Permission lattice

The decision, opened up. For Ryan Gomez (System Administrator) under purpose operations, every action on every selected system is decided by six bounds in order — identity, practitioner, source, phi, necessity, target, target — and the narrowest one wins. The cell that set the decision is marked; a bound not consulted because an earlier one already refused says so rather than guessing.

Purpose Treatment Payment Health care operations Patient request Legal Research only the purposes this role may assert are offered — the lattice cannot be widened past the role

No patient in context — identity cells are decided per patient at run time, so they read not applicable here. Pick one below to see the lattice for a chart.

Northside Health (Epic)

smart backend services PHI AI signs RS384 no scope in the token request bulk export: yes conditional create: yes creatable: DocumentReference, Condition, Observation, DiagnosticReport, ServiceRequest, MedicationRequest, AllergyIntolerance, Immunization, Procedure, Encounter

Action	identity	practitioner	source	phi	necessity	target	narrowest wins
Read chart ingest · Patient · patient:read	n/a decided per patient at run time	n/a reads carry no author; the crosswalk binds deliveries	allow the profile records 15 resource types for ingestion from Northside Health (Epic) over smart backend services - the vendor's published surface where one is published; confirm on the instance's CapabilityStatement	allow heightened categories withheld: purpose operations does not permit them	allow Patient is within the minimum necessary for purpose operations — minimum necessary applies (45 CFR 164.502(b)(1))	n/a ingest writes nothing	allow allowed on every consulted bound
Export population ingest · Group · integration:view	n/a population-level: no single patient to link; each later delivery is decided per patient against its verified link	n/a reads carry no author; the crosswalk binds deliveries	allow Group-level Bulk Data Export only; requires a Group FHIR ID from Epic; rate-limited to once per 24 hours per group and client; every kickoff is a full re-extract	allow heightened categories withheld: purpose operations does not permit them	allow Group is within the minimum necessary for purpose operations — minimum necessary applies (45 CFR 164.502(b)(1))	n/a ingest writes nothing	allow allowed on every consulted bound
Deliver note deliver · DocumentReference · integration:export	n/a decided per patient at run time	allow Ryan Gomez authors as Practitioner/e1cumljlf8mai (ict · ICT professional) on epic	n/a reads are bounded at the source, not here	allow heightened categories withheld: purpose operations does not permit them; psychotherapy notes never on a deliver path	refuse decided here DocumentReference is more than purpose operations needs — minimum necessary applies (45 CFR 164.502(b)(1)). Permitted for this purpose: Patient, Group, Condition, Observation, DiagnosticReport, ServiceRequest	n/a not consulted - refused earlier	refuse DocumentReference is more than purpose operations needs — minimum necessary applies (45 CFR 164.502(b)(1)). Permitted for this purpose: Patient, Group, Condition, Observation, DiagnosticReport, ServiceRequest
Deliver problem deliver · Condition · integration:export	n/a decided per patient at run time	allow Ryan Gomez authors as Practitioner/e1cumljlf8mai (ict · ICT professional) on epic	n/a reads are bounded at the source, not here	allow heightened categories withheld: purpose operations does not permit them; psychotherapy notes never on a deliver path	allow Condition is within the minimum necessary for purpose operations — minimum necessary applies (45 CFR 164.502(b)(1))	allow Northside Health (Epic) has licensed a write path covering Condition — the vendor's free surface would not accept it, and this site's agreement does. Conditional create (If-None-Exist) is wired, so a re-run does not duplicate	allow allowed on every consulted bound
Deliver result deliver · Observation · integration:export	n/a decided per patient at run time	allow Ryan Gomez authors as Practitioner/e1cumljlf8mai (ict · ICT professional) on epic	n/a reads are bounded at the source, not here	allow heightened categories withheld: purpose operations does not permit them; psychotherapy notes never on a deliver path	allow Observation is within the minimum necessary for purpose operations — minimum necessary applies (45 CFR 164.502(b)(1))	allow Northside Health (Epic) has licensed a write path covering Observation — the vendor's free surface would not accept it, and this site's agreement does. Conditional create (If-None-Exist) is wired, so a re-run does not duplicate	allow allowed on every consulted bound
Deliver report deliver · DiagnosticReport · integration:export	n/a decided per patient at run time	allow Ryan Gomez authors as Practitioner/e1cumljlf8mai (ict · ICT professional) on epic	n/a reads are bounded at the source, not here	allow heightened categories withheld: purpose operations does not permit them; psychotherapy notes never on a deliver path	allow DiagnosticReport is within the minimum necessary for purpose operations — minimum necessary applies (45 CFR 164.502(b)(1))	allow Northside Health (Epic) has licensed a write path covering DiagnosticReport — the vendor's free surface would not accept it, and this site's agreement does. Conditional create (If-None-Exist) is wired, so a re-run does not duplicate	allow allowed on every consulted bound
Deliver order deliver · ServiceRequest · integration:export	n/a decided per patient at run time	allow Ryan Gomez authors as Practitioner/e1cumljlf8mai (ict · ICT professional) on epic	n/a reads are bounded at the source, not here	allow heightened categories withheld: purpose operations does not permit them; psychotherapy notes never on a deliver path	allow ServiceRequest is within the minimum necessary for purpose operations — minimum necessary applies (45 CFR 164.502(b)(1))	allow Northside Health (Epic) has licensed a write path covering ServiceRequest — the vendor's free surface would not accept it, and this site's agreement does. Conditional create (If-None-Exist) is wired, so a re-run does not duplicate	allow allowed on every consulted bound

Withheld categories

The categories the delivery gate withholds, corpus-wide. No patient is in context, so no counts. No target has earned any of them: this demo holds no disclosure-consent record for a target system, and release of information is the only path that can carry one out. Purpose operations does not permit heightened categories at all — both gates hold. Psychotherapy notes never travel on a deliver path.

Category	count	at delivery
Domestic & intimate partner violence domestic_violence	—	withheld the purpose does not permit it; the target has not earned it
Abuse & neglect abuse_neglect	—	withheld the purpose does not permit it; the target has not earned it
SUD — 42 CFR Part 2 sud_part2	—	withheld the purpose does not permit it; the target has not earned it
Mental health mental_health	—	withheld the purpose does not permit it; the target has not earned it
Reproductive health reproductive	—	withheld the purpose does not permit it; the target has not earned it
HIV hiv	—	withheld the purpose does not permit it; the target has not earned it
Genetic genetic	—	withheld the purpose does not permit it; the target has not earned it
Sexually transmitted infection sti	—	withheld the purpose does not permit it; the target has not earned it
Gender identity & affirming care gender_identity	—	withheld the purpose does not permit it; the target has not earned it
Minor-consented confidential service minor_confidential	—	withheld the purpose does not permit it; the target has not earned it

Who is this for?

This feature works on a patient, and no patient is in context. Pick one — the selection is recorded, and it follows you until you clear it or switch roles.

Recently seen patients shown — or search above. The full roster is in Patients & charts.

The lattice is orch_decide rendered, the same function the preflight and the run call. What you see here is what a run would do.