ACP+Retrieval

=**What is the mechanism by which a responding node retrieves an asserted Access Consent Policy (ACP)?**=

**Information in red has not yet been validated**

An initiating node includes an Authorization Decision Statement, as specified in section 3.3.3 of the Authorization Framework. This OPTIONAL statement provides a means by which an initiating node asserts that it holds an ACP or patient specific instance of and ACP which the responding node may wish to evaluate its response decision. The information contained in the Auth Decision Statement MAY be used by the responder to retrieve the an asserted patient specific instance of an ACP.
 * Scenario/Background**

As specified in section 3.3.3.1 of the Auth Framework, the Auth Decision Statement must contain **at least one** of the following attributes:
 * 1) An  element with the name **“AccessConsentPolicy”** and NameFormat “http://www.hhs.gov/healthit/nhin”. The value(s) for this attribute will be the OID(s) of the access policies that the asserting entity has previously communicated to or agreed to with other entities. The OIDs MUST be expressed using the urn format ( e.g. - urn:oid:1.2.3.4). __An ACP is not intended to be retrieved via Nationwide Health Information Network transactions__.
 * 2) An  element with the name **“InstanceAccessConsentPolicy”** (IACP) and NameFormat “http://www.hhs.gov/healthit/nhin”. The value(s) of this attribute will be the OID(s) of the patient specific access policy instances. The OIDs MUST be expressed using the urn format ( e.g. - urn:oid:1.2.3.4.123456789). If a requestor specifies this Attribute, the requestor MUST support the ability for the specified policy document(s) to be retrieved via the mechanism described in HITSP TP30 - via Nationwide Health Information Network Query for Documents and Nationwide Health Information Network Retrieve Documents.

In the event the responding node wants to retrieve an InstanceAccessConsentPolicy, the responder must use the Query for Document and the Retrieve Documents web services to query for and then retrieve the asserted IACP(s).

In the original request, the responder was supplied with the Patient ID (PID) for the patient who is the subject of the request, as well as the OID(s) for the asserted IACP(s). The responder is unable to proceed straight to Retrieve Document because they may not have the **repositoryUniqueID** and the asserted IACP OID(s) may not be **documentUniqueIDs**. See Nationwide Health Information Network Retrieve Documents section 3.3 for more information.
 * Guidance**

Section 3.2 of the Nationwide Health Information Network Access Consent Policy specification states that the metadata elements listed in Table 1 of that section must be used on query transactions related to Access Consent Policies. To clarify, a portion of the elements listed in that table pertain only to the query request or the response. Those distinctions are provided below.

__IACP Query Request__
 * **$XDSDocumentEntryPatientID - __SHALL__** be populated with the **resource-id** included in the SAML assertion of the original request, as described in section 3.3.2.7 of the Nationwide Health Information Network Auth Framework.
 * **$XDSDocument Entry EventCodeList - __SHALL__** be populated with the **InstanceAccessConsentPolicy** value(s) included in the SAML assertion of the original request as described above and in section 3.3.3.1 of the Nationwide Health Information Network Auth Framework specification.
 * **$XDSDocuemntEntryStatus - MUST** be populated with the 'Approved' or 'Deprecated' as described in section Section 3.18.4.1.2.3.7 of Vol 2a of IHE ITI TF and listed in Section 4.1.7, Table 4.1-5 of Vol 3 of the IHE ITI TF. Nationwide Health Information Network also allows the use of 'DeferredCreation'.
 * **$XDSDocumentEntryClassCode** - **__MAY__** be populated with LOINC code 57016-8, as listed in Table 2-144 of HITSP C80 v2.0.1. This code corresponds to **InstanceAccessConsentPolicy.** The only reason to include this code is to constrain the list of returned documents, which is unlikely to be necessary since **$XDSDocument Entry EventCodeList** is required.

__IACP Query Response__ In addition to the elements listed above for the query, the remaining elements in Table 1 of Section 3.2 of Nationwide Health Information Network Access Consent Policies are associated with the response as indicated in that table.