<H3>Special Instructions</H3><p> <p>An XDS.a/.b Document Source or XDR Document Recipient must run this test if it supports BPPC, ie it supports the Basic Patient Privacy Enforcement option.   This is a test where the Document Source interprets/enforces a privacy policy in document it retrieves (eg a Medical Summary). <p>BPPC Document Sources must run test <b>BPPC_Source_Enforcement </b> before this test can be    run.  Document Sources have no work to do in this test, but are included as an actor in this test so that they get credit when Document Consumers process the documents they applied the consent policies to.</p> <p>A Document Consumer must run this test if you support BPPC, ie you support the Basic Patient    Privacy Enforcement option. </p> </p><H3>Description</H3><p>In this test, the Document Consumer queries for documents for two patients:</p><ul>     <li>BPPCNormal^[source_system_name]</li>     <li>BPPCRestricted^[source_system_name]</li> </ul><p>After the query, the Document Consumer should display documents to the user (if the policy    allows it).</p><p> All Affinity Domains at the Connectathon have the following two privacy policies which    patients can choose from:</p><ul>     <li>The 'Normal Policy' (Normal Sharing for Treatment) have the     confidentiality policy specified by the OID 1.3.6.1.4.1.21367.2006.7.107 </li>     <li>The 'Restricted Policy' (Sensitive Restricted Sharing) have the     confidentiality policy specified by the OID 1.3.6.1.4.1.21367.2006.7.109 </li> </ul> <p>The Document Consumer should show documents for the Normal patient and NO documents for the    patient who chose the Restricted policy.</p> <H3>Evaluation</H3> <p>The monitor should observe the Document Consumer in real time performing the query and    retrieving documents. The monitor should observe documents displayed for the Normal patient. If    any documents are displayed for the Restricted patient, that is a failure.</p> <p>The monitor may ask the Document Source to show how Privacy Consent policies are configured on    its system, and how it determines how to enforce confidentiality codes in the Affinity   Domain.</p> 