---
title: SAIF.Business.Claim.MedicalBill security and authorization
summary: Authorization and confidentiality controls for SAIF.Business.Claim.MedicalBill.
status: draft
owner: SAIF Doc Gen
last_reviewed: 2026-07-28
library: SAIF.Business.Claim.MedicalBill
reference_type: package
---

# SAIF.Business.Claim.MedicalBill security and authorization

This page documents the authorization and claim-confidentiality behavior implemented by `SAIF.Business.Claim.MedicalBill`. Authentication is supplied by the broader SAIF infrastructure.

## Authorization architecture

The library uses claim-security state and cached `clsSecurityPrincipal.IsAuthorized(...)` checks to decide whether certain medical-bill views can be exposed, and it applies worker-name masking when confidentiality flags are present.

```mermaid

flowchart TD

    Caller[Calling code] --> Collection[clsMedicalBillCollection]

    Collection --> Principal[clsSecurityPrincipal]

    Collection --> Bill[clsMedicalBill]

    Bill --> Masking[Worker-name confidentiality masking]

```

## AD resource catalog

| Resource name | Purpose | Enforcement point | Source |
| --- | --- | --- | --- |
| ``ExposureClaim`` | Cached authorization lookup for exposure-claim access | ``clsMedicalBillCollection.HasExposureAccess`` | ``Business\SAIF.Business.Claim.MedicalBill\clsMedicalBillCollection.vb`` |
| ``CollateralHealthClaim`` | Cached authorization lookup for collateral-health access | ``clsMedicalBillCollection.HasHealthIssueAccess`` | ``Business\SAIF.Business.Claim.MedicalBill\clsMedicalBillCollection.vb`` |

## Authorization enforcement points

### Programmatic authorization checks

| Class | Method | Resource / Role | Check type | Source |
| --- | --- | --- | --- | --- |
| `clsMedicalBillCollection` | `HasExposureAccess` | `ExposureClaim` | Cached `clsSecurityPrincipal.IsAuthorized(...)` check | `Business\SAIF.Business.Claim.MedicalBill\clsMedicalBillCollection.vb` |
| `clsMedicalBillCollection` | `HasHealthIssueAccess` | `CollateralHealthClaim` | Cached `clsSecurityPrincipal.IsAuthorized(...)` check | `Business\SAIF.Business.Claim.MedicalBill\clsMedicalBillCollection.vb` |

## Data-level authorization

| Entity type | Validation method | Mechanism | Source |
| --- | --- | --- | --- |
| Claim worker identity | ``clsMedicalBill.WorkerName`` | Masks the worker name as `** Confidential **` when the caller is internal or flagged as a SAIF employee and `clsClaimSecurity` reports `IsWorkerConflict` | ``Business\SAIF.Business.Claim.MedicalBill\clsMedicalBill.vb`` |
| Caller classification | ``clsMedicalBillCollection.IsSAIFEmployee` + `AfterRetrieve`` | Derives caller type from `SecurityPrincipal.Domain = "SAIF"` and propagates that flag to each `clsMedicalBill` so the worker-name masking rule can execute | ``Business\SAIF.Business.Claim.MedicalBill\clsMedicalBillCollection.vb`` |

## Security interfaces and contracts

| Interface / Class | Role | Consumers | Source |
| --- | --- | --- | --- |
| `clsSecurityPrincipal` | Provides authorization checks for cached exposure and collateral-health access helpers. | `clsMedicalBillCollection` | `Business\SAIF.Business.Claim.MedicalBill\clsMedicalBillCollection.vb` |
| `clsClaimSecurity` | Provides claim-level worker-conflict state used for worker-name masking. | `clsMedicalBill` | `Business\SAIF.Business.Claim.MedicalBill\clsMedicalBill.vb` |

## Notes

- AD resource names are documented without environment-specific suffixes.
- Worker-name masking is claim scoped and source backed by the listed medical-bill files.

## Related documentation

- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Database tables](database-tables.md)
- [SQL catalog](sql/index.md)
- [Procedures](procedures/index.md)
- [API reference](api/index.md)

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified.

## Sources

- `Business\SAIF.Business.Claim.MedicalBill\clsMedicalBillCollection.vb`
- `Business\SAIF.Business.Claim.MedicalBill\clsMedicalBill.vb`
- `Business\SAIF.Business.Claim.MedicalBill\clsBillSearchCriteria.vb`
- `Business\SAIF.Business.Claim.MedicalBill\clsAdjustmentCode.vb`
- `Business\SAIF.Business.Claim.MedicalBill\clsAdjustmentCodeCollection.vb`
- `Business\SAIF.Business.Claim.MedicalBill\clsAuditServiceCollection.vb`
- `Business\SAIF.Business.Claim.MedicalBill\clsEOBNoteCollection.vb`
- `Business\SAIF.Business.Claim.MedicalBill\clsNationalDrug.vb`
- `Business\SAIF.Business.Claim.MedicalBill\clsNationalDrugPrice.vb`
- `Business\SAIF.Business.Claim.MedicalBill\clsNationalDrugPriceCollection.vb`
- `Business\SAIF.Business.Claim.MedicalBill\clsNdcPriceHistory.vb`
- `Business\SAIF.Business.Claim.MedicalBill\clsNdcPriceHistoryCollection.vb`
- `Business\SAIF.Business.Claim.MedicalBill\clsServiceAdjustmentCollection.vb`