes =
         error_message.match(/CDSHooksResponse\.cards\[0\]\.suggestions\[(\d+)\]\.actions\[(\d+)\]\.resource/)
       unless extracted_indexes
@@ -330,7 +334,7 @@ module DaVinciCRDTestKit
 
       message_prefix = "#{error_prefix} suggestion #{suggestion_index + 1}, action #{action_index + 1} - "
       resource = FHIR.from_contents(card['suggestions'][suggestion_index]['actions'][action_index]['resource'].to_json)
-      resource_is_valid?(resource:, message_prefix:) # no questionnaire profile applied per CRD
+      resource_is_valid?(resource:, message_prefix:, validator:) # no questionnaire profile applied per CRD
 
       return if resource.id.present?
 
@@ -344,12 +348,13 @@ module DaVinciCRDTestKit
     end
 
     def manually_check_propose_alternative_errors(card, validation_issues, request_body,
-                                                  error_prefix, ig_semver)
+                                                  error_prefix, ig_semver, validator: :default)
       no_resource_issues = manually_check_action_resources_for_order_profile_conformance(card,
                                                                                          validation_issues,
                                                                                          request_body,
                                                                                          error_prefix,
-                                                                                         ig_semver)
+                                                                                         ig_semver,
+                                                                                         validator:)
 
       no_resource_issues.each do |issue|
         next unless issue.message.match?(/Constraint failed: crd-respar-1/)
@@ -368,23 +373,24 @@ module DaVinciCRDTestKit
     end
 
     def manually_check_additional_orders_errors(card, validation_issues, request_body,
-                                                error_prefix, ig_semver)
+                                                error_prefix, ig_semver, validator: :default)
       manually_check_action_resources_for_order_profile_conformance(card,
                                                                     validation_issues,
                                                                     request_body,
                                                                     error_prefix,
-                                                                    ig_semver)
+                                                                    ig_semver,
+                                                                    validator:)
     end
 
     def manually_check_action_resources_for_order_profile_conformance(card, validation_issues, request_body,
-                                                                      error_prefix, ig_semver)
+                                                                      error_prefix, ig_semver, validator: :default)
       if card['suggestions'].present?
         card['suggestions'].each_with_index do |suggestion, suggestion_index|
           next unless suggestion['actions'].present?
 
           suggestion['actions'].each_with_index do |action, action_index|
             action_error_prefix = "#{error_prefix}suggestion #{suggestion_index + 1}, action #{action_index + 1} - "
-            check_action_target(action, request_body, action_error_prefix, ig_semver)
+            check_action_target(action, request_body, action_error_prefix, ig_semver, validator:)
           end
         end
       end
@@ -392,36 +398,37 @@ module DaVinciCRDTestKit
       reject_resource_issues(validation_issues)
     end
 
-    def check_action_target(action, request_body, error_prefix, ig_semver)
+    def check_action_target(action, request_body, error_prefix, ig_semver, validator: :default)
       local_reference?(action['resourceId'], error_prefix) if action['resourceId'].present?
       return unless action['resource'].present?
 
-      check_resource_conformance_to_order_profile(action['resource'], request_body, error_prefix, ig_semver)
+      check_resource_conformance_to_order_profile(action['resource'], request_body, error_prefix, ig_semver, validator:)
     end
 
     def manually_check_coverage_information_errors(action, validation_issues, request_body,
-                                                   error_prefix, ig_semver)
+                                                   error_prefix, ig_semver, validator: :default)
       if action['resource'].present?
         check_resource_conformance_to_order_or_encounter_profile(action['resource'], request_body,
-                                                                 error_prefix, ig_semver)
+                                                                 error_prefix, ig_semver, validator:)
       end
       reject_resource_issues(validation_issues)
     end
 
     def manually_check_update_coverage_action_errors(action, validation_issues,
-                                                     error_prefix, ig_semver)
+                                                     error_prefix, ig_semver, validator: :default)
       check_required_action_type(action, 'update', error_prefix, 'coverage update action response type')
       if action['resource'].present?
-        check_resource_conformance_to_coverage_profile(action['resource'], error_prefix, ig_semver)
+        check_resource_conformance_to_coverage_profile(action['resource'], error_prefix, ig_semver, validator:)
       end
       reject_resource_issues(validation_issues)
     end
 
     def manually_check_form_completion_action_errors(action, validation_issues,
-                                                     error_prefix, ig_semver)
+                                                     error_prefix, ig_semver, validator: :default)
       check_required_action_type(action, 'create', error_prefix, 'form completion action response type')
       if action['resource'].present?
-        check_resource_conformance_to_questionnaire_task_profile(action['resource'], error_prefix, ig_semver)
+        check_resource_conformance_to_questionnaire_task_profile(action['resource'], error_prefix, ig_semver,
+                                                                 validator:)
       end
       reject_resource_issues(validation_issues)
     end

data/lib/davinci_crd_test_kit/cross_suite/tags.rb

@@ -7,12 +7,15 @@ module DaVinciCRDTestKit
   ORDER_SIGN_TAG = 'order-sign'.freeze
   DISCOVERY_TAG = 'cds_discovery'.freeze
   ANY_HOOK_TAG = 'any_hook'.freeze
+  CROSS_HOOK_ANALYSIS_TAG = 'cross_hook'.freeze
   DATA_FETCH_TAG = 'data_fetch'.freeze
   PAYER_ORG_FETCH_TAG = 'payer_org'.freeze
   PARENT_LOCATION_FETCH_TAG = 'parent_location'.freeze
   HOOK_INSTANCE_TAG_PREFIX = 'hi_'.freeze
   HOOK_INSTANCE_DATA_FETCH_TAG_PREFIX = 'hi_data_fetch_'.freeze
   LONG_RUNNING_GROUP_TAG = 'long_running_request'.freeze
+  UNKNOWN_CONTENT_GROUP_TAG = 'unknown_content_request'.freeze
+  SELF_PAY_GROUP_TAG = 'self_pay_request'.freeze
   DUPLICATED_HOOK_INSTANCE_TAG = 'duplicate_hook_instance'.freeze
   COVERAGE_INFO_DISABLED_TAG = 'coverage-info-disabled'.freeze
   TECHNICAL_ISSUES_TAG = 'technical-issues'.freeze

data/lib/davinci_crd_test_kit/requirements/davinci_crd_test_kit_requirements.csv

@@ -1216,7 +1216,7 @@ hl7.fhir.us.davinci-crd_2.2.1,hook-35,https://hl7.org/fhir/us/davinci-crd/2.2.1/
 hl7.fhir.us.davinci-crd_2.2.1,hook-36,https://hl7.org/fhir/us/davinci-crd/2.2.1/en/hooks.html#ci-c-hook-36,"Where CRD Clients have an appropriate workflow and data capture mechanism, the order-select hook **MAY** be used in scenarios that do not involve creating a true order.",MAY,CRD Client,,true,,
 hl7.fhir.us.davinci-crd_2.2.1,hook-37,https://hl7.org/fhir/us/davinci-crd/2.2.1/en/hooks.html#ci-c-hook-37,The 'context' field in invocations of the order-sign hook **SHALL** conform to the logical model specified [here](https://hl7.org/fhir/us/davinci-crd/2.2.1/en/StructureDefinition-CRDOrderSignContext.html),SHALL,CRD Client,,true,,
 hl7.fhir.us.davinci-crd_2.2.1,hook-38,https://hl7.org/fhir/us/davinci-crd/2.2.1/en/hooks.html#ci-c-hook-38,CRD Servers **MAY** use the order-sign hook as a basis for associating a patient with a particular practitioner from a payer attribution perspective.,MAY,CRD Server,,false,,
-hl7.fhir.us.davinci-crd_2.2.1,hook-39,https://hl7.org/fhir/us/davinci-crd/2.2.1/en/hooks.html#ci-c-hook-39,"CRD clients and servers **SHALL**, at minimum, support returning and processing the [Coverage Information](https://hl7.org/fhir/us/davinci-crd/2.2.1/en/StructureDefinition-ext-coverage-information.html) system action for all invocations of the order-select hook.",SHALL,"CRD Client, CRD Server",,false,,
+hl7.fhir.us.davinci-crd_2.2.1,hook-39,https://hl7.org/fhir/us/davinci-crd/2.2.1/en/hooks.html#ci-c-hook-39,"CRD clients and servers **SHALL**, at minimum, support returning and processing the [Coverage Information](https://hl7.org/fhir/us/davinci-crd/2.2.1/en/StructureDefinition-ext-coverage-information.html) system action for all invocations of the order-sign hook.",SHALL,"CRD Client, CRD Server",,false,,
 hl7.fhir.us.davinci-crd_2.2.1,impl-1,https://hl7.org/fhir/us/davinci-crd/2.2.1/en/implementation.html#ci-c-impl-1,Clients that suppress 'default presumption' coverage-information of messages **SHALL** mitigate the potential for misinterpretation in the event CRD is unavailable.,SHALL,CRD Client,,false,,
 hl7.fhir.us.davinci-crd_2.2.1,impl-2,https://hl7.org/fhir/us/davinci-crd/2.2.1/en/implementation.html#ci-c-impl-2,CRD servers **SHOULD** strive to achieve a minimum of 3-9s availability for their services and strive to provide at least some level of useful response to CRD clients even if some of their back-end systems are unavailable.,SHOULD,CRD Server,,false,,
 hl7.fhir.us.davinci-crd_2.2.1,impl-3,https://hl7.org/fhir/us/davinci-crd/2.2.1/en/implementation.html#ci-c-impl-3,"Even if implemented using multiple components, there is still a requirement that the exchanges between the provider HIT (including any ePA coordinators) and the payer HIT (including any ePA coordinators) **SHALL** replicate all of the defined exchanges between provider and payer.",SHALL,"CRD Client, CRD Server",,false,,
@@ -1311,7 +1311,11 @@ hl7.fhir.us.davinci-crd_2.2.1,resp-69,https://hl7.org/fhir/us/davinci-crd/2.2.1/
 hl7.fhir.us.davinci-crd_2.2.1,resp-70,https://hl7.org/fhir/us/davinci-crd/2.2.1/en/cards.html#ci-c-resp-70,"If returning a card rather than a system action, the ""Update Coverage Records"" response type **SHOULD NOT** be returned for hook types that are likely to be triggered by clinical users rather than administrative staff. Cards of this type would be appropriate for hooks such as encounter-start or appointment-book but would not be appropriate for order-select or order-sign.",SHOULD NOT,CRD Server,,true,,
 hl7.fhir.us.davinci-crd_2.2.1,resp-71,https://hl7.org/fhir/us/davinci-crd/2.2.1/en/cards.html#ci-c-resp-71,Adjust Coverage responses **SHALL** comply with the logical model profile found [here](https://hl7.org/fhir/us/davinci-crd/2.2.1/en/StructureDefinition-CRDHooksResponse-adjustCoverage.html).,SHALL,CRD Server,,false,,
 hl7.fhir.us.davinci-crd_2.2.1,resp-72,https://hl7.org/fhir/us/davinci-crd/2.2.1/en/cards.html#ci-c-resp-72,Launch SMART responses **SHALL** comply with the logical model profile found [here](https://hl7.org/fhir/us/davinci-crd/2.2.1/en/StructureDefinition-CRDHooksResponse-launchSMART.html).,SHALL,CRD Server,,false,,
-hl7.fhir.us.davinci-crd_2.2.1,sec-1,https://hl7.org/fhir/us/davinci-crd/2.2.1/en/security.html#ci-c-sec-1,Implementers SHALL adhere to inherited security and privacy rules,SHALL,"CRD Client, CRD Server",,false,,
+hl7.fhir.us.davinci-crd_2.2.1,sec-1,https://hl7.org/fhir/us/davinci-crd/2.2.1/en/security.html#ci-c-sec-1,"Implementers SHALL adhere to any security and privacy rules defined by:
+- FHIR Core: [Security & Privacy Module](http://hl7.org/fhir/R4/secpriv-module.html), [Security Principles](http://hl7.org/fhir/R4/security.html) and [Implementer's Checklist](http://hl7.org/fhir/R4/safety.html)
+- HRex: [Privacy & Security](http://hl7.org/fhir/us/davinci-hrex/1.2.0/security.html)
+- CDS Hooks: [Security & Safety](http://cds-hooks.hl7.org/2026Jan/index.html#security-and-safety)
+- SMART on FHIR: [SMART App Launch](http://www.hl7.org/fhir/smart-app-launch)",SHALL,"CRD Client, CRD Server",,false,,
 hl7.fhir.us.davinci-crd_2.2.1,sec-2,https://hl7.org/fhir/us/davinci-crd/2.2.1/en/security.html#ci-c-sec-2,"As per the CDS Hooks specification, communications between CRD clients and CRD servers **SHALL** use TLS.",SHALL,"CRD Client, CRD Server",,false,,
 hl7.fhir.us.davinci-crd_2.2.1,sec-3,https://hl7.org/fhir/us/davinci-crd/2.2.1/en/security.html#ci-c-sec-3,CRD servers and CRD clients **SHOULD** enforce a minimum version and other TLS configuration requirements based on [HRex rules](http://hl7.org/fhir/us/davinci-hrex/1.2.0/security.html#exchange-security) for PHI exchange.,SHOULD,"CRD Client, CRD Server",,false,,
 hl7.fhir.us.davinci-crd_2.2.1,sec-4,https://hl7.org/fhir/us/davinci-crd/2.2.1/en/security.html#ci-c-sec-4,CRD clients that support the Launch SMART Application Response Type **SHALL** support running applications that adhere to the SMART on FHIR [confidential app](https://hl7.org/fhir/smart-app-launch/STU2.2/app-launch.html#support-for-public-and-confidential-apps) profile.,SHALL,CRD Client,,true,,