PJD - XUA - SAML specification

Content:
0. Specification changelog
0.5 Mapping between old and new fields
1. Identity and Context claims
   1.1 SAML Assertions
   1.2 Relationship to IHE XUA Integration Profile
2. Assertion for Norwegian Identity Trust Framework for Health Care Services
   2.1 Generic Structure of the Identity Assertion
   2.2 Assertion Signature
   2.3 Attributes for Norwegian Trust Framework for Health Care Services
   2.4 Audit Trail Consideration
3. Examples

0. Specification changelog

This table specifiec from what time a given SAML specification will be active

Valid from (tentative)

SAML-endepunkt version

Spesifikasjon version

Environment

Comment

2020

V1.0

V1.1

Production

Version used in production by most users (may 2024)

13.03.24

V2.0

Hybrid (V1.1 + V2.0)

Production

Hybrid between old and new specification

xx.05.24

(Medio May)

V1.0

V1.2

Production

Include trust-framework:1.0:ext:care-relationship:healthcare-service

01.11.24

V2.0

V2.1

Production

Remove fields from old SAML-specification 1.x

0.5 Mapping between old and new fields

 

Old SAML-specification

New SAML-spesifikasjon (From 13.03.2024)

subject/NameID

subject/NameID

urn:oasis:names:tc:xspa:1.0:subject:subject-id   (deprecated XSPAv2)

urn:oasis:names:tc:xacml:1.0:subject:subject-id

urn:oasis:names:tc:xspa:2.0:subject:npi (finnes ikke i XSPAv2)

urn:oasis:names:tc:xspa:1.0:subject:npi

urn:ihe:iti:xua:2017:subject:provider-identifier

urn:ihe:iti:xua:2017:subject:provider-identifier

urn:oasis:names:tc:xspa:1.0:subject:role   (finnes ikke i XSPAv2)

urn:oasis:names:tc:xacml:2.0:subject:role

urn:oasis:names:tc:xspa:1.0:subject:organization-id

urn:oasis:names:tc:xspa:1.0:subject:organization-id

urn:oasis:names:tc:xspa:1.0:subject:organization

urn:oasis:names:tc:xspa:1.0:subject:organization

   -

urn:oasis:names:tc:xspa:1.0:subject:child-organization

   -

urn:nhn:trust-framework:1.0:ext:subject:child-organization-name

   -

urn:oasis:names:tc:xspa:1.0:subject:facility

   -

urn:nhn:trust-framework:1.0:ext:subject:facility-name

   -

urn:nhn:trust-framework:1.0:ext:care-relationship:healthcare-service

urn:oasis:names:tc:xspa:1.0:subject:purposeOfUse   (deprecated XSPAv2)

urn:oasis:names:tc:xacml:2.0:action:purpose

   -

urn:nhn:trust-framework:1.0:ext:care-relationship:purpose-of-use-details

   -

urn:nhn:trust-framework:1.0:ext:care-relationship:decision-ref

urn:oasis:names:tc:xacml:2.0:resource:resource-id   (finnes ikke i XSPAv2)

urn:oasis:names:tc:xacml:1.0:resource:resource-id

   -

urn:nhn:trust-framework:1.0:ext:resource:child-organization

   -

urn:nhn:trust-framework:1.0:ext:resource:child-organization-name

   -

urn:nhn:trust-framework:1.0:ext:resource:facility

   -

urn:nhn:trust-framework:1.0:ext:resource:facility-name

urn:no:ehelse:saml:1.0:subject:homeCommunityId (deprecated NHN)

urn:ihe:iti:xca:2010:homeCommunityId

urn:ihe:iti:bppc:2007:docid

urn:ihe:iti:bppc:2007:docid

urn:ihe:iti:xua:2012:acp

urn:ihe:iti:xua:2012:acp

urn:no:ehelse:saml:1.0:subject:SecurityLevel

    -

urn:no:ehelse:saml:1.0:subject:Scope

    -

urn:no:ehelse:saml:1.0:subject:client_id

    -

urn:no:ehelse:saml:1.0:subject:Authentication_method

    -

1. Identity and Context Claims

The OASIS Security Assertion Markup Language (OASIS SAML 2.0) is an XML framework for sharing identity, authenticity and authorization claims within a distributed environment.

The standard defines:

  • Assertions for encoding identity, authenticity, and authorization claims
  • Protocols for interacting with services which manage the lifecycle of SAML assertions
  • Bindings for implementing the protocols on different platforms.
  • Profiles for adapting assertions and protocols to specific scenarios.

 

SAML Assertions

SAML Assertions encapsulate statements about a subject. Such statements may cover the context of subject authentication, describing attributes about the subject and/or the subject's permissions. Each SAML assertion additionally contains information about the issuer of the assertion and the lifecycle of the assertion (e.g. validity conditions). SAML assertions are usually digitally signed by their issuer.

Relationship to IHE XUA Integration Profile

The IHE Cross-Enterprise User Assertion (XUA) integration profile defines conventions for using SAML identity assertions within healthcare scenarios.
For verifying the authenticity and legitimacy of the presenter of an assertion the XUA profile considers both the bearer method and the holder-of-key method.
These methods do not match the needs of a trust-brokered environment were the presenter of the assertion is not the subject but vouches for the subject.

2. Assertion for Norwegian Identity Trust Framework for Health Care Services

... TBD ...

Generic Structure of the Identity Assertion

The following table specified how the elements and attributes of a SAML v2.0 assertion are to be used with regard to the context of the eHealth DSI Identity Assertion.

Elements and attributes which are not explicitly profiled within this table MUST be ignored by the assertion consumer.

Attributes, presented in this norwegian specification, are build upon OASIS-specification Cross-Enterprise Security and Privacy Authorization (XSPA) Profile of SAML v2.0 for Healthcare version 2.0.
Additional attributes for norwegian trust framework are specified as extension in their own namespace.

The following table defines which categories MUST be filled (R), which MAY be filled (O) and which categories MUST NOT be used (X).

Assertion Element Optionality Usage convention
@Version R MUST be "2.0"
@ID R URN encoded unique identifier (UUID) of the assertion
@IssueInstant R time instant of issuance in UTC
Issuer R address URI that identifies the endpoint of issuing service e.g. "helseid-saml.nhn.no"
Subject R     
     NameId R Identifier of the HCP encoded as a string value (unspecified format)
          @Format R MUST be "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
     SubjectConfirmation R     
          @Method R MUST be "urn:oasis:names:tc:SAML:2.0:cm:bearer"
          SubjectConfirmationData X     
Conditions R     
     @NotBefore R Time instant from which the assertion is useable. This condition MUST be assessed by the assertion consumer to proof the validity of the assertion.
     AudienceRestriction R     
          Audience R This element of the assertion should contain a value identifying the X-Service Provider e.g. "kjernejournal-portal"
     @NotOnOrAfter R Time instant at which the assertion expires. This condition MUST be assessed by the assertion consumer to proof the validity of the assertion.
AuthnStatement R     
     @AuthnInstant R Time instant of HCP authentication in UTC
     @SessionNotOnOrAfter O Time instant of the expiration of the session
     AuthnContext R     
          AuthnContextClassRef R Reference to the HCP's authentication method, Two-Factor
Authentication method MUST be used:
See [OASIS SAML Authn] for a list of valid authentication methods: 
- urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered
- urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract
- urn:oasis:names:tc:SAML:2.0:ac:classes:X509
- urn:oasis:names:tc:SAML:2.0:ac:classes:SPKI
- urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI
- urn:oasis:names:tc:SAML:2.0:ac:classes:SoftwarePKI
- urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient


Assertion Signature

Every HCS Identity MUST be signed by its issuer.

Attributes for Norwegian Trust Framework for Health Care Services

An identity assertion can carry an arbitrary number of attributes on the authenticated entity. Each attribute MUST be encoded using a SAML attribute element.

 

 

 

 

Home Community ID
Friendly name: homecommunity-id
Name: 
urn:ihe:iti:xca:2010:homeCommunityId
Datatype: 
xs:anyURI
Valid values: Valid OID to Home Community MUST be presented.

Example values:
OID Name of homeCommunity 
urn:oid:2.16.578.1.12.4.1.7.1.1
 Norsk helsenett
Optionality: Mandatory
Description: OID-identifier to homeCommunity according IHE XDS/XCA-profiles where request is originating from.

Can be also identifier to middleware product as KJ-portal where Norsk helsenett is homeCommunity object in such case, otherwise it should be identifer representing home community as defined in IHE XDS
Sample fragment: 
                        
    ...

    <saml2:Attribute Name="urn:ihe:iti:xca:2010:homeCommunityId" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>urn:oid:2.16.578.1.12.4.1.7.1.1</saml2:AttributeValue>
    </saml2:Attribute>

    ...

 

 

 

 

 

Healthcare professional (HCP)
Friendly name: hcp-name
Name: 
urn:oasis:names:tc:xacml:1.0:subject:subject-id
Datatype: 
xs:string
Valid values: Human readable name of HCP, supporting norwegian alphabet

Example values: 
Ola Nordmann
Kari Nordmann
Kåre Skøyen Nordmann
Optionality: Mandatory
Description: This attribute MUST contain the full name of the HCP in human readable form
Sample fragment:   
                        
    ...

    <urn:oasis:names:tc:xacml:1.0:subject:subject-id" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>OLA NORDMANN</saml2:AttributeValue>
    </saml2:Attribute>

    ...

 

 

 

 

 

Healthcare Profesional Structional Role (HCP)
Friendly name: hcp-role
Name: 
urn:oasis:names:tc:xacml:2.0:subject:role
Datatype: 
urn:hl7-org#CE
Valid values: Value for structural role should represented as one of possible healthcare categories as defined in norwegian valueset

Example value:
Code EN NO 
<Role xmlns="urn:hl7-org:v3" xsi:type="CE" 
                    code="LE" codeSystem="2.16.578.1.12.4.1.1.9060"
                    codeSystemName="Kategori helsepersonell" displayName="Lege" />
 physician lege 
<Role xmlns="urn:hl7-org:v3" xsi:type="CE" 
                    code="PS" codeSystem="2.16.578.1.12.4.1.1.9060"
                    codeSystemName="Kategori helsepersonell" displayName="Psykolog" />
 psychologist psykolog 
<Role xmlns="urn:hl7-org:v3" xsi:type="CE" 
                    code="SP" codeSystem="2.16.578.1.12.4.1.1.9060" 
                    codeSystemName="Kategori helsepersonell" displayName="Sykepleier" />
 nurse sykepleier
Optionality: Optional
Description: HCP's approved health education level/approval in Norway. One HCP can have multiple different approvals in different healthcare categories.

Just the most appropriate role MUST be used in this context.
Sample fragment:   
                        
    ...

    <saml2:Attribute Name="urn:oasis:names:tc:xacml:2.0:subject:role" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>
            <Role xmlns="urn:hl7-org:v3" xsi:type="CE" code="LE" 
                codeSystem="2.16.578.1.12.4.1.1.9060" codeSystemName="Kategori helsepersonell" displayName="Lege" />
        </saml2:AttributeValue>
    </saml2:Attribute>

    ...

 

 

 

 

 

Healthcare Professional ID (HCP)
Friendly name: hcp-professional-id
Name: 
urn:oasis:names:tc:xspa:1.0:subject:npi
Datatype: 
xs:string
Valid values: Value represented in this attribute should refer to HCP's HPR-identifier if there is one existing (acknowleged authorized healthcare personell).

HPR-identifier is up to 9-digit string.

Example values: 
123456789
12345678
1234567
Optionality: Optional
Description: Identifier refering to HCP's approved health education level/approval in Norway
Sample fragment:   
                        
    ...

    <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:npi" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>12345678</saml2:AttributeValue>
    </saml2:Attribute>

    ...

 

 

 

 

 

Healthcare Professional ID-provider (HCP)
Friendly name: hcp-professional-id-provider
Name: 
urn:ihe:iti:xua:2017:subject:provider-identifier
Type 
urn:hl7-org:v3#II
Valid values: Value represented in this attribute should refer to HCP's HPR-identifier if there is one existing (acknowleged authorized healthcare personell), together with reference to assigning authority.
HPR-identifier is up to 9-digit string.

OID to assigning authority for norwegian healthcare personnel's identifier is always "2.16.578.1.12.4.1.4.4"

Example values: 
<id xmlns="urn:hl7-org:v3" type="II" extension="9999971" root="2.16.578.1.12.4.1.4.4" 
                            displayable="false" />
<id xmlns="urn:hl7-org:v3" type="II" extension="12345678" root="2.16.578.1.12.4.1.4.4" 
                            displayable="false" />
<id xmlns="urn:hl7-org:v3" type="II" extension="123456789" root="2.16.578.1.12.4.1.4.4"
                            displayable="false" />
Optionality: Optional
Description: Identifier refering to HCP's approved health education level/approval in Norway
Sample fragment:   
                        
    ...

    <saml2:Attribute Name="urn:ihe:iti:xua:2017:subject:provider-identifier" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>
            <id xmlns="urn:hl7-org:v3" type="II" extension="9999971" root="2.16.578.1.12.4.1.4.4" displayable="false" />
        </saml2:AttributeValue>
    </saml2:Attribute>

    ...

 

 

 

 

 

Healthcare Professional Organization (HCPO)
Friendly name: hcpo-organization-name
Name: 
urn:oasis:names:tc:xspa:1.0:subject:organization
Datatype: 
xs:string
Valid values: Human readable name of healthcare professional organization

Example values: 
Legekontor i Mordor
Hobbiton kommune
Optionality: Mandatory
Description: The name of the requesting organization, expecting the legal level of organization of the requesting HCP-user belongs to.
In plain text, the organization that the user belongs to shall be placed in the value of the element.
Sample fragment:   
                        
    ...

    <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:organization" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>Legekontor i Mordor</saml2:AttributeValue>
    </saml2:Attribute>

    ...

 

 

 

 

 

Healthcare Professional Organization ID (HCPO)
Friendly name: hcpo-organization-id
Name: 
urn:oasis:names:tc:xspa:1.0:subject:organization-id
Datatype: 
urn:hl7-org:v3#II
Valid values: Organization identifier from Brønnøysundsregistrene should be presented

Example values: 
<id xmlns="urn:hl7-org:v3" xsi:type="II" extension="123456789" root="2.16.578.1.12.4.1.4.101" 
                        assigningAuthorityName="Enhetsregisteret" displayable="true"/>
<id xmlns="urn:hl7-org:v3" xsi:type="II" extension="987654321" root="2.16.578.1.12.4.1.4.101" 
                        assigningAuthorityName="Enhetsregisteret" displayable="true"/>
Optionality: Mandatory
Description: Unique identifier of legal level of consuming organization (Healthcare Professional Organization), according to registration in Brønnøysundsregistrene.

A unique identifier for the organization that the user is representing in performing this transaction shall be placed in the value of the element. The organization ID may be an Object Identifier (OID), using the urn format (that is, “urn:oid:” appended with the OID); or it may be a URL assigned to that organization.
Sample fragment:   
                        
    ...

    <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:organization-id" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>
            <id xmlns="urn:hl7-org:v3" xsi:type="II" extension="123456789" root="2.16.578.1.12.4.1.4.101" 
                    assigningAuthorityName="Enhetsregisteret" displayable="true"/>
        </saml2:AttributeValue>
    </saml2:Attribute>

    ...

 

 

 

 

 

Point of care (HCPO)
Friendly name: hcpo-point-of-care
Name: 
urn:nhn:trust-framework:1.0:ext:subject:child-organization-name
Datatype: 
xs:string
Valid values: Human readable name of healthcare professional organization

Example values: 
Legekontor i Mordor
Kommunal legekontor i Hobbiton
Optionality: Optional
Description: Name of the hospital or medical facility which HCP is currently assosiated with.
Can be the same as HCPO, but can differ in large medical organizations
Sample fragment:   
                        
    ...

    <saml2:Attribute Name="urn:nhn:trust-framework:1.0:ext:subject:child-organization-name" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>Legekontor i Mordor</saml2:AttributeValue>
    </saml2:Attribute>

    ...

 

 

 

 

 

Point of care ID (HCPO)
Friendly name: hcpo-child-organization-id
Name: 
urn:oasis:names:tc:xspa:1.0:subject:child-organization
Datatype: 
urn:hl7-org:v3#II
Valid values: Organization's identifier from Brønnøysundsregistrene should be presented

Example values: 
<id xmlns="urn:hl7-org:v3" xsi:type="II" extension="123456789" root="2.16.578.1.12.4.1.4.101" 
            assigningAuthorityName="Enhetsregisteret" displayable="true"/>
<id xmlns="urn:hl7-org:v3" xsi:type="II" extension="987654321" root="2.16.578.1.12.4.1.4.101" 
            assigningAuthorityName="Enhetsregisteret" displayable="true"/>
Optionality: Optional
Description: Identifier to the hospital or medical facility (HCPO point-of-care).
Sample fragment:   
                        
    ...

    <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:child-organization" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>
            <id xmlns="urn:hl7-org:v3" xsi:type="II" extension="123456789" root="2.16.578.1.12.4.1.4.101" 
                    assigningAuthorityName="Enhetsregisteret" displayable="true"/>
        </saml2:AttributeValue>
    </saml2:Attribute>

    ...

 

 

 

 

 

Department (HCPO)
Friendly name: hcpo-department
Datatype: 
xs:string
Name: 
urn:nhn:trust-framework:1.0:ext:subject:facility-name
Valid values: Human-readable name of department or facility which HCP is currently assosiated with in current patient context

Example values: 
Gastrokirurgisk avdeling
Barnenevrologisk avdeling
Optionality: Optional
Description: Name of sub-unit in medical treatment facility which HCP is currently assosiated with, in current patient context.
Sample fragment:   
                        
    ...

    <saml2:Attribute Name="urn:nhn:trust-framework:1.0:ext:subject:facility-name" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>Gastrokirurgisk avdeling</saml2:AttributeValue>
    </saml2:Attribute>

    ...

 

 

 

 

 

HCPO Department ID (HCPO)
Friendly name: hcpo-department-id
Name: 
urn:oasis:names:tc:xspa:1.0:subject:facility
Datatype: 
urn:hl7-org:v3#II
Valid values: Department-ID should be referred as ID from respective register in Norway, e.g. RESH Example values: 
<Facility xmlns="urn:hl7-org:v3" xsi:type="II" extension="123456" root="2.16.578.1.12.4.1.4.102" 
                assigningAuthorityName="Register over enheter i spesialisthelsetjenesten" displayable="true" />
Optionality: Optional
Description: Idenfifier of sub-unit/department in medical treatment facility which HCP is currently assosiated with.
Sample fragment: 
                        
    ...

    <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:facility" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>
            <Facility xmlns="urn:hl7-org:v3" xsi:type="II" extension="123456" root="2.16.578.1.12.4.1.4.102" 
            assigningAuthorityName="Register over enheter i spesialisthelsetjenesten" displayable="true" />
        </saml2:AttributeValue>
    </saml2:Attribute>

    ...

 

 

 

 

 

Patient identifier (Patient)
Friendly name: patient-id
Name: 
urn:oasis:names:tc:xacml:1.0:resource:resource-id
Datatype: 
HL7 V2.5 CX
Valid values: Patient's identifier is presented in HL7 v2.5 CX-format

Use OID for respective format of patients identifier:
F-number OID: 2.16.578.1.12.4.1.4.1 (fødselsnummer) - registered citizen/permanent approval for residency in Norway
D-number OID: 2.16.578.1.12.4.1.4.2 (d-nummer) - temporary approval for residency in Norway
FHN-number OID: 2.16.578.1.12.4.1.4.3 (felles-hjelpenummer) - temporary identifer for health sector for unknown people
DUF-number OID: 2.16.578.1.12.4.1.4.5 (duf-nummer) - temporary identifier for registered refugee in Norway

Example values: 
<saml2:AttributeValue>13116900216^^^&2.16.578.1.12.4.1.4.1&ISO</saml2:AttributeValue>
<saml2:AttributeValue>41018500216^^^&2.16.578.1.12.4.1.4.2&ISO</saml2:AttributeValue>
Optionality: Mandatory
Description: One of patient's norwegian identifier which is approved for use in norwegian health sector. Identifier of the data object(s) being requested, e.g. the patient unique identifier, or the query string defining the requested data in case of bulk requests.
Sample fragment:   
                        
    ...

    <saml2:Attribute Name="urn:oasis:names:tc:xacml:1.0:resource:resource-id" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>
            <saml2:AttributeValue>13116900216^^^&2.16.578.1.12.4.1.4.1&ISO</saml2:AttributeValue>
        </saml2:AttributeValue>
    </saml2:Attribute>

    ...

 

 

 

 

 

Point-of-care (Patient)
Friendly name: patient-point-of-care
Name: 
urn:nhn:trust-framework:1.0:ext:resource:child-organization-name
Datatype: 
xs:string
Valid values: Human-readable name of institution where patient potentialy belongs to.

Example values: 
Galtvort sykehjem
Mordor helsestasjon
Optionality: Optional
Description: Name of the hospital or medical facility where patient belongs to
Sample fragment:   
                        
    ...

    <saml2:Attribute Name="urn:nhn:trust-framework:1.0:ext:resource:child-organization-name" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>Galtvort sykehjem</saml2:AttributeValue>
    </saml2:Attribute>

    ...

 

 

 

 

 

Point-of-care ID (Patient)
Friendly name: patient-point-of-care-id
Name: 
urn:nhn:trust-framework:1.0:ext:resource:child-organization
Datatype: 
urn:hl7-org:v3#II
Valid values: Organization's identifier from Brønnøysundsregistrene should be presented

Example values: 
<id xmlns="urn:hl7-org:v3" xsi:type="II" extension="123456789" root="2.16.578.1.12.4.1.4.101" 
                            assigningAuthorityName="Enhetsregisteret" displayable="true"/>
<id xmlns="urn:hl7-org:v3" xsi:type="II" extension="987654321" root="2.16.578.1.12.4.1.4.101" 
                            assigningAuthorityName="Enhetsregisteret" displayable="true"/>
Optionality: Conditional, mandatory if "Patient point-of-care"-attribute is present
Description: Identifier of the hospital or medical facility where patient belongs to
Sample fragment:   
                        
    ...

    <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:environment:locality" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>
            <id xmlns="urn:hl7-org:v3" xsi:type="II" extension="123456789" root="2.16.578.1.12.4.1.4.101" 
                assigningAuthorityName="Enhetsregisteret" displayable="true"/>
        </saml2:AttributeValue>
    </saml2:Attribute>

    ...

 

 

 

 

 

Treatment facility (Patient)
Friendly name: patient-department
Name: 
urn:nhn:trust-framework:1.0:ext:resource:facility-name
Datatype: 
xs:string
Valid values: Human-readable name of department/sub-unit in patients point-of-care organization where patient is treated.

Valid examples: 
Palliativ avdeling
Barne- og ungdomspsykiatrisk avdeling (BUPA)
Optionality: Optional
Description: Name of sub-unit in medical treatment facility where patient is treated
Sample fragment:   
                        
    ...

    <saml2:Attribute Name="urn:nhn:trust-framework:1.0:ext:resource:facility-name" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>Palliativ avdeling</saml2:AttributeValue>
    </saml2:Attribute>

    ...

 

 

 

 

 

Treatment facility ID (Patient)
Friendly name: patient-department-id
Name: 
urn:nhn:trust-framework:1.0:ext:resource:facility
Datatype: 
urn:hl7-org:v3#II
Valid values: Organization's identifier from Brønnøysundsregistrene should be presented

Example values: 
<id xmlns="urn:hl7-org:v3" xsi:type="II" extension="123456789" root="2.16.578.1.12.4.1.4.101" 
                        assigningAuthorityName="Enhetsregisteret" displayable="true"/>
<id xmlns="urn:hl7-org:v3" xsi:type="II" extension="987654321" root="2.16.578.1.12.4.1.4.101" 
                        assigningAuthorityName="Enhetsregisteret" displayable="true"/>
Optionality: Conditional, mandatory if "Patient department"-attribute is present
Description: Identifier of sub-unit in medical treatment facility where patient is treated
Sample fragment:   
                        
    ...

    <saml2:Attribute Name="urn:nhn:trust-framework:1.0:ext:resource:facility" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>
            <id xmlns="urn:hl7-org:v3" xsi:type="II" extension="123456789" root="2.16.578.1.12.4.1.4.101" 
                assigningAuthorityName="Enhetsregisteret" displayable="true">
        </saml2:AttributeValue>
    </saml2:Attribute>

    ...

 

 

 

 

 

Purpose of use (relationship)
Friendly name: purpose
Name: 
urn:oasis:names:tc:xacml:2.0:action:purpose
Datatype: 
urn:hl7-org:v3#CE
Valid values: Values for "purpose of use" is based on usage HL7 Valueset "PurposeOfUse" [urn:oid:2.16.840.1.113883.1.11.20448]

One of following values MUST be used in norwegian perspective:
Code: EN: NO: 
TREAT
 treatment behandling 
ETREAT
 emergency treatment akkuttbehandling 
COC
 coordination of care administrativ behandling 
BTG
 break the glass-emergency krisebehandling

Example values: 
<Purpose xmlns="urn:hl7-org:v3" xsi:type="CE" code="TREAT" codeSystem="2.16.840.1.113883.1.11.20448" 
                            displayName="treatment" />
<Purpose xmlns="urn:hl7-org:v3" xsi:type="CE" code="ETREAT" codeSystem="2.16.840.1.113883.1.11.20448" 
                            displayName="emergency treatment" />
<Purpose xmlns="urn:hl7-org:v3" xsi:type="CE" code="COC" codeSystem="2.16.840.1.113883.1.11.20448" 
                            displayName="coordination of care" />
Optionality: Mandatory
Description: This attribute refers to the usual working environment of the user

Note: Usage of "urn:oasis:names:tc:xspa:1.0:subject:purposeofuse" is deprecated by XSPA-profile for healthcare v2.0
Sample fragment:   
                        
    ...

    <saml2:Attribute Name="urn:oasis:names:tc:xacml:2.0:action:purpose" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>
            <Purpose xmlns="urn:hl7-org:v3" xsi:type="CE" code="TREAT" codeSystem="2.16.840.1.113883.1.11.20448" 
                displayName="treatment" />
        </saml2:AttributeValue>
    </saml2:Attribute>

    ...

 

 

 

 

 

Healthcare service (relationship)
Friendly name: healthcare-service
Name: 
urn:nhn:trust-framework:1.0:ext:care-relationship:healthcare-service
Datatype: 
urn:hl7-org:v3#CE
Valid values: Value from one of respective valuesets MUST be present. Valuesets er norwegian code valuesets from Volven (helsedirektoratet.no)
OID EN NO 
2.16.578.1.12.4.1.1.8451
 Area of profession Fagområde 
2.16.578.1.12.4.1.1.8627
 Healthcare services within healthcare specialist domain Tjenestetyper innen spesialisthelsetjenesten 
2.16.578.1.12.4.1.1.8668
 Healthcare services for healthcare specialist domain Tjenestetyper for spesialisthelsetjenesten 
2.16.578.1.12.4.1.1.8663
 Healthcare services for primary healthcare domain Tjenestetyper for kommunal helse- og omsorgstjeneste mv 
2.16.578.1.12.4.1.1.8662
 Healthcare services for county domain Fylkeskommunale tjenestetyper 
2.16.578.1.12.4.1.1.8664
 Healthcare services for pharmacies and bandaging suppliers Tjenestetyper for apotek og bandasjister 
2.16.578.1.12.4.1.1.8666
 Common healthcare services Felles tjenestetyper

Example values: 
<HealthcareService xmlns="urn:hl7-org:v3" xsi:type="CE" code="KX17" 
                codeSystem="2.16.578.1.12.4.1.1.8663" displayName="Fastlege, liste uten fast lege" 
                assigningAuthorityName="Helsedirektoratet" />
<HealthcareService xmlns="urn:hl7-org:v3" xsi:type="CE" code="KP02" 
                codeSystem="2.16.578.1.12.4.1.1.8663" displayName="Sykepleietjeneste" 
                assigningAuthorityName="Helsedirektoratet" />
Optionality: Mandatory
Description: Reference to healthcare service which is provided according to the treatment of patient. Just one, the most relevant, service MUST be presented.
Sample fragment:   
                        
    ...

    <saml2:Attribute Name="urn:nhn:trust-framework:1.0:ext:care-relationship:healthcare-service" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>
                <HealthcareService xmlns="urn:hl7-org:v3" xsi:type="CE" code="KP02" 
                    codeSystem="2.16.578.1.12.4.1.1.8663" displayName="Sykepleietjeneste"
                    assigningAuthorityName="Helsedirektoratet"/>
        </saml2:AttributeValue>
    </saml2:Attribute>

    ...

 

 

 

 

 

Purpose-of-use-details (relationship)
Friendly name: purpose-of-use-details
Name: 
urn:nhn:trust-framework:1.0:ext:care-relationship:purpose-of-use-details
Datatype: 
urn:hl7-org:v3#CE
Valid values: Refers to summary for purpose of use and providing healthcare services to refered patient.

Example values: 
<purpose-of-use-details xmlns="urn:hl7-org:v3" xsi:type="CE" code="15" 
                        codeSystem="urn:oid:2.16.578.1.12.4.1.1.9151" 
                        displayName="Helsetjenester i hjemmet" 
                        assigningAuthorityName="Helsedirektoratet" />
Optionality: Optional
Description: Reference to healthcare service which is provided according to the treatment of patient.
Sample fragment:   
                        
    ...

    <saml2:Attribute Name="urn:nhn:trust-framework:1.0:ext:care-relationship:purpose-of-use-details" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>
            <purpose-of-use-details xmlns="urn:hl7-org:v3" xsi:type="CE" code="15" 
                        codeSystem="urn:oid:2.16.578.1.12.4.1.1.9151" 
                        displayName="Helsetjenester i hjemmet" 
                        assigningAuthorityName="Helsedirektoratet" />
        </saml2:AttributeValue>
    </saml2:Attribute>

    ...

 

 

 

 

 

Decision reference (relationship)
Friendly name: decision-ref
Name: 
urn:nhn:trust-framework:1.0:ext:care-relationship:decision-ref
Datatype: 
urn:nhn:trust-framework:1.0#CD
Valid values: "Id"-identifier should be presented as UUID
"User-selected" MUST be boolean value

Example values: 
    <decision-ref> 
        <id tf:value="urn:uuid:b0b87276-79aa-4643-9bb3-7760b1f43a4d" />
        <user-selected tf:value="false" />
    </decision-ref>
    
    <decision-ref> 
        <id tf:value="urn:uuid:c1b87276-27bb-9873-4hh7-1278b1c53a8e" />
        <user-selected tf:value="true" />
    </decision-ref>
Optionality: Optional
Description: Reference to EHR's PDP identifier, identifier representing decision point in EHR allowing HCP to access patient record.
Sample fragment:   
                        
    ...

    <saml2:Attribute Name="urn:nhn:trust-framework:1.0:ext:care-relationship:decision-ref" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>
            <decision-ref> 
                <id tf:value="urn:uuid:b0b87276-79aa-4643-9bb3-7760b1f43a4d" />
                <user-selected tf:value="false" />
            </decision-ref>
        </saml2:AttributeValue>
    </saml2:Attribute>

    ...

 

 

 

 

 

BPPC DOCID
Friendly name: bppc-docid
Name: 
urn:ihe:iti:bppc:2007:docid
Datatype: 
urn:oid
Valid values: An "OID"-identifier should be present
There are to following values:
OID Description 
2.16.578.1.12.4.1.7.2.2.1
 Digital channel 
2.16.578.1.12.4.1.7.2.2.2
 Analog channel
Example values: 
    <saml:AttributeValue xmlns:a="http://www.w3.org/2001/XMLSchema-instance" a:nil="true"/>
                    
    <saml2:AttributeValue>urn:oid:2.16.578.1.12.4.1.7.2.1.6</saml2:AttributeValue>
Optionality: Conditional, if "XUA ACP"-attribute present
Description: Reference to an OID identifier, identifier represents form of applied consent.
Sample fragment:   
                        
    ...

    <saml2:Attribute Name="urn:ihe:iti:bppc:2007:docid" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue>urn:oid:2.16.578.1.12.4.1.7.2.2.1</saml2:AttributeValue>
    </saml2:Attribute>

    ...

 

 

 

 

 

XUA ACP
Friendly name: xua-acp
Name: 
urn:ihe:iti:xua:2012:acp
Datatype: 
urn:oid
Valid values: An "OID"-identifier should be present
There are to following values:
OID Description 
nil/null - ingen verdi
 Healthcare professional [subject] has not neccessary acknowledge to open and see patient's healthcare data [resource] and there is no need for any overrides 
2.16.578.1.12.4.1.7.2.1.4
 Healthcare professional [subject] is not obliged to retrieve patient's consent to [resource] open and see patient's healthcare data, e.g. "patient's regular physician" (fastlege) 
2.16.578.1.12.4.1.7.2.1.5
 Healthcare professional [subject] has been given explicit consent from patient [resource] to open and see patient's healthcare data, including locked data 
2.16.578.1.12.4.1.7.2.1.6
 Healthcare professional [subject] is not able to retrieve consent from current patient [resource] (e.g. patient is unconscious) 
2.16.578.1.12.4.1.7.2.1.7
 Healthcare professional [subject] has documented reasons to unlock all available healthcare data for current patient [resource] in an emergency/catastrophic situation 
2.16.578.1.12.4.1.7.2.1.8
 Healthcare professional [subject] has retrieved consent from patient [resource] to open and see patient's healthcare data
Example values: 
        <saml:AttributeValue xmlns:a="http://www.w3.org/2001/XMLSchema-instance" a:nil="true"/>
                    
        <saml2:AttributeValue>urn:oid:2.16.578.1.12.4.1.7.2.1.6</saml2:AttributeValue>
Optionality: Optional
Description: Reference to OID identifier, reffering to an existing access consent policy
Sample fragment:   
                        
    ...

    <saml2:Attribute Name="urn:ihe:iti:xua:2012:acp" 
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue>urn:oid:2.16.578.1.12.4.1.7.2.1.6</saml2:AttributeValue>
    </saml2:Attribute>

    ...


Audit Trail Consideration

The audit message MUST be assembled according to the HCP Assurance audit schema as defined in [Audit Trail Profile].
The following table defines which categories MUST be filled (R), which MAY be filled (O) and which categories MUST NOT be used (X).

Instance Optionality Decription
Event R Audited event
Requesting point of care R HCPO which is in treatment relationship with the patient
Human requestor R HCP who requested patient information
Source gateway R Outbound gateway that attested authenticity of trust framework information
Target Gateway X  
Audit Source R Legal entity that ensures the uniquenes of the identifiers that are used to identify active participants
Event target X  


3. Examples

Examples are taken from TEST-environment and does not contain sensitive information.