Patient Service: Query API

Die Query API: Patient Service ermöglicht es dem Versicherten oder Vertreter, die Versicherteninformationen des Aktenkontoinhabers abzurufen.

Einsatzbereich

Das ePA-FdV ruft die Versicherteninformationen ab, um dem Versicherten oder Vertreter Einsicht in die gespeicherten Daten zu ermöglichen.

Nachricht

Die Nachricht zum Abruf der Versicherteninformationen wird als HTTP GET-Anfrage an den Patient Service gesendet, um die aktuellen Daten des Aktenkontoinhabers abzurufen.

Auslösung

Wenn das ePA-FdV die Versicherteninformationen abrufen möchte, sendet es eine Query API: Patient Service Nachricht an den Patient Service.

Resource API

Bei Anfragen an die Query API für die Patient-Ressource wird die Antwort als ein FHIR Bundle des Typs searchset zurückgegeben. Dieses Bundle enthält eine Instanz der Patient-Ressource.

headerParams: - name: "x-insurantid" expectation: "MUSS" type: "string" description: "Health Record Identifier" - name: "x-useragent" expectation: "MUSS" type: "string" description: "User Agent Information" - name: "X-Request-ID" expectation: "KANN" type: "string" description: "UUID der Nachricht" responses: - statusCode: '200' description: "Successful operation" errorCode: "-" note: "-" - statusCode: '400' description: "Unknown search parameter" errorCode: "MSG_PARAM_UNKNOWN" note: "TIOperationOutcome" - statusCode: '400' description: "Invalid query parameter(s)" errorCode: "MSG_BAD_SYNTAX" note: "TIOperationOutcome" - statusCode: '400' description: "Invalid request" errorCode: "MSG_BAD_FORMAT" note: "TIOperationOutcome" - statusCode: '404' description: "Unknown resource type" errorCode: "MSG_UNKNOWN_TYPE" note: "TIOperationOutcome" responses: - statusCode: '200' description: "Successful operation" errorCode: "-" note: "-" - statusCode: '400' description: "Invalid request" errorCode: "MSG_BAD_FORMAT" note: "TIOperationOutcome" - statusCode: '404' description: "Unknown resource type" errorCode: "MSG_UNKNOWN_TYPE" note: "TIOperationOutcome" responses: - statusCode: '200' description: "Successful operation" errorCode: "-" note: "-" - statusCode: '400' description: "Invalid request" errorCode: "MSG_BAD_FORMAT" note: "TIOperationOutcome" - statusCode: '404' description: "Unknown resource type" errorCode: "MSG_UNKNOWN_TYPE" note: "TIOperationOutcome" - statusCode: '404' description: "Resource is not known" errorCode: "MSG_RESOURCE_ID_FAIL" note: "TIOperationOutcome" responses: - statusCode: '403' description: "Requestor not authorized" errorCode: "invalAuth" note: "No user session with valid ID-Token available" - statusCode: '403' description: "Requestor has no valid entitlement" errorCode: "notEntitled" note: "-" - statusCode: '403' description: "Requestor role is not in the list of allowed user groups" errorCode: "invalidOid" note: "-" - statusCode: '403' description: "Device registration does not exist" errorCode: "unregisteredDevice" note: "if requestor role is oid_versicherter only" - statusCode: '404' description: "Health record is in state UNKNOWN or INITIALIZED" errorCode: "noHealthRecord" note: "-" - statusCode: '409' description: "Health record is in state SUSPENDED" errorCode: "statusMismatch" note: "-" - statusCode: '500' description: "Any other error" errorCode: "internalError" note: "-" contentTypes: - "application/fhir+xml" - "application/fhir+json" headerParams: - name: "Accept" expectation: "KANN" type: "string" description: "Der Accept-Header gibt an, in welchem Format der Client die FHIR-Response erhalten möchte - unterstützt werden application/fhir+json und application/fhir+xml" base: "[base]" paths: /epa/patient/api/v1/fhir/Patient: get: include: - "#default-api" - "#base-responses" - "#query-responses" - "#fhir-api" - "#fhir-get-api" operationId: "listPatient_PatientSvc" fhir: capabilityStatement: url: "./CapabilityStatement-epa-patient-server.json" forResourceType: "Patient" responseExamples: - name: "application/fhir+json" type: JSON url: './Bundle-example-searchset-patient.json' - name: "application/fhir+xml" type: XML url: './Bundle-example-searchset-patient.xml' Der Patient Service MUSS die Suchparameter der Ressource Patient verarbeiten können, wie sie im CapabilityStatement mit dem Namen EPAPatientServer festgelegt sind.

Resource API (Versionshistorie)

base: "[base]" paths: /epa/patient/api/v1/fhir/Patient/_history: get: include: - "#default-api" - "#base-responses" - "#history-response" - "#fhir-api" - "#fhir-get-api" operationId: "listPatient_PatientSvc" responseExamples: - name: "application/fhir+json" type: JSON url: './Bundle-example-patient-history-bundle.json' - name: "application/fhir+xml" type: XML url: './Bundle-example-patient-history-bundle.xml'

Instance API

base: "[base]" paths: /epa/patient/api/v1/fhir/Patient/[id]: get: include: - "#default-api" - "#base-responses" - "#instance-responses" - "#fhir-api" - "#fhir-get-api" operationId: "getPatientById_PatientSvc" /epa/patient/api/v1/fhir/Patient/[id]/_history: get: include: - "#default-api" - "#base-responses" - "#instance-responses" - "#fhir-api" - "#fhir-get-api" operationId: "getPatientById_PatientSvc" /epa/patient/api/v1/fhir/Patient/[id]/_history/[versionId]: get: include: - "#default-api" - "#base-responses" - "#instance-responses" - "#fhir-api" - "#fhir-get-api" operationId: "getPatientById_PatientSvc"

Sicherheitsanforderungen

Der Patient Service MUSS sicherstellen, dass die generelle Ausführung zum Abrufen von Versicherteninformationen ausschließlich für das ePA-FdV mit der Nutzergruppe aus der nachstehenden Liste zugelassen wird:

professionOID
oid_versicherter

Generelle Sicherheitsanforderungen werden hier festgehalten.

Protokollierung

Die Protokollierung erfolgt über den Audit Event Service. Weitere Anforderungen sind [gemSpec_Aktensystem_ePAfueralle#Protokollierung] zu entnehmen.