Provenance
Die Provenance beschreibt als Meta-Ressource die Herkunft einer Einwilligung. Neben Details zu den enthaltenen Unterschriften (Wer hat ggf. für Wen Wann und auf Welche Weise unterzeichnet), stellt die Provenance ebenfalls den Bezug zum Scan der Einwilligung her.
Der Provenance.Agent wird genutzt, um die verwendete Software (z.B. gICS) oder die an der Erstellung der Einwilligung beteiligten Personen und/oder Organisationen zu referenzieren.
Die Art der Unterschrift wird wie folgt angegeben. Weitere SignatureTypes sind möglich.
Art der Unterschrift | System | Code | Display |
---|---|---|---|
Unterschrift der einwilligenden Person | urn:iso-astm:E1762-95:2013 | 1.2.840.10065.1.12.1.7 | Consent Signature |
Unterschrift der (gesetzlich) vertretenden Person | urn:iso-astm:E1762-95:2013 | 1.2.840.10065.1.12.1.11 | Consent Witness Signature |
Unterschrift der aufklärenden Person | urn:iso-astm:E1762-95:2013 | 1.2.840.10065.1.12.1.5 | Verification Signature |
Provenance | I | Provenance | There are no (further) constraints on this element Element IdProvenance Who, What, When for a set of resources Alternate namesHistory, Event, Activity DefinitionProvenance of a resource is a record that describes entities and processes involved in producing and delivering or otherwise influencing that resource. Provenance provides a critical foundation for assessing authenticity, enabling trust, and allowing reproducibility. Provenance assertions are a form of contextual metadata and can themselves become important records with their own provenance. Provenance statement indicates clinical significance in terms of confidence in authenticity, reliability, and trustworthiness, integrity, and stage in lifecycle (e.g. Document Completion - has the artifact been legally authenticated), all of which may impact security, privacy, and trust policies. Some parties may be duplicated between the target resource and its provenance. For instance, the prescriber is usually (but not always) the author of the prescription resource. This resource is defined with close consideration for W3C Provenance.
| |
target | S Σ I | 1..* | Reference(Consent Management QuestionnaireResponse | Consent Management: Consent) | Element IdProvenance.target Target Reference(s) (usually version specific) DefinitionThe Reference(s) that were generated or updated by the activity described in this resource. A provenance can point to more than one target if multiple resources were created/updated by the same activity. Target references are usually version specific, but might not be, if a version has not been assigned or if the provenance information is part of the set of resources being maintained (i.e. a document). When using the RESTful API, the identity of the resource might not be known (especially not the version specific one); the client may either submit the resource first, and then the provenance, or it may submit both using a single transaction. See the notes on transaction for further discussion. Reference(Consent Management QuestionnaireResponse | Consent Management: Consent) Constraints
|
reference | S Σ I | 1..1 | string | There are no (further) constraints on this element Element IdProvenance.target.reference Literal reference, Relative, internal or absolute URL DefinitionA reference to a location at which the other resource is found. The reference may be a relative reference, in which case it is relative to the service base URL, or an absolute URL that resolves to the location where the resource is found. The reference may be version specific or not. If the reference is not to a FHIR RESTful server, then it should be assumed to be version specific. Internal fragment references (start with '#') refer to contained resources. Using absolute URLs provides a stable scalable approach suitable for a cloud/web context, while using relative/logical references provides a flexible approach suitable for use when trading across closed eco-system boundaries. Absolute URLs do not need to point to a FHIR RESTful server, though this is the preferred approach. If the URL conforms to the structure "/[type]/[id]" then it should be assumed that the reference is to a FHIR RESTful server.
|
type | Σ | 0..1 | uriBinding | There are no (further) constraints on this element Element IdProvenance.target.type Type the reference refers to (e.g. "Patient") DefinitionThe expected type of the target of the reference. If both Reference.type and Reference.reference are populated and Reference.reference is a FHIR URL, both SHALL be consistent. The type is the Canonical URL of Resource Definition that is the type this reference refers to. References are URLs that are relative to http://hl7.org/fhir/StructureDefinition/ e.g. "Patient" is a reference to http://hl7.org/fhir/StructureDefinition/Patient. Absolute URLs are only allowed for logical models (and can only be used in references in logical models, not resources). This element is used to indicate the type of the target of the reference. This may be used which ever of the other elements are populated (or not). In some cases, the type of the target may be determined by inspection of the reference (e.g. a RESTful URL) or by resolving the target of the reference; if both the type and a reference is provided, the reference SHALL resolve to a resource of the same type as that specified. Aa resource (or, for logical models, the URI of the logical model). ResourceType (extensible)Constraints
|
identifier | Σ | 0..1 | Identifier | There are no (further) constraints on this element Element IdProvenance.target.identifier Logical reference, when literal reference is not known DefinitionAn identifier for the target resource. This is used when there is no way to reference the other resource directly, either because the entity it represents is not available through a FHIR server, or because there is no way for the author of the resource to convert a known identifier to an actual location. There is no requirement that a Reference.identifier point to something that is actually exposed as a FHIR instance, but it SHALL point to a business concept that would be expected to be exposed as a FHIR instance, and that instance would need to be of a FHIR resource type allowed by the reference. When an identifier is provided in place of a reference, any system processing the reference will only be able to resolve the identifier to a reference if it understands the business context in which the identifier is used. Sometimes this is global (e.g. a national identifier) but often it is not. For this reason, none of the useful mechanisms described for working with references (e.g. chaining, includes) are possible, nor should servers be expected to be able resolve the reference. Servers may accept an identifier based reference untouched, resolve it, and/or reject it - see CapabilityStatement.rest.resource.referencePolicy. When both an identifier and a literal reference are provided, the literal reference is preferred. Applications processing the resource are allowed - but not required - to check that the identifier matches the literal reference Applications converting a logical reference to a literal reference may choose to leave the logical reference present, or remove it. Reference is intended to point to a structure that can potentially be expressed as a FHIR resource, though there is no need for it to exist as an actual FHIR resource instance - except in as much as an application wishes to actual find the target of the reference. The content referred to be the identifier must meet the logical constraints implied by any limitations on what resource types are permitted for the reference. For example, it would not be legitimate to send the identifier for a drug prescription if the type were Reference(Observation|DiagnosticReport). One of the use-cases for Reference.identifier is the situation where no FHIR representation exists (where the type is Reference (Any).
|
display | Σ | 0..1 | string | There are no (further) constraints on this element Element IdProvenance.target.display Text alternative for the resource DefinitionPlain text narrative that identifies the resource in addition to the resource reference. This is generally not the same as the Resource.text of the referenced resource. The purpose is to identify what's being referenced, not to fully describe it.
|
occurred[x] | 0..1 | There are no (further) constraints on this element Element IdProvenance.occurred[x] When the activity occurred DefinitionThe period during which the activity occurred. The period can be a little arbitrary; where possible, the time should correspond to human assessment of the activity time.
| ||
occurredPeriod | Period | There are no (further) constraints on this element Data Type | ||
occurredDateTime | dateTime | There are no (further) constraints on this element Data Type | ||
recorded | S Σ | 1..1 | instant | There are no (further) constraints on this element Element IdProvenance.recorded When the activity was recorded / updated DefinitionThe instant of time at which the activity was recorded. This can be a little different from the time stamp on the resource if there is a delay between recording the event and updating the provenance and target resource.
|
policy | 0..* | uri | There are no (further) constraints on this element Element IdProvenance.policy Policy or plan the activity was defined by DefinitionPolicy or plan the activity was defined by. Typically, a single activity may have multiple applicable policy documents, such as patient consent, guarantor funding, etc. For example: Where an OAuth token authorizes, the unique identifier from the OAuth token is placed into the policy element Where a policy engine (e.g. XACML) holds policy logic, the unique policy identifier is placed into the policy element.
| |
location | I | 0..1 | Reference(Location) | There are no (further) constraints on this element Element IdProvenance.location Where the activity occurred, if relevant DefinitionWhere the activity occurred, if relevant. References SHALL be a reference to an actual FHIR resource, and SHALL be resolveable (allowing for access control, temporary unavailability, etc.). Resolution can be either by retrieval from the URL, or, where applicable by resource type, by treating an absolute reference as a canonical URL and looking it up in a local registry/repository.
|
reason | 0..* | CodeableConceptBinding | There are no (further) constraints on this element Element IdProvenance.reason Reason the activity is occurring DefinitionThe reason that the activity was taking place. Not all terminology uses fit this general pattern. In some cases, models should not use CodeableConcept and use Coding directly and provide their own structure for managing text, codings, translations and the relationship between elements and pre- and post-coordination. The reason the activity took place. v3.PurposeOfUse (extensible)Constraints
| |
activity | 0..1 | CodeableConceptBinding | There are no (further) constraints on this element Element IdProvenance.activity Activity that occurred DefinitionAn activity is something that occurs over a period of time and acts upon or with entities; it may include consuming, processing, transforming, modifying, relocating, using, or generating entities. Not all terminology uses fit this general pattern. In some cases, models should not use CodeableConcept and use Coding directly and provide their own structure for managing text, codings, translations and the relationship between elements and pre- and post-coordination. The activity that took place. ProvenanceActivityType (extensible)Constraints
| |
agent | S | 1..* | BackboneElement | Element IdProvenance.agent Actor involved DefinitionAn dieser Stelle soll die verwendete Software dokumentiert werden. Über die Form der Dokumentation wird hier keine Aussage getroffen, d.h. auch eine freitextliche Angabe (agent.who.display) ist möglich. Optional können die an der Erstellung der Einwilligung beteiligten Personen und/oder Organisationen hier referenziert werden, sofern im konkreten Anwendungsfall die Referenzierung mittels signature.who nicht ausreicht. An agent can be a person, an organization, software, device, or other entities that may be ascribed responsibility. Several agents may be associated (i.e. has some responsibility for an activity) with an activity and vice-versa.
|
type | Σ | 0..1 | CodeableConceptBinding | There are no (further) constraints on this element Element IdProvenance.agent.type How the agent participated DefinitionThe participation the agent had with respect to the activity. For example: author, performer, enterer, attester, etc. The type of participation that a provenance agent played with respect to the activity. ProvenanceParticipantType (extensible)Constraints
|
role | 0..* | CodeableConcept | There are no (further) constraints on this element Element IdProvenance.agent.role What the agents role was DefinitionThe function of the agent with respect to the activity. The security role enabling the agent with respect to the activity. For example: doctor, nurse, clerk, etc. The role that a provenance agent played with respect to the activity. SecurityRoleType (example)Constraints
| |
who | S Σ I | 1..1 | Reference(Practitioner | PractitionerRole | RelatedPerson | Patient | Device | Organization) | There are no (further) constraints on this element Element IdProvenance.agent.who Who participated DefinitionThe individual, device or organization that participated in the event. whoIdentity should be used when the agent is not a Resource type. Reference(Practitioner | PractitionerRole | RelatedPerson | Patient | Device | Organization) Constraints
|
onBehalfOf | I | 0..1 | Reference(Practitioner | PractitionerRole | RelatedPerson | Patient | Device | Organization) | There are no (further) constraints on this element Element IdProvenance.agent.onBehalfOf Who the agent is representing DefinitionThe individual, device, or organization for whom the change was made. onBehalfOfIdentity should be used when the agent is not a Resource type. Reference(Practitioner | PractitionerRole | RelatedPerson | Patient | Device | Organization) Constraints
|
entity | S | 0..* | BackboneElement | There are no (further) constraints on this element Element IdProvenance.entity An entity used in this activity DefinitionAn entity used in this activity.
|
role | S Σ | 1..1 | codeBindingFixed Value | Element IdProvenance.entity.role derivation | revision | quotation | source | removal DefinitionHow the entity was used during the activity. Note that FHIR strings SHALL NOT exceed 1MB in size How an entity was used in an activity. ProvenanceEntityRole (required)Constraints
source
|
what | S Σ I | 1..1 | Reference(Consent Management DocumentReference) | Element IdProvenance.entity.what Identity of entity DefinitionIdentity of the Entity used. May be a logical or physical uri and maybe absolute or relative. whatIdentity should be used for entities that are not a Resource type. Reference(Consent Management DocumentReference) Constraints
|
reference | S Σ I | 1..1 | string | There are no (further) constraints on this element Element IdProvenance.entity.what.reference Literal reference, Relative, internal or absolute URL DefinitionA reference to a location at which the other resource is found. The reference may be a relative reference, in which case it is relative to the service base URL, or an absolute URL that resolves to the location where the resource is found. The reference may be version specific or not. If the reference is not to a FHIR RESTful server, then it should be assumed to be version specific. Internal fragment references (start with '#') refer to contained resources. Using absolute URLs provides a stable scalable approach suitable for a cloud/web context, while using relative/logical references provides a flexible approach suitable for use when trading across closed eco-system boundaries. Absolute URLs do not need to point to a FHIR RESTful server, though this is the preferred approach. If the URL conforms to the structure "/[type]/[id]" then it should be assumed that the reference is to a FHIR RESTful server.
|
type | Σ | 0..1 | uriBinding | There are no (further) constraints on this element Element IdProvenance.entity.what.type Type the reference refers to (e.g. "Patient") DefinitionThe expected type of the target of the reference. If both Reference.type and Reference.reference are populated and Reference.reference is a FHIR URL, both SHALL be consistent. The type is the Canonical URL of Resource Definition that is the type this reference refers to. References are URLs that are relative to http://hl7.org/fhir/StructureDefinition/ e.g. "Patient" is a reference to http://hl7.org/fhir/StructureDefinition/Patient. Absolute URLs are only allowed for logical models (and can only be used in references in logical models, not resources). This element is used to indicate the type of the target of the reference. This may be used which ever of the other elements are populated (or not). In some cases, the type of the target may be determined by inspection of the reference (e.g. a RESTful URL) or by resolving the target of the reference; if both the type and a reference is provided, the reference SHALL resolve to a resource of the same type as that specified. Aa resource (or, for logical models, the URI of the logical model). ResourceType (extensible)Constraints
|
identifier | Σ | 0..1 | Identifier | There are no (further) constraints on this element Element IdProvenance.entity.what.identifier Logical reference, when literal reference is not known DefinitionAn identifier for the target resource. This is used when there is no way to reference the other resource directly, either because the entity it represents is not available through a FHIR server, or because there is no way for the author of the resource to convert a known identifier to an actual location. There is no requirement that a Reference.identifier point to something that is actually exposed as a FHIR instance, but it SHALL point to a business concept that would be expected to be exposed as a FHIR instance, and that instance would need to be of a FHIR resource type allowed by the reference. When an identifier is provided in place of a reference, any system processing the reference will only be able to resolve the identifier to a reference if it understands the business context in which the identifier is used. Sometimes this is global (e.g. a national identifier) but often it is not. For this reason, none of the useful mechanisms described for working with references (e.g. chaining, includes) are possible, nor should servers be expected to be able resolve the reference. Servers may accept an identifier based reference untouched, resolve it, and/or reject it - see CapabilityStatement.rest.resource.referencePolicy. When both an identifier and a literal reference are provided, the literal reference is preferred. Applications processing the resource are allowed - but not required - to check that the identifier matches the literal reference Applications converting a logical reference to a literal reference may choose to leave the logical reference present, or remove it. Reference is intended to point to a structure that can potentially be expressed as a FHIR resource, though there is no need for it to exist as an actual FHIR resource instance - except in as much as an application wishes to actual find the target of the reference. The content referred to be the identifier must meet the logical constraints implied by any limitations on what resource types are permitted for the reference. For example, it would not be legitimate to send the identifier for a drug prescription if the type were Reference(Observation|DiagnosticReport). One of the use-cases for Reference.identifier is the situation where no FHIR representation exists (where the type is Reference (Any).
|
display | Σ | 0..1 | string | There are no (further) constraints on this element Element IdProvenance.entity.what.display Text alternative for the resource DefinitionPlain text narrative that identifies the resource in addition to the resource reference. This is generally not the same as the Resource.text of the referenced resource. The purpose is to identify what's being referenced, not to fully describe it.
|
agent | 0..* | see (agent) | There are no (further) constraints on this element Element IdProvenance.entity.agent Entity is attributed to this agent DefinitionThe entity is attributed to an agent to express the agent's responsibility for that entity, possibly along with other agents. This description can be understood as shorthand for saying that the agent was responsible for the activity which generated the entity. A usecase where one Provenance.entity.agent is used where the Entity that was used in the creation/updating of the Target, is not in the context of the same custodianship as the Target, and thus the meaning of Provenance.entity.agent is to say that the entity referenced is managed elsewhere and that this Agent provided access to it. This would be similar to where the Entity being referenced is managed outside FHIR, such as through HL7 v2, v3, or XDS. This might be where the Entity being referenced is managed in another FHIR resource server. Thus it explains the Provenance of that Entity's use in the context of this Provenance activity.
| |
signature | S | 0..* | Signature | There are no (further) constraints on this element Element IdProvenance.signature Signature on target DefinitionA digital signature on the target Reference(s). The signer should match a Provenance.agent. The purpose of the signature is indicated. The elements of the Signature Resource are for ease of access of these elements. For digital signatures (Xml DigSig, JWS), the non-repudiation proof comes from the Signature validation, which includes validation of the referenced objects (e.g. Resources) (a.k.a., Content) in the XML-Signature Detached form.
|
type | S Σ | 1..* | CodingBinding | Element IdProvenance.signature.type Indication of the reason the entity signed the object(s) DefinitionAn indication of the reason that the entity signed this document. This may be explicitly included as part of the signature information and can be used when determining accountability for various actions concerning the document. Examples include attesting to: authorship, correct transcription, and witness of specific event. Also known as a "Commitment Type Indication". An indication of the reason that an entity signed the object. SignatureTypeCodes (extensible)Constraints
|
system | S Σ | 1..1 | uri | There are no (further) constraints on this element Element IdProvenance.signature.type.system Identity of the terminology system DefinitionThe identification of the code system that defines the meaning of the symbol in the code. Need to be unambiguous about the source of the definition of the symbol. The URI may be an OID (urn:oid:...) or a UUID (urn:uuid:...). OIDs and UUIDs SHALL be references to the HL7 OID registry. Otherwise, the URI should come from HL7's list of FHIR defined special URIs or it should reference to some definition that establishes the system clearly and unambiguously.
|
version | Σ | 0..1 | string | There are no (further) constraints on this element Element IdProvenance.signature.type.version Version of the system - if relevant DefinitionThe version of the code system which was used when choosing this code. Note that a well-maintained code system does not need the version reported, because the meaning of codes is consistent across versions. However this cannot consistently be assured, and when the meaning is not guaranteed to be consistent, the version SHOULD be exchanged. Where the terminology does not clearly define what string should be used to identify code system versions, the recommendation is to use the date (expressed in FHIR date format) on which that version was officially published as the version date.
|
code | S Σ | 1..1 | code | There are no (further) constraints on this element Element IdProvenance.signature.type.code Symbol in syntax defined by the system DefinitionA symbol in syntax defined by the system. The symbol may be a predefined code or an expression in a syntax defined by the coding system (e.g. post-coordination). Need to refer to a particular code in the system. Note that FHIR strings SHALL NOT exceed 1MB in size
|
display | Σ | 0..1 | string | There are no (further) constraints on this element Element IdProvenance.signature.type.display Representation defined by the system DefinitionA representation of the meaning of the code in the system, following the rules of the system. Need to be able to carry a human-readable meaning of the code for readers that do not know the system. Note that FHIR strings SHALL NOT exceed 1MB in size
|
userSelected | Σ | 0..1 | boolean | There are no (further) constraints on this element Element IdProvenance.signature.type.userSelected If this coding was chosen directly by the user DefinitionIndicates that this coding was chosen by a user directly - e.g. off a pick list of available items (codes or displays). This has been identified as a clinical safety criterium - that this exact system/code pair was chosen explicitly, rather than inferred by the system based on some rules or language processing. Amongst a set of alternatives, a directly chosen code is the most appropriate starting point for new translations. There is some ambiguity about what exactly 'directly chosen' implies, and trading partner agreement may be needed to clarify the use of this element and its consequences more completely.
|
when | S Σ | 1..1 | instant | There are no (further) constraints on this element Element IdProvenance.signature.when When the signature was created DefinitionWhen the digital signature was signed. This should agree with the information in the signature.
|
who | S Σ I | 1..1 | Reference(Practitioner | PractitionerRole | RelatedPerson | Patient | Device | Organization) | There are no (further) constraints on this element Element IdProvenance.signature.who Who signed DefinitionA reference to an application-usable description of the identity that signed (e.g. the signature used their private key). This should agree with the information in the signature. Reference(Practitioner | PractitionerRole | RelatedPerson | Patient | Device | Organization) Constraints
|
onBehalfOf | S Σ I | 0..1 | Reference(Practitioner | PractitionerRole | RelatedPerson | Patient | Device | Organization) | There are no (further) constraints on this element Element IdProvenance.signature.onBehalfOf The party represented DefinitionA reference to an application-usable description of the identity that is represented by the signature. used when the signature is on behalf of a non-signer. The party that can't sign. For example a child. Reference(Practitioner | PractitionerRole | RelatedPerson | Patient | Device | Organization) Constraints
|
targetFormat | 0..1 | codeBinding | There are no (further) constraints on this element Element IdProvenance.signature.targetFormat The technical format of the signed resources DefinitionA mime type that indicates the technical format of the target resources signed by the signature. "xml", "json" and "ttl" are allowed, which describe the simple encodings described in the specification (and imply appropriate bundle support). Otherwise, mime types are legal here. The mime type of an attachment. Any valid mime type is allowed. Mime Types (required)Constraints
| |
sigFormat | 0..1 | codeBinding | There are no (further) constraints on this element Element IdProvenance.signature.sigFormat The technical format of the signature DefinitionA mime type that indicates the technical format of the signature. Important mime types are application/signature+xml for X ML DigSig, application/jose for JWS, and image/* for a graphical image of a signature, etc. Note that FHIR strings SHALL NOT exceed 1MB in size The mime type of an attachment. Any valid mime type is allowed. Mime Types (required)Constraints
| |
data | S | 0..1 | base64Binary | There are no (further) constraints on this element Element IdProvenance.signature.data The actual signature content (XML DigSig. JWS, picture, etc.) DefinitionThe base64 encoding of the Signature content. When signature is not recorded electronically this element would be empty. Where the signature type is an XML DigSig, the signed content is a FHIR Resource(s), the signature is of the XML form of the Resource(s) using XML-Signature (XMLDIG) "Detached Signature" form.
|
Beispiel
<Provenance xmlns="http://hl7.org/fhir"> <id value="4ac851a6-e0dd-4f9b-a19f-45ac0ae0bea0" /> <meta> <lastUpdated value="2021-02-08T14:21:07.5320994+00:00" /> <profile value="http://fhir.de/ConsentManagement/StructureDefinition/Provenance" /> </meta> <!-- Diese Provenance gilt für den ausgefüllten Fragebogen (QuestionnaireResponse). Sofern in der jeweiligen konkreten Implementierung keine Einwände bestehen (z.B. Datenschutz- oder anderes Recht) können auch aus dem QuestionnaireResponse abgeleitete Consent-Ressourcen hier als target referenziert werden. Dies würde bedeuten, dass alle Signaturen (signature-Elemeent) auch für diese Consent-Ressourcen gelten. --> <target> <reference value="QuestionnaireResponse/02eac854-6a2e-48f9-88d7-edd04faff81c" /> </target> <!-- Zeitpunkt der Erfassung der Provenance (bzw. hier auch der bezogenen Ressourcen) --> <recorded value="2020-12-11T09:39:07+00:00" /> <!-- Software, die zur Verarbeitung verwendet wurde --> <agent> <who> <display value="Snakeoil Soft Consent Manager 2021" /> </who> </agent> <!-- Verweis auf die originale Informationsquelle, z.B. (gescanntes) Papierdokument --> <entity> <role value="source" /> <what> <reference value="DocumentReference/237c359c-cb58-432c-a4a3-807bb28edfdb" /> </what> </entity> <!-- Unterschrift des Patienten --> <signature> <type> <system value="urn:iso-astm:E1762-95:2013" /> <code value="1.2.840.10065.1.12.1.7" /> <display value="Consent Signature" /> </type> <when value="2020-12-11T09:39:07+00:00" /> <who> <reference value="Patient/9b4a702d-162c-428a-8c5d-8b98af21b693" /> </who> <data value="iVBORw0KGgoAAAANSUhEUgAAAJYAAABZCAYCCCDcv92DAAAABGdBTUEAAKKkxq/Z1wAAACBjSFJNAACHEAAAjBIAAQW.....[base64-codiert, z.B. Scan der Unterschrift]" /> </signature> <!-- Unterschrift des aufklärenden Arztes --> <signature> <type> <system value="urn:iso-astm:E1762-95:2013" /> <code value="1.2.840.10065.1.12.1.5" /> <display value="Verification Signature" /> </type> <when value="2020-12-11T09:39:07+00:00" /> <who> <display value="Dr. F. Müller" /> </who> <onBehalfOf> <display value="Krankenhaus Musterstadt" /> </onBehalfOf> <data value="QUcgRVdFIEZISVIgcm9ja3M=" /> </signature> </Provenance>