Secondary Use FHIR Server Implementation Guide
0.1.0 - ci-build

Secondary Use FHIR Server Implementation Guide - Local Development build (v0.1.0) built by the FHIR (HL7® FHIR® Standard) Build Tools. See the Directory of published versions

Prototype Limits

These limits describe the default synthetic demo. External-source hospital mode has a separate conservative privacy policy, persistent cohorts, bounded background exports and opt-out checks; see docs/HOSPITAL.md in the repository. Neither mode claims certified anonymisation or complete hospital/profile conformance.

Limits

This prototype intentionally implements a focused subset.

FHIR and Bulk Data Scope

  • FHIR search supports the documented resource parameters and eq/ne/gt/lt/ge/le/sa/eb date comparisons, not the complete FHIR search language. The cross-resource date convenience alias is not uniformly a standard R4 search parameter and is retained for compatibility; native parameter names should be used. Approximate (ap) dates are rejected.
  • Patient _has support is limited to the documented patient-compartment resource/reference/search combinations.
  • The Bulk Cohort API is an experimental draft. Requests declare the canonical http://hl7.org/fhir/uv/bulkdata/StructureDefinition/bulk-cohort-group profile, but the prototype does not claim full Bulk Data IG conformance.
  • _typeFilter supports the documented ordinary searches and is not a general cross-resource query language. Search result controls such as _summary and _elements are rejected.
  • _elements supports root elements only; mandatory and modifier fields are retained.
  • Optional Bulk Data features not implemented by this server are rejected rather than silently ignored.
  • HAPI serializes and parses R4 resources, but no general FHIR or profile validator is wired. The guide describes the implemented contract rather than claiming full HL7 conformance.

State and Upstream Execution

  • Startup validates all command-line options before binding either service. If the second service cannot start, the first is stopped; normal shutdown stops both.
  • Groups and Group-create status are in memory, disappear on restart, and are not a production cohort registry. Bulk job manifests and resources persist separately on disk.
  • Group activation runs in the background. Direct Group reads expose actual and members-refreshed; the legacy explicit async contract reports an operation-result Bundle. Demo exports compute during kickoff; external exports retrieve and transform resources in a bounded background worker after 202.
  • Upstream paging is restricted to the configured FHIR base and does not follow redirects. Source failures, malformed search Bundles, invalid next links, and paging loops fail the adapter operation.

Privacy and Production Use

  • The mock server is synthetic and is not suitable for clinical use.
  • Pseudonymization and minimization are demonstration controls, not a complete governance or authorization solution.
  • Ordinary adapter searches expose untransformed source resources; privacy controls apply to adapter Bulk exports only.
  • Recursive privacy rewriting covers populated FHIR Reference elements that identify source Patients. Foreign absolute URLs, logical references, contained-resource content, and identifiers present only in free text remain outside the policy.