device-compartment

device_compartment Validator Documentation
FHIR Compartment-Based Access Control for Device-Linked Resources

---

Intent

The device_compartment validator restricts access to resources explicitly linked to the authenticated device’s FHIR compartment. It ensures automated or headless devices (e.g., lab instruments, IoT sensors) can only interact with data they generate or manage.

Key Use Cases:

• Lab equipment submitting DiagnosticReport results.
• Wearable devices recording Observation data (e.g., heart rate).
• Imaging machines updating Media or ImagingStudy resources.

---

Key Features

1. Role Enforcement:
   • Validates that the client has the Device role. Requests from non-device roles (e.g., Practitioner) are denied.
2. Compartment Membership Check:
   • Confirms the requested resource type belongs to the FHIR Device compartment (e.g., DeviceMetric, Observation).
3. Reference Validation:
   • For create/update operations, ensures the resource references the device’s ID (e.g., Observation.performer = Device/<id>).

---

Validation Logic

Step	Action	Error If Failed
1	Check client_role is Device.	403 Forbidden (Invalid role)
2	Verify resource type is in the Device compartment.	403 Forbidden (Invalid compartment)
3	For write operations, validate device ID in relevant fields (e.g., performer, device).	403 Forbidden (Reference mismatch)

---

Example Configurations

1. Read Access to Observation

{
  "client_role": "Device",
  "entity_name": "Observation",
  "operation": "read",
  "validator": "device_compartment"
}

Explanation: A device can read Observation resources

2. Submit a Device Metric

{
  "client_role": "Device",
  "entity_name": "DeviceMetric",
  "operation": "create",
  "validator": "device_compartment"
}

---

FHIR References

1. Device Compartment Definition:
   FHIR R4 Device Compartment (Official HL7 documentation).
2. Resource Examples:
   • Observation.performer
   • DeviceMetric.source

---

Authentication Notes

• Headless Devices: Supports OAuth 2.0 Device Code Flow for authentication.
• Cloud Services: Not yet supported (future roadmap item).

---

Use Case: Lab Equipment Integration

A hematology analyzer uses this validator to:

1. Submit lab results: Creates Observation resources with performer set to its Device ID.
2. Monitor calibration metrics: Updates DeviceMetric resources linked to its compartment.

Error Handling:

• A device attempting to access another device’s Observation data receives a 403 Forbidden response.