Fine-grained Patient access

[PaulOrtegaCHU]

REST API scopes allow us to grant CRUD rights to resource consumers.
However, we cannot provide detailed access to a specific pool of resources or to only certain elements within the allowed resources.

As a hospital, we share a lot of patient data but would like to limit our data sharing to only the required resources and share only the necessary elements within those resources.

For example, if a data collector needs access to patients from cardiology and only requires their name and telecom information, there is no reason to share other patients' data, nor should we disclose the allowed patients' addresses or marital status.