Secondary Use FHIR Server Implementation Guide - Local Development build (v0.1.0) built by the FHIR (HL7® FHIR® Standard) Build Tools. See the Directory of published versions

Privacy

Privacy

Mandatory Pseudonymization

Every adapter export applies the same server policy. There is no privacy-mode query parameter.

The policy:

• replaces Patient ids with stable salted pseudonyms;
• recursively rewrites populated FHIR Reference elements that resolve to source Patients and removes source Reference.identifier and Reference.display from rewritten references;
• removes identifier, name, telecom, address, contact, photo, narrative text, generalPractitioner, and managingOrganization from Patient;
• shifts selected dates by a deterministic patient-specific offset from -15 through +15 days.

The transformation preserves time-of-day while shifting the calendar date where supported.

Cohort and _typeFilter selection use source values before this transformation. A shifted date in the exported resource may therefore fall outside the source-date criterion that selected it.

Optional Minimization

Callers request a smaller analytical representation with standard Bulk Data _elements. The UI offers two choices:

• Pseudonymized: omit _elements.
• Minimized: send the documented analytical root-element allowlist through _elements.

Minimization therefore happens after mandatory pseudonymization and never weakens the server privacy boundary. It retains implicitRules, root modifierExtension, resource-specific status and modifier fields, and mandatory elements, including medicationReference when that choice supplies the required medication value. Partial resources carry the standard SUBSETTED tag.

Scope

This deterministic local prototype is not a certified anonymization mechanism. It does not implement consent evaluation, user authorization, formal disclosure-risk scoring, k-anonymity, differential privacy, or legal certification.

The rewriting policy does not cover foreign absolute Patient URLs, logical references, contained-resource content, or Patient identifiers present only in free text. Ordinary adapter searches are also outside the export transformation and return untransformed synthetic source resources.