davinci_pdex_test_kit 0.10.6 → 0.12.0

data/lib/davinci_pdex_test_kit/pdex_payer_server/workflow_member_match_group.rb

@@ -1,4 +1,3 @@
-# frozen_string_literal: true
 require_relative 'member_match_request_profile_validation'
 require_relative 'member_match_request_local_references_validation'
 require_relative 'coverage_to_link_minimal_data_validation'
@@ -11,7 +10,7 @@ module DaVinciPDexTestKit
     class WorkflowMemberMatchGroup < Inferno::TestGroup
       title 'Server can return a matching member in response to $member-match request'
       short_title '$member-match'
-      id :pdex_workflow_member_match_group
+      id :pdex_workflow_member_match
       description %{
         # Background
 
@@ -20,11 +19,11 @@ module DaVinciPDexTestKit
         [required by the PDex Implementation Guide](https://hl7.org/fhir/us/davinci-pdex/STU2/payertopayerexchange.html#member-match-with-consent).
 
         # Testing Methodology
-        
+
         The developer must supply JSON FHIR input parameter conforming to the
         [member match request profile](https://hl7.org/fhir/us/davinci-hrex/STU1/StructureDefinition-hrex-parameters-member-match-in.html). This
         test sequence will:
-        
+
         1. Request the server's capability statement and verify that it asserts support for the $member-match operation
         2. Validate user's member match request input
            + validate Parameters profile conformance
@@ -33,25 +32,35 @@ module DaVinciPDexTestKit
            + optional: validate minimal data on CoverageToLink parameter
         3. POST request to server and validate HTTP 200 response status
         4. validate memeber match response conforms to profile
-        5. use member identifier from response to query for patient id 
+        5. use member identifier from response to query for patient id
       }
 
       run_as_group
 
       input :member_match_request,
-        title: 'Member Match Request for one match',
-        description: "A JSON payload for server's $member-match endpoint that has **exactly one match**",
-        type: 'textarea'
+            title: 'Member Match Request for one match',
+            description: "A JSON payload for server's $member-match endpoint that has **exactly one match**",
+            type: 'textarea'
+
+      input :smart_auth_info,
+            title: 'OAuth Credentials',
+            type: :auth_info,
+            optional: true
+
+      fhir_client do
+        url :url
+        auth_info :smart_auth_info
+      end
 
-      test from: :patient_operation_in_capability_statement_validation,
-           id: :member_match_operation_in_capability_statement_test,
+      test from: :pdex_patient_operation_in_cap_stmt_validation,
+           id: :pdex_member_match_operation_in_cap_stmt,
            title: 'Server declares support for Patient member match operation in CapabilityStatement',
            config: {
              options: { operation_name: 'member-match', operation_url: 'http://hl7.org/fhir/us/davinci-hrex/OperationDefinition/member-match' }
            }
 
-      test from: :pdex_member_match_request_profile_validation do
-        id :member_match_request_profile_test
+      test from: :pdex_member_match_profile_validation do
+        id :pdex_one_match_profile_validation
         title '[USER INPUT VALIDATION] Member match request for exactly one match is valid'
         description %{
           This test validates the conformity of the user input to the
@@ -61,31 +70,31 @@ module DaVinciPDexTestKit
         }
       end
 
-      test from: :pdex_member_match_request_local_references_validation do
-        id :member_match_request_local_references_test
+      test from: :pdex_member_match_local_ref_validation do
+        id :pdex_member_match_local_ref
         title '[USER INPUT VALIDATION] Member match request only uses local references'
       end
 
-      test from: :pdex_coverage_to_link_minimal_data_validation
-      test from: :pdex_coverage_to_link_must_support_validation
-   
+      test from: :pdex_coverage_to_link_minimal_validation
+      test from: :pdex_coverage_to_link_ms_validation
+
       test do
-        id :member_match_on_server_test
+        id :pdex_member_match_on_server
         title 'Server handles $member-match operation successfully'
         description 'Server receives request `POST [baseURL]/Patient/$member-match` and returns 200'
-           
+
         input :member_match_request
-   
+
         makes_request :member_match
-   
+
         run do
           fhir_operation('/Patient/$member-match', body: FHIR.from_contents(member_match_request), name: :member_match)
           assert_response_status(200)
         end
       end
-  
+
       test do
-        id :member_match_response_profile_test
+        id :pdex_member_match_response_profile
         title 'Server $member-match response conforms to profile'
         description %{
           The response body from the previous POST request to $member-match must be valid FHIR JSON conforming to
@@ -93,7 +102,7 @@ module DaVinciPDexTestKit
         }
 
         output :member_identifier
-        output :member_identifier_system  
+        output :member_identifier_system
 
         uses_request :member_match
 
@@ -103,17 +112,19 @@ module DaVinciPDexTestKit
           assert_resource_type('Parameters')
 
           # We should save the output before validating every detail of the payload
-          output member_identifier: resource.parameter.find{|p| p.name=='MemberIdentifier'}&.valueIdentifier&.value
-          output member_identifier_system: resource.parameter.find{|p| p.name=='MemberIdentifier'}&.valueIdentifier&.system
+          output member_identifier: resource.parameter.find { |p| p.name == 'MemberIdentifier' }&.valueIdentifier&.value
+          output member_identifier_system: resource.parameter.find { |p|
+            p.name == 'MemberIdentifier'
+          }&.valueIdentifier&.system
 
           assert_valid_resource(profile_url: 'http://hl7.org/fhir/us/davinci-hrex/StructureDefinition/hrex-parameters-member-match-out')
         end
       end
-  
+
       test do
-        id :member_match_identifier_to_id
+        id :pdex_member_match_identifier_to_id
         title 'Server member identifier from $member-match yields logical Patient id'
-        description %Q{
+        description %(
           The $member-match operation returns a Member Identifier, and subsequent clinical queries and operations
           are only required to support logical Patient FHIR ID. Hence server must be able to provide a Patient
           FHIR ID from Member Identifier.
@@ -121,15 +132,17 @@ module DaVinciPDexTestKit
           Server receives request `GET [baseURL]/Patient?identifier=[member_identifier]`
           and returns 200 and a Bundle with a single FHIR Patient. The `[member_identifier]` is from Member Match Response
           `Parameters.parameter:MemberIdentifier.valueIdentifier.value`.
-        }
+        )
+
+        verifies_requirements 'hl7.fhir.us.davinci-pdex_2.0.0@35'
 
         input :member_identifier
         input :member_identifier_system, optional: true
         output :patient_id
 
         run do
-          skip_if !member_identifier, "No member identifier obtained from $member-match request"
- 
+          skip_if !member_identifier, 'No member identifier obtained from $member-match request'
+
           # We only query by identifier.value, and preset information happens to return a value with a system within it
           # which may be a bug.
           # Other options are to query by system|value or type-of:
@@ -140,19 +153,24 @@ module DaVinciPDexTestKit
           assert_valid_json(response[:body])
           assert_resource_type('Bundle')
 
-          assert resource.entry.find{ |entry| entry.resource&.resourceType == 'Patient' }, "Bundle has no Patient resource."
+          assert resource.entry.find { |entry|
+            entry.resource&.resourceType == 'Patient'
+          }, 'Bundle has no Patient resource.'
 
-          patient_id = resource.entry.reverse_each.find{ |entry| entry.resource&.resourceType == 'Patient' }&.resource&.id
-          assert patient_id, "Patient resource in Bundle has no logical resource id"
+          patient_id = resource.entry.reverse_each.find do |entry|
+            entry.resource&.resourceType == 'Patient'
+          end&.resource&.id
+          assert patient_id, 'Patient resource in Bundle has no logical resource id'
 
-          info "Multiple patients found, using the last patient id." if resource.entry.select{ |entry| entry.resource&.resourceType == 'Patient' }.length > 1
+          info 'Multiple patients found, using the last patient id.' if resource.entry.select do |entry|
+            entry.resource&.resourceType == 'Patient'
+          end.length > 1
 
-          output :patient_id => patient_id
+          output patient_id: patient_id
 
           assert_valid_resource
         end
       end
-
     end
   end
 end

data/lib/davinci_pdex_test_kit/pdex_payer_server_suite.rb

@@ -1,4 +1,4 @@
-# frozen_string_literal: true
+require 'us_core_test_kit/generated/v3.1.1/us_core_test_suite'
 
 require_relative 'pdex_payer_server/workflow_member_match_group'
 require_relative 'pdex_payer_server/workflow_clinical_data_group'
@@ -9,96 +9,89 @@ require_relative 'pdex_payer_server/no_member_matches_group'
 require_relative 'pdex_payer_server/multiple_member_matches_group'
 
 require_relative 'pdex_payer_server/explanation_of_benefit_group'
+require_relative 'pdex_payer_server/device_group'
+require_relative 'pdex_payer_server/medication_dispense_group'
+require_relative 'pdex_payer_server/provenance_group'
 
 module DaVinciPDexTestKit
-    class PDexPayerServerSuite < Inferno::TestSuite
-      id :pdex_payer_server
-      title 'Da Vinci PDex Payer Server Test Suite'
-      description File.read(File.join(__dir__, 'docs', 'payer_server_suite_description_v200.md'))
-  
-      links [
-        {
-          label: 'Report Issue',
-          url: 'https://github.com/inferno-framework/davinci-pdex-test-kit/issues'
-        },
-        {
-          label: 'Open Source',
-          url: 'https://github.com/inferno-framework/davinci-pdex-test-kit'
-        },
-        {
-          label: 'Download',
-          url: 'https://github.com/inferno-framework/davinci-pdex-test-kit/releases'
-        },
-        {
-          label: 'Implementation Guide',
-          url: 'https://hl7.org/fhir/us/davinci-pdex/STU2/'
-        }
-      ]
-
-      input :url,
-            title: 'FHIR Server Base Url'
-  
-      input :credentials,
-            title: 'OAuth Credentials',
-            type: :oauth_credentials,
-            optional: true
-  
-      fhir_client do
-        url :url
-        oauth_credentials :credentials
-      end
-
-      VALIDATION_MESSAGE_FILTERS = [
-        /Observation\.effective\.ofType\(Period\): .*vs-1:/, # Invalid invariant in FHIR v4.0.1
-        /\A\S+: \S+: URL value '.*' does not resolve/
-      ].freeze
-
-      VERSION_SPECIFIC_MESSAGE_FILTERS = [].freeze
-
-      # Hl7 Validator Wrapper:
-      fhir_resource_validator do
-        igs 'hl7.fhir.us.davinci-pdex#2.0.0'
-        # hrex 1.0.0 and other dependencies will auto-load
-
-        # Copy messages limit from Bulk Data Export tests
-        message_filters = VALIDATION_MESSAGE_FILTERS + VERSION_SPECIFIC_MESSAGE_FILTERS
-
-        $num_messages = 0
-        $capped_message = false
-        $num_errors = 0
-        $capped_errors = false
-
-        exclude_message do |message|
-          matches_filter = message_filters.any? { |filter| filter.match? message.message }
-
-          unless matches_filter
-            if message.type != 'error'
-              $num_messages += 1
-            else
-              $num_errors += 1
-            end
+  class PDexPayerServerSuite < Inferno::TestSuite
+    id :pdex_payer_server
+    title 'Da Vinci PDex Payer Server Test Suite'
+    description File.read(File.join(__dir__, 'docs', 'payer_server_suite_description_v200.md'))
+
+    links [
+      {
+        label: 'Report Issue',
+        url: 'https://github.com/inferno-framework/davinci-pdex-test-kit/issues'
+      },
+      {
+        label: 'Open Source',
+        url: 'https://github.com/inferno-framework/davinci-pdex-test-kit'
+      },
+      {
+        label: 'Download',
+        url: 'https://github.com/inferno-framework/davinci-pdex-test-kit/releases'
+      },
+      {
+        label: 'Implementation Guide',
+        url: 'https://hl7.org/fhir/us/davinci-pdex/STU2/'
+      }
+    ]
+
+    input :url,
+          title: 'FHIR Server Base Url'
+
+    VALIDATION_MESSAGE_FILTERS = [
+      /Observation\.effective\.ofType\(Period\): .*vs-1:/, # Invalid invariant in FHIR v4.0.1
+      /\A\S+: \S+: URL value '.*' does not resolve/
+    ].freeze
+
+    VERSION_SPECIFIC_MESSAGE_FILTERS = [].freeze
+
+    # Hl7 Validator Wrapper:
+    fhir_resource_validator do
+      igs 'hl7.fhir.us.davinci-pdex#2.0.0'
+      # hrex 1.0.0 and other dependencies will auto-load
+
+      # Copy messages limit from Bulk Data Export tests
+      message_filters = VALIDATION_MESSAGE_FILTERS + VERSION_SPECIFIC_MESSAGE_FILTERS
+
+      $num_messages = 0
+      $capped_message = false
+      $num_errors = 0
+      $capped_errors = false
+
+      exclude_message do |message|
+        matches_filter = message_filters.any? { |filter| filter.match? message.message }
+
+        unless matches_filter
+          if message.type == 'error'
+            $num_errors += 1
+          else
+            $num_messages += 1
           end
-
-           matches_filter ||
-            (message.type != 'error' && $num_messages > 50 && !message.message.include?('Inferno is only showing the first')) ||
-            (message.type == 'error' && $num_errors > 20 && !message.message.include?('Inferno is only showing the first'))
         end
 
-        perform_additional_validation do
-          if $num_messages > 50 && !$capped_message
-            $capped_message = true
-            { type: 'info', message: 'Inferno is only showing the first 50 validation info and warning messages.' }
-          elsif $num_errors > 20 && !$capped_errors
-            $capped_errors = true
-            { type: 'error', message: 'Inferno is only showing the first 20 validation error messages.' }
-          end
+        matches_filter ||
+          (message.type != 'error' && $num_messages > 50 && !message.message.include?('Inferno is only showing the first')) ||
+          (message.type == 'error' && $num_errors > 20 && !message.message.include?('Inferno is only showing the first'))
+      end
+
+      perform_additional_validation do
+        if $num_messages > 50 && !$capped_message
+          $capped_message = true
+          { type: 'info', message: 'Inferno is only showing the first 50 validation info and warning messages.' }
+        elsif $num_errors > 20 && !$capped_errors
+          $capped_errors = true
+          { type: 'error', message: 'Inferno is only showing the first 20 validation error messages.' }
         end
       end
+    end
 
-      group do
-        title 'Payer to Payer Workflow'
-        id :payer_to_payer_workflow
-        description %(
+    group do
+      title 'Payer to Payer Workflow'
+      id :payer_to_payer_workflow
+      description %(
           # Background
 
           This Payer to Payer Workflow test sequence is designed to simulate a realistic use case for
@@ -125,22 +118,34 @@ module DaVinciPDexTestKit
           See the corresponding test group's description for the testing methodology of each part.
         )
 
-        group from: :pdex_workflow_member_match_group
-        group from: :pdex_workflow_clinical_data_group
-        group from: :pdex_workflow_everything_group
-        group from: :pdex_workflow_export_group
+      group from: :pdex_workflow_member_match
+      group from: :pdex_workflow_clinical_data
+      group from: :pdex_workflow_everything
+      group from: :pdex_workflow_export
+    end
+
+    group do
+      title 'API Capability and Must Support Coverage'
+      id :api_and_ms_coverage
+
+      verifies_requirements 'hl7.fhir.us.davinci-pdex_2.0.0@9', 'hl7.fhir.us.davinci-pdex_2.0.0@14'
+
+      input :smart_auth_info,
+            title: 'OAuth Credentials',
+            type: :auth_info,
+            optional: true
+
+      fhir_client do
+        url :url
+        auth_info :smart_auth_info
       end
 
       group do
-        title 'API Capability and Must Support Coverage'
-        id :api_and_must_support_coverage
-        
-        group do
-          title '$member-match failure cases'
-          id :member_match_failure_cases
-          description %{
+        title '$member-match failure cases'
+        id :member_match_failure_cases
+        description %{
             # Background
-            
+
             This test sequence is for the negative results specification in
             [member matching logic](http://hl7.org/fhir/us/davinci-hrex/STU1/OperationDefinition-member-match.html#member-matching-logic)
             from HRex 1.0.0 Implementation Guide, and is required by the PDex 2.0.0 Implementation Guide.
@@ -155,26 +160,33 @@ module DaVinciPDexTestKit
               + POST request to server and validiate HTTP 422 response status
           }
 
-          input_order :url, :credentials, :no_member_match_request, :multiple_member_match_request
-
-          group from: :pdex_no_member_matches_group
-          group from: :pdex_multiple_member_matches_group
-        end
-
-        group do
-          title 'PDEX Search and Read API (US Core plus additional PDex resource types)' 
-          id :search_and_read_api_coverage
-          
-          group from: :pdex_explanation_of_benefit_group
+        input_order :url, :smart_auth_info, :no_member_match_request, :multiple_member_match_request
 
-          # Import all US Core v3.1.1 groups without the Suite
-          Dir.glob(File.join($LOAD_PATH.find { |x| x.match? "us_core_test_kit" }, 'us_core_test_kit/generated/v3.1.1/*_group.rb')).each do |test_group_path|
-            require_relative test_group_path
+        group from: :pdex_no_member_matches
+        group from: :pdex_multiple_member_matches
+      end
 
-            group from: "us_core_v311_#{File.basename(test_group_path).gsub('_group.rb','')}".to_sym
-          end
+      group do
+        title 'PDEX Search and Read API (US Core plus additional PDex resource types)'
+        id :pdex_fhir_api_coverage
+
+        verifies_requirements 'hl7.fhir.us.davinci-pdex_2.0.0@3', 'hl7.fhir.us.davinci-pdex_2.0.0@7',
+                              'hl7.fhir.us.davinci-pdex_2.0.0@16', 'hl7.fhir.us.davinci-pdex_2.0.0@43',
+                              'hl7.fhir.us.davinci-pdex_2.0.0@48', 'hl7.fhir.us.davinci-pdex_2.0.0@49',
+                              'hl7.fhir.us.davinci-pdex_2.0.0@50', 'hl7.fhir.us.davinci-pdex_2.0.0@51',
+                              'hl7.fhir.us.davinci-pdex_2.0.0@52'
+
+        group from: :pdex_eob
+        group from: :pdex_device
+        group from: :pdex_medication_dispense
+        group from: :pdex_provenance
+
+        # Import all US Core v3.1.1 groups without the Suite
+        USCoreTestKit::USCoreV311::USCoreTestSuite.groups[1].groups.each do |group|
+          # This prevents a second OAuth credentials box from appearing in UI
+          group(from: group.ancestors[1].id, id: group.ancestors[1].id.delete_prefix('us_core_v311_'))
         end
       end
-
     end
+  end
 end

data/lib/davinci_pdex_test_kit/pdex_provider_client_suite.rb

@@ -8,7 +8,7 @@ module DaVinciPDexTestKit
         This suite validates that a provider system can act as a client
         retrieving patient data from a payer system using
         the APIs described in the PDex implementation
-        guide. Inferno will act as a payer server that the 
+        guide. Inferno will act as a payer server that the
         system under test will connect to and retrieve data from.
       )
 
@@ -30,22 +30,22 @@ module DaVinciPDexTestKit
           url: 'https://hl7.org/fhir/us/davinci-pdex/STU2/'
         }
       ]
-  
+
       # These inputs will be available to all tests in this suite
       input :url,
             title: 'FHIR Server Base Url'
-  
-      input :credentials,
+
+      input :smart_auth_info,
             title: 'OAuth Credentials',
-            type: :oauth_credentials,
+            type: :auth_info,
             optional: true
-  
+
       # All FHIR requests in this suite will use this FHIR client
       fhir_client do
         url :url
-        oauth_credentials :credentials
+        auth_info :smart_auth_info
       end
-  
+
       # Hl7 Validator Wrapper:
       fhir_resource_validator do
         igs 'hl7.fhir.us.davinci-pdex#2.0.0'

data/lib/davinci_pdex_test_kit/requirements/davinci-pdex-test-kit_out_of_scope_requirements.csv

@@ -0,0 +1 @@
+Req Set,ID,Reason,Details

data/lib/davinci_pdex_test_kit/requirements/davinci-pdex-test-kit_requirements.csv

@@ -0,0 +1,64 @@
+Req Set,ID,URL,Requirement,Conformance,Actor,Sub-Requirement(s),Conditionality
+hl7.fhir.us.davinci-pdex_2.0.0,1,https://hl7.org/fhir/us/davinci-pdex/STU2/#intellectual-property,Implementers ... of this specification SHALL abide by the license requirements for each terminology content artifact utilized within a functioning implementation.,SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,2,https://hl7.org/fhir/us/davinci-pdex/STU2/#intellectual-property,Terminology licenses SHALL be obtained from the Third-Party IP owner for each code system and/or other specified artifact used.,SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,3,https://hl7.org/fhir/us/davinci-pdex/STU2/index.html#must-support,"For profiles defined in [US Core and referenced by PDex], the meaning of Must Support [for Servers] is established in [the US Core IG].",SHALL,Server,"hl7.fhir.us.core_3.1.1@75,77,78,80",false
+hl7.fhir.us.davinci-pdex_2.0.0,4,https://hl7.org/fhir/us/davinci-pdex/STU2/index.html#must-support,"For profiles defined in [US Core and referenced by PDex], the meaning of Must Support [for Clients] is established in [the US Core IG].",SHALL,Client,"hl7.fhir.us.core_3.1.1@76,79",false
+hl7.fhir.us.davinci-pdex_2.0.0,5,https://hl7.org/fhir/us/davinci-pdex/STU2/index.html#must-support,"For profiles defined in [DaVinci HRex and referenced by PDex], the meaning of Must Support [for Servers] is established in [the HRex IG].",SHALL,Server,"hl7.fhir.us.davinci-hrex_1.0.0@21,22,24,25,27",false
+hl7.fhir.us.davinci-pdex_2.0.0,6,https://hl7.org/fhir/us/davinci-pdex/STU2/index.html#must-support,"For profiles defined in [DaVinci HRex and referenced by PDex], the meaning of Must Support [for Clients] is established in [the HRex IG].",SHALL,Client,"hl7.fhir.us.davinci-hrex_1.0.0@23,26,28",false
+hl7.fhir.us.davinci-pdex_2.0.0,7,https://hl7.org/fhir/us/davinci-pdex/STU2/index.html#must-support,"[For profiles defined in the PDex IG, Servers SHALL follow] Must Support requirements … [from] the US Core Implementation Guide.",SHALL,Server,"hl7.fhir.us.core_3.1.1@75,77,78,80",false
+hl7.fhir.us.davinci-pdex_2.0.0,8,https://hl7.org/fhir/us/davinci-pdex/STU2/index.html#must-support,"[For profiles defined in the PDex IG, Clients SHALL follow] Must Support requirements … [from] the US Core Implementation Guide.",SHALL,Client,"hl7.fhir.us.core_3.1.1@76,79",false
+hl7.fhir.us.davinci-pdex_2.0.0,9,https://hl7.org/fhir/us/davinci-pdex/STU2/overview.html#overview,All data exchanged by Health Plans using the interactions covered in this IG SHALL be transformed to FHIR R4 resources.,SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,10,"https://hl7.org/fhir/us/davinci-pdex/STU2/overview.html#oauth20-or-smart-on-fhir-member-authorized-exchange,https://hl7.org/fhir/us/davinci-pdex/STU2/member-authorizedoauth2exchange.html,https://hl7.org/fhir/us/davinci-pdex/STU2/pdeximplementationactorsinteractionsdatapayloadsandmethods.html#oauth20-and-fhir-api",The member SHALL authenticate using [and the server SHALL accept only] credentials that have been issued by or are recognized and accepted by the Health Plan. These are typically the member’s customer portal credentials for accessing the health plan.,SHALL,Client,,false
+hl7.fhir.us.davinci-pdex_2.0.0,11,https://hl7.org/fhir/us/davinci-pdex/STU2/overview.html#patient-everything-exchange-via-alternate-secure-transport,The use of the Bulk FHIR specification for transmission of member data SHALL honor jurisdictional and personal privacy restrictions that are relevant to a member’s health record.,SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,12,https://hl7.org/fhir/us/davinci-pdex/STU2/overview.html#provenance,Health Plans SHALL incorporate provenance records that they receive as part of any exchange of FHIR data.,SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,13,https://hl7.org/fhir/us/davinci-pdex/STU2/overview.html#provenance,"Health Plans SHALL provide Provenance records [for each non-Provenance instance] that, at a minimum, indicate that they are playing the role of Transmitter of the data in any PDex information exchange.",SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,14,https://hl7.org/fhir/us/davinci-pdex/STU2/introduction.html#implementation-hierarchy-and-priorities,"[F]or profiles and APIs identified in this IG, the FHIR R4 version SHALL be used.",SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,15,https://hl7.org/fhir/us/davinci-pdex/STU2/introduction.html#pdex-data-payloads,All resources available via a FHIR API endpoint SHALL be declared in a FHIR CapabilityStatement.,SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,16,https://hl7.org/fhir/us/davinci-pdex/STU2/introduction.html#pdex-data-payloads,The Read and Search Operations SHALL be supported for the FHIR Profiles [that are part of the member health history].,SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,17,https://hl7.org/fhir/us/davinci-pdex/STU2/introduction.html#capabilitystatement,The Read ... Operation... SHALL be supported for … Resource Type … Coverage [using the [HRex Coverage](https://hl7.org/fhir/us/davinci-hrex/STU1/StructureDefinition-hrex-coverage.html) profile].,SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,18,https://hl7.org/fhir/us/davinci-pdex/STU2/introduction.html#capabilitystatement,The ... Search Operation... SHALL be supported for … Resource Type … Coverage [using the [HRex Coverage](https://hl7.org/fhir/us/davinci-hrex/STU1/StructureDefinition-hrex-coverage.html) profile].,SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,19,https://hl7.org/fhir/us/davinci-pdex/STU2/pdeximplementationactorsinteractionsdatapayloadsandmethods.html#data-payloads,All resources and operations available via a FHIR API endpoint SHALL be declared in a FHIR CapabilityStatement.,SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,20,"https://hl7.org/fhir/us/davinci-pdex/STU2/overview.html#oauth20-or-smart-on-fhir-member-authorized-exchange,https://hl7.org/fhir/us/davinci-pdex/STU2/member-authorizedoauth2exchange.html,https://hl7.org/fhir/us/davinci-pdex/STU2/pdeximplementationactorsinteractionsdatapayloadsandmethods.html#oauth20-and-fhir-api","[When a payer allows their member to authorize information sharing, a]fter authenticating to the (source) Health Plan’s authorization server, the Member SHALL be presented with an Authorization screen that enables them to approve the sharing of information with their intended application, service or (target) Health Plan.",SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,21,https://hl7.org/fhir/us/davinci-pdex/STU2/pdeximplementationactorsinteractionsdatapayloadsandmethods.html#oauth20-and-fhir-api,"For this authorization [of data sharing by a member] to occur the Application, service or (target) Health Plan will require OAuth 2.0 client application credentials, which ... the (source) Health Plan [SHALL issue during client] register[ation]",SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,22,"https://hl7.org/fhir/us/davinci-pdex/STU2/pdeximplementationactorsinteractionsdatapayloadsandmethods.html#oauth20-and-fhir-api,https://hl7.org/fhir/us/davinci-pdex/STU2/member-authorizedoauth2exchange.htm","The Authorization process [of data sharing by a member], in accordance with applicable privacy policy, SHALL provide a mechanism to support current regulations allowing members the right to decide what information is permitted to be exchanged.",SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,23,"https://hl7.org/fhir/us/davinci-pdex/STU2/pdeximplementationactorsinteractionsdatapayloadsandmethods.html#oauth20-and-fhir-api,https://hl7.org/fhir/us/davinci-pdex/STU2/member-authorizedoauth2exchange.htm","After successfully authorizing [data sharing with] an application [on behalf of the Member,] an Access Token ... SHALL be returned to the requesting application.",SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,24,"https://hl7.org/fhir/us/davinci-pdex/STU2/pdeximplementationactorsinteractionsdatapayloadsandmethods.html#oauth20-and-fhir-api,https://hl7.org/fhir/us/davinci-pdex/STU2/member-authorizedoauth2exchange.htm","After successfully authorizing [data sharing with] an application [on behalf of the Member,] an … Optional Refresh Token ... [MAY] be returned to the requesting application.",MAY,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,25,https://hl7.org/fhir/us/davinci-pdex/STU2/pdeximplementationactorsinteractionsdatapayloadsandmethods.html#oauth20-and-fhir-api,The scopes of the access token [returned by the server for data sharing on behalf of a member] SHALL be restricted to the authorizing Member’s information and the scopes approved.,SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,26,https://hl7.org/fhir/us/davinci-pdex/STU2/pdeximplementationactorsinteractionsdatapayloadsandmethods.html#oauth20-and-fhir-api,Any subsequent Access Token [returned by the server for data sharing on behalf of the member] issued based on the Refresh Token SHALL be restricted (at least) to the same restrictions.,SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,27,"https://hl7.org/fhir/us/davinci-pdex/STU2/pdeximplementationactorsinteractionsdatapayloadsandmethods.html#oauth20-and-fhir-api,https://hl7.org/fhir/us/davinci-pdex/STU2/member-authorizedoauth2exchange.htm",The requesting application [authorized to access member information] SHALL use the access token to access the Health Plan’s secure FHIR API to download the information that the Application is allowed to access.,SHALL,Client,,false
+hl7.fhir.us.davinci-pdex_2.0.0,28,https://hl7.org/fhir/us/davinci-pdex/STU2/handlingdataprovenance.html#handling-data-provenance,Health Plans SHALL accept and retain Provenance records received with data based on Member-authorized Payer-to-Payer exchange.,SHALL,Client,,false
+hl7.fhir.us.davinci-pdex_2.0.0,29,https://hl7.org/fhir/us/davinci-pdex/STU2/payertopayerexchange.html#member-match-with-consent,Each [data] retrieval ... SHALL be preceded by the use of the ... [HRex [$member-match](https://hl7.org/fhir/us/davinci-hrex/STU1/OperationDefinition-member-match.html)] interaction to match a member and provide consent.,SHALL,Client,"hl7.fhir.us.davinci-hrex_1.0.0@34,37,38,40,46,47",false
+hl7.fhir.us.davinci-pdex_2.0.0,30,https://hl7.org/fhir/us/davinci-pdex/STU2/payertopayerexchange.html#member-match-with-consent,Health Plans SHALL support the $member-match operation.,SHALL,Server,"hl7.fhir.us.davinci-hrex_1.0.0@35,36,39,41-45,48",false
+hl7.fhir.us.davinci-pdex_2.0.0,31,https://hl7.org/fhir/us/davinci-pdex/STU2/payertopayerexchange.html#member-match-with-consent,"[Before allowing a $member-match operation, Servers SHALL e]stablish a secure connection [with the client payer] via mTLS.",SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,32,https://hl7.org/fhir/us/davinci-pdex/STU2/payertopayerexchange.html#member-match-with-consent,[Servers SHALL allow clients to u]se mTLS secure connection to perform OAuth2.0 Dynamic Client Registration to acquire OAuth2.0 client credentials,SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,33,https://hl7.org/fhir/us/davinci-pdex/STU2/payertopayerexchange.html#member-match-with-consent,[Servers SHALL allow clients to u]se Client Credentials to acquire OAuth2.0 token to perform $member-match operation,SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,34,https://hl7.org/fhir/us/davinci-pdex/STU2/payertopayerexchange.html#member-match-with-consent,"If a Patient ID is returned from $member-match, [Servers SHALL allow clients to make] a request for an OAuth2.0 Access Token that is scoped to the identified shared member",SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,35,https://hl7.org/fhir/us/davinci-pdex/STU2/payertopayerexchange.html#the-member-match-operation,In the case where a [member] match is confirmed the receiving payer will: … [r]eturn a Unique Patient Identifier (Patient FHIR ID) in the $member-match Operation Response.,SHALL,Server,,true
+hl7.fhir.us.davinci-pdex_2.0.0,36,https://hl7.org/fhir/us/davinci-pdex/STU2/payertopayerexchange.html#the-member-match-operation,When no [member] match is found ... a 422 Unprocessable entity status code will be returned [by the receiving payer].,SHALL,Server,,true
+hl7.fhir.us.davinci-pdex_2.0.0,37,https://hl7.org/fhir/us/davinci-pdex/STU2/payertopayerexchange.html#the-member-match-operation,"When … multiple matches are found, a 422 Unprocessable entity status code will be returned [by the receiving payer].",SHALL,Server,,true
+hl7.fhir.us.davinci-pdex_2.0.0,38,https://hl7.org/fhir/us/davinci-pdex/STU2/payertopayerexchange.html#the-member-match-operation,"If the receiving payer matches to a unique member but is unable to comply with the consent request, a Patient ID SHALL NOT be returned in the $member-match response",SHALL NOT,Server,,true
+hl7.fhir.us.davinci-pdex_2.0.0,39,https://hl7.org/fhir/us/davinci-pdex/STU2/payertopayerexchange.html#the-member-match-operation,"If the receiving payer matches to a unique member but is unable to comply with the consent request [e.g., because they do not support the requested data segmentation policy], … a 422 status code SHALL be returned with an Operation Outcome that indicates that the consent request could not be complied with.",SHALL,Server,,true
+hl7.fhir.us.davinci-pdex_2.0.0,40,https://hl7.org/fhir/us/davinci-pdex/STU2/payertopayerexchange.html#evaluation-of-consent,"[Servers SHALL consider consent requirements to be met only if]
+- Member Identity is matched
+- Consent Policy (Everything or only Non-Sensitive data) matches the data release segmentation capabilities of the receiving payer
+- Date period for consent is valid
+- Payer requesting retrieval of data is matched.",SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,41,https://hl7.org/fhir/us/davinci-pdex/STU2/payertopayerexchange.html#data-retrieval-methods,"Once Health Plans have completed the Member Access stage of the Exchange the requesting Health Plan SHALL utilize the access token returned from the Member Access step to request/retrieve data using one of the following three methods:
+- Query all clinical resource individually
+- $patient-everything operation
+- Bulk FHIR Asynchronous protocols.",SHALL,Client,,false
+hl7.fhir.us.davinci-pdex_2.0.0,42,https://hl7.org/fhir/us/davinci-pdex/STU2/payertopayerexchange.html#data-retrieval-methods,"Each of the above methods[, query all clinical resource individually, $everything, and $export,] SHALL support the retrieval of the profiles and resources [in the scope of the member health history, defined in the Server CapabilityStatement]",SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,43,https://hl7.org/fhir/us/davinci-pdex/STU2/payertopayerexchange.html#query-all-clinical-resources-individually,Health Plans SHALL support search of a member’s clinical data.,SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,44,,[Servers SHALL support] the _revInclude and _include parameters to ... retrieve the associated Provenance and supporting records.,SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,45,https://hl7.org/fhir/us/davinci-pdex/STU2/payertopayerexchange.html#constraining-data-based-upon-permissions-of-the-requestor,The FHIR Server SHALL constrain the data returned from the server to a requester based upon the access permissions of the requester.,SHALL,Server,,false
+hl7.fhir.us.davinci-pdex_2.0.0,46,https://hl7.org/fhir/us/davinci-pdex/STU2/payertopayerexchange.html#everything-operation,Health Plans SHOULD support the use of the $everything operation… defined in the FHIR R4 specification here: https://www.hl7.org/fhir/operation-patient-everything.html,SHOULD,Server,fhir_4.0.1,false
+hl7.fhir.us.davinci-pdex_2.0.0,47,https://hl7.org/fhir/us/davinci-pdex/STU2/payertopayerexchange.html#bulk-fhir-asynchronous-protocols,"Payer-to-Payer Data Exchange SHOULD support the use of Bulk FHIR methods, as defined in the HL7 FHIR [Bulk Data Access Implementation Guide](https://hl7.org/fhir/uv/bulkdata/authorization/).",SHOULD,Server,hl7.fhir.uv.bulkdata_2.0.0,false
+hl7.fhir.us.davinci-pdex_2.0.0,48,https://hl7.org/fhir/us/davinci-pdex/STU2/datamapping.html#data-mapping,Health Plans SHALL map claims and clinical information for a member to US Core v3.1.1 FHIR Resources based on R4.,SHALL,Server,hl7.fhir.us.core_3.1.1,false
+hl7.fhir.us.davinci-pdex_2.0.0,49,https://hl7.org/fhir/us/davinci-pdex/STU2/datamapping.html#data-mapping,"Where a US Core FHIR R4 Resource is not defined Health Plans SHALL map claims and clinical information to FHIR Profiles defined in this IG, or the Da Vinci HRex IG.",SHALL,Server,hl7.fhir.us.davinci-hrex_1.0.0,true
+hl7.fhir.us.davinci-pdex_2.0.0,50,https://hl7.org/fhir/us/davinci-pdex/STU2/datamapping.html#providing-data-in-sub-element-fields,"If a field is marked as required (cardinality n.., where n>0) the Health Plan SHALL populate the field.",SHALL,Server,,true
+hl7.fhir.us.davinci-pdex_2.0.0,51,https://hl7.org/fhir/us/davinci-pdex/STU2/datamapping.html#providing-data-in-sub-element-fields,"For a field specified as MUST SUPPORT and the cardinality is 0.., the Health Plan SHALL be capable of populating the field and do so if the relevant data exists.",SHALL,Server,,true
+hl7.fhir.us.davinci-pdex_2.0.0,52,https://hl7.org/fhir/us/davinci-pdex/STU2/datamapping.html#providing-data-in-sub-element-fields,"For a field specified as MUST SUPPORT and the cardinality is 0.., the Health Plan SHALL … [populate] the field ... if the relevant data exists.",SHALL,Server,,true
+hl7.fhir.us.davinci-pdex_2.0.0,53,https://hl7.org/fhir/us/davinci-pdex/STU2/datamapping.html#providing-data-in-sub-element-fields,"If a field is marked as MUST SUPPORT the receiver must be able to consume it without generating an error, unless the field is a sub-element of another field where that parent field does NOT have a minimum cardinality of 1 [or a Must Support Flag]. For example, if the parent field has a cardinality of “0..1” or “0..*” the sub-element field does not need to be populated.",SHALL,Client,,true
+hl7.fhir.us.davinci-pdex_2.0.0,54,https://hl7.org/fhir/us/davinci-pdex/STU2/usecasescenarios.html#versioning-of-fhir-data,"If a payer chooses to support FHIR resource data versioning of related resource references, the referring resource **SHALL** use the vread format of reference: `[type]/[id]/_history/[vid]`",SHALL,Server,,true
+hl7.fhir.us.davinci-pdex_2.0.0,55,https://hl7.org/fhir/us/davinci-pdex/STU2/usecasescenarios.html#versioning-of-fhir-data,Supporting versioning of FHIR data implies supporting the [vread](https://www.hl7.org/fhir/http.html#vread) and [history](https://www.hl7.org/fhir/http.html#history) interactions in the FHIR specification.,SHALL,Server,,true
+hl7.fhir.us.davinci-pdex_2.0.0,56,https://hl7.org/fhir/us/davinci-pdex/STU2/StructureDefinition-pdex-priorauthorization.html,"Payers SHALL make available pending and active prior authorization decisions and related clinical documentation and forms for items and services, not including prescription drugs, including the date the prior authorization was approved, the date the authorization ends, as well as the units and services approved and those used to date, no later than one (1) business day after a provider initiates a prior authorization for the beneficiary or there is a change of status for the prior authorization.",SHALL,Server,,false