> For the complete documentation index, see [llms.txt](https://help.santesuite.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.santesuite.org/operations/server-administration/configuration-tool/security-settings/data-privacy-filtering.md).
# Data Privacy Filtering
The `Data Privacy Filtering` panel controls the configuration of the data privacy services in SanteDB. Data privacy services allow administrators to:
* Control how sensitive data is handled in SanteDB iCDR
* Control which resources have specific privacy sensitivity in SanteDB iCDR
* Control how sensitive records are disclosed or updated
* Control which properties on which resources are forbidden (and will result in a privacy violation exception when collected, or queried).
| Option | Description | Example |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- |
| Default Action | The action which should be applied to all resources which have been flagged as sensitive, where no specific policy has been assigned. | See: [Policy Actions](#undefined) |
| Resources | The resources which are to be protected with specialized policy enforcement. | |
## Resource Controls
Expanding the resources input allows administrators to specify resources in the RIM which are subject to special protections. Clicking the ellipsis on the resources property will open a collection editor change the settings for resource controls:
| Option | Description | Example |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- |
| Action | The action to be applied on resources which have privacy policies applied to them, when the requesting user does not have a grant for the policy. | See: [Policy Actions](#undefined) |
| Resource Type | The type of resource that the policy applies to. | Patient, Person, etc. |
| Fields | The properties which are forbidden or have specialized sub-policy enforcement instructions. | See: [#property-policies](#property-policies "mention") |
{% hint style="info" %}
You can set policies on identifiers (on entities and acts) by controlling the policy on `AssigningAuthority`.
{% endhint %}
## Property Policies
The property policies allow implementing jurisdictions to control which properties in which resources are forbidden. Examples of this functionality are:
* Restricting the collection, disclosure, or querying of Patient religion or ethnicity to all users
* Restricting the disclosure, collection or querying of Patient VIP status to only users which have "Access to Taboo Information" policy.
| Option | Description | Example |
| -------- | --------------------------------------------------------------------------------------------- | --------------------------------- |
| Action | The action to apply when the caller attempts to access, query, or write data to the field. | See: [Policy Actions](#undefined) |
| Policy | The policy OIDs which the user must posses in order for the Action not to result in an error. | 2.25.0303030 |
| Property | The HDSI property path (root paths only) on the resource, where this policy applies. | |
## Policy Actions
Resources, properties and the default policy actions dictate how the privacy filtering engine will handle data whenever:
* The requesting principal lacks appropriate policy permissions to view data (when flagged), or
* The requesting principal is querying, updating, or being disclosed data from a forbidden property.
| Action | Behavior |
| ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| None | No action is taken on the resource or data element. |
| Audit | The disclosure or update is permitted to continue, however a specialized security alert audit created indicating the property was disclosed or updated. |
| Redact | - On Resources with data policies, the resource is stripped of all information (identifiers, addresses, telecoms, etc.) and data is replaced with XXXXXX
- On
AssigningAuthority resource the value of the identifier is replaced with XXXXXXX - On forbidden properties, the value of the property is replaced with
XXXXXX on disclosure. Query is not permitted, recordation is not permitted.
Note: The $pep.masked tag is appended to the resource.
|
| Nullify | Replaces the value of the property with null , if the action is applied to a resource then the status is set to Nullify and no data is disclosed.
Note: The $pep.masked tag is appended to the resource.
|
| Hide | - On Resources with data policies, the resource is removed from result sets. Direct fetching of the resource by UUID results in a
NotFound and updates result in errors. - On
AssigningAuthority resource, the identifier is removed from the object being disclosed. Updates or addition of the identity domain result in a privacy error. - On forbidden properties, the property is removed from the resource. Querying, recordation, and disclosure are forbidden.
Note: The $pep.masked tag is appended to the resource.
|
| Error | Whenever a principal attempts to read, query, or update the resource, the policy enforcement service will raise an error. |
| Hash | - On Resources with data policies, the resource has its properties replaced with the SHA256 hash of the value
- On
AssigningAuthority resource, the identifier is replaced with a hash of the identifier value. - On forbidden properties, this setting has no effect.
Note: The $pep.masked tag is appended to the resource.
|