AWS healthlake documentation change
Summary
Updated documentation for FHIR $davinci-data-export operation: Added new 'provider-snapshot' export type, clarified temporal filtering rules per export type, expanded financial data stripping details for ExplanationOfBenefit resources, and enhanced security authorization notes.
Security assessment
The changes clarify authorization requirements (system-level scopes/IAM only) and explicitly state that patient/user-level scopes are rejected. Financial data stripping documentation was expanded to detail privacy protections, but no specific vulnerability fix is indicated. Enhanced security documentation exists but isn't tied to a resolved incident.
Diff
diff --git a/healthlake/latest/devguide/reference-fhir-operations-davinci-data-export.md b/healthlake/latest/devguide/reference-fhir-operations-davinci-data-export.md index fccbbade1..999aa426e 100644 --- a//healthlake/latest/devguide/reference-fhir-operations-davinci-data-export.md +++ b//healthlake/latest/devguide/reference-fhir-operations-davinci-data-export.md @@ -7 +7 @@ -Key FeaturesOperation EndpointRequest ParametersExport TypesProfile Support and Inclusion LogicFive-Year Temporal Filtering for PDex ExportsSample RequestsSample ResponseResource RelationshipsJob ManagementOutput FormatError HandlingSecurity and AuthorizationBest PracticesLimitationsAdditional Resources +Key FeaturesOperation EndpointRequest ParametersExport TypesProfile Support and Inclusion LogicTemporal filtering for PDex exportsSample RequestsSample ResponseResource RelationshipsJob ManagementOutput FormatError HandlingSecurity and AuthorizationBest PracticesLimitationsAdditional Resources @@ -44,2 +44,2 @@ Parameter | Cardinality | Description -`exportType` | 0..1 | Type of export to perform. Valid values: `hl7.fhir.us.davinci-atr`, `hl7.fhir.us.davinci-pdex`, `hl7.fhir.us.davinci-pdex.p2p`, `hl7.fhir.us.davinci-pdex.member`. Default: `hl7.fhir.us.davinci-atr`. -`_includeEOB2xWoFinancial` | 0..1 | Specifies whether to include CARIN BB 2.x ExplanationOfBenefit resources with financial data removed. Default: `false`. +`exportType` | 0..1 | The type of export to perform. Valid values: `hl7.fhir.us.davinci-atr` (ATR), `hl7.fhir.us.davinci-pdex` (Provider Access), `hl7.fhir.us.davinci-pdex#provider-snapshot` (Provider Access snapshot), `hl7.fhir.us.davinci-pdex.p2p` (Payer-to-Payer), `hl7.fhir.us.davinci-pdex.member` (Member Access). Default: `hl7.fhir.us.davinci-atr`. +`_includeEOB2xWoFinancial` | 0..1 | When set to `true`, includes `ExplanationOfBenefit` resources that declare a CARIN BB 2.x Financial (non-Basis) profile in the export with financial data stripped. The exported resource conforms to the corresponding Basis profile, but the original resource in the data store is not modified. This parameter has no effect on resources that already declare a Basis profile, as those are always included and have residual financial data removed automatically. Default: `false`. @@ -48,0 +49,8 @@ Parameter | Cardinality | Description +###### Filter behavior for _security and _tag + +The `_security` and `_tag` filters apply to all export types, including `hl7.fhir.us.davinci-atr`. These filters also support the following FHIR search modifiers: `:not`, `:missing`, `:text`, `:above`, and `:below`. For example, you can use `_tag:not=archived` or `_security:missing=true`. The operation excludes from the export any resources that do not match the supplied filters. + +###### ExplanationOfBenefit financial data + +The following financial data fields are removed from all exported CARIN BB 2.x `ExplanationOfBenefit` resources, regardless of whether the resource declares a Basis or a Financial profile: adjudication amounts, `payment`, `total`, `benefitPeriod`, `benefitBalance`, and item `net` and `unitPrice`. This ensures that financial data is not exported on Da Vinci Provider Access and Payer-to-Payer paths. `ExplanationOfBenefit` resources that declare only a PDex Prior Authorization profile (without a CARIN BB 2.x profile) are exported unchanged and no financial data is removed. If a resource declares both profiles, financial data is stripped. + @@ -81 +89,2 @@ Export Type | Purpose | Data Scope | Temporal Limit -`hl7.fhir.us.davinci-pdex` | Provider Access API | Clinical and claims data for attributed patients | 5 years +`hl7.fhir.us.davinci-pdex` | Provider Access API | Clinical and claims data for attributed patients | None +`hl7.fhir.us.davinci-pdex#provider-snapshot` | Provider Access API (snapshot) | All clinical, prior authorization, and non-financial claims and encounter data for attributed patients | None @@ -85 +94,3 @@ Export Type | Purpose | Data Scope | Temporal Limit -###### Note +###### Temporal limits by export type + +The 5-year temporal limit applies only to the Payer-to-Payer (`hl7.fhir.us.davinci-pdex.p2p`) and Member Access (`hl7.fhir.us.davinci-pdex.member`) export types. The Provider Access export types (`hl7.fhir.us.davinci-pdex` and `hl7.fhir.us.davinci-pdex#provider-snapshot`) have no temporal restriction. For the export types that are temporally limited, the 5-year limit does not apply to ATR resource types (`Group`, `Patient`, `Coverage`, `RelatedPerson`, `Practitioner`, `PractitionerRole`, `Organization`, `Location`). These resources are always included regardless of age. @@ -87 +98,3 @@ Export Type | Purpose | Data Scope | Temporal Limit -For PDex exports, the 5-year temporal limit does not apply to ATR resource types (`Group`, `Patient`, `Coverage`, `RelatedPerson`, `Practitioner`, `PractitionerRole`, `Organization`, `Location`). These resources are always included regardless of age. +###### Temporal filtering basis + +Temporal limits and the `_since` and `_until` parameters are evaluated against each resource's `meta.lastUpdated` timestamp rather than clinical or service dates. This provides consistent temporal filtering across all resource types. @@ -122,0 +136,5 @@ Enables in-network providers to retrieve patient data for attributed patients. +Provider Access — snapshot (`hl7.fhir.us.davinci-pdex#provider-snapshot`) + + +Returns a full snapshot of all clinical, prior authorization, and non-financial claims and encounter data for attributed patients. This export type behaves the same as `hl7.fhir.us.davinci-pdex` and is not subject to a temporal limit. + @@ -131 +149 @@ Member Access (`hl7.fhir.us.davinci-pdex.member`) -Enables members to access their own health data. This export type may include financial data in claims resources. +Enables members to access their own health data. @@ -145 +163 @@ For PDex exports, the `$davinci-data-export` operation uses profile declarations - * ExplanationOfBenefit resources with a CARIN BB 2.x Basis profile are always included. + * ExplanationOfBenefit resources with a CARIN BB 2.x Basis profile are always included, with any residual financial data removed so that the resource conforms to the CARIN BB 2.x Non-Financial Basis profile. @@ -153,0 +172,4 @@ For PDex exports, the `$davinci-data-export` operation uses profile declarations +###### Profile precedence for financial-data stripping + +When an ExplanationOfBenefit resource declares multiple profiles, financial-data stripping takes precedence over pass-through. For a resource that declares both a Basis (or Financial) profile and a PDex Prior Authorization profile, the operation removes financial data before exporting the resource. + @@ -158 +180,9 @@ When you set `_includeEOB2xWoFinancial=true`, the operation transforms [CARIN BB -The following financial data elements are removed during transformation: +The operation removes the following financial data elements in two scenarios: when it transforms a CARIN BB 2.x Financial resource to its Basis profile (using `_includeEOB2xWoFinancial=true`), and when it removes residual financial data from a CARIN BB 2.x Basis resource: + + * The `total` element + + * The `payment` element + + * The `benefitPeriod` element + + * The `benefitBalance` element @@ -160 +190 @@ The following financial data elements are removed during transformation: - * All slicing on `total` elements + * The `adjudication` amount entries (the `amount` slice; non-financial entries such as `benefitpaymentstatus` and `billingnetworkstatus` are preserved) @@ -162 +192 @@ The following financial data elements are removed during transformation: - * All `adjudication` elements with `amounttype` slice + * The `item.net` element @@ -164 +194,3 @@ The following financial data elements are removed during transformation: - * All `item.adjudication` elements with amount information + * The `item.unitPrice` element + + * The `item.adjudication` amount entries @@ -195 +227 @@ The operation uses the following rules to detect and validate profiles: -## Five-Year Temporal Filtering for PDex Exports +## Temporal filtering for PDex exports @@ -197 +229 @@ The operation uses the following rules to detect and validate profiles: -For all PDex export types, HealthLake applies a 5-year temporal filter based on when the resource was last updated. The temporal filter applies to all resources except the following core attribution resource types, which are always exported regardless of age: +HealthLake applies a 5-year temporal filter for the Payer-to-Payer (`hl7.fhir.us.davinci-pdex.p2p`) and Member Access (`hl7.fhir.us.davinci-pdex.member`) export types. The filter is based on when the resource was last updated. The Provider Access export types (`hl7.fhir.us.davinci-pdex` and `hl7.fhir.us.davinci-pdex#provider-snapshot`) are not subject to any temporal limit. For the temporally limited export types, the filter applies to all resources except the following core attribution resource types, which are always exported regardless of age: @@ -247,0 +280,5 @@ _Provider Access export with ExplanationOfBenefit financial data removal_ +_Provider Access snapshot export_ + + + GET https://healthlake.{region}.amazonaws.com/datastore/{datastoreId}/r4/Group/example-group/$davinci-data-export?exportType=hl7.fhir.us.davinci-pdex%23provider-snapshot + @@ -374,0 +412,2 @@ Resource Validation Errors +`$davinci-data-export` is a backend bulk operation authorized through IAM permissions or system-level SMART on FHIR (OAuth 2.0) scopes; requests presenting patient- or user-level scopes are rejected. The operation does not evaluate FHIR Consent resources to filter or restrict the exported data. + @@ -394 +433 @@ Resource Validation Errors - * _Temporal Filter Awareness_ : For PDex exports, consider the 5-year temporal filter when you select resource types + * _Temporal Filter Awareness_ : For Payer-to-Payer and Member Access exports, consider the 5-year temporal filter when you select resource types @@ -413 +452 @@ Resource Validation Errors - * PDex exports are limited to 5 years of clinical and claims data + * Payer-to-Payer and Member Access exports are limited to 5 years of clinical and claims data