Secondary Use FHIR Server Implementation Guide - Local Development build (v0.1.0) built by the FHIR (HL7® FHIR® Standard) Build Tools. See the Directory of published versions

Privacy

Privacy

Mandatory Pseudonymization

Every adapter export applies the same server policy. There is no privacy-mode query parameter.

The policy:

• replaces Patient ids with stable salted pseudonyms;
• rewrites Patient references consistently;
• removes identifier, name, telecom, address, contact, photo, generalPractitioner, and managingOrganization from Patient;
• shifts selected dates by a deterministic patient-specific offset from -15 through +15 days.

The transformation preserves time-of-day while shifting the calendar date where supported.

Optional Minimization

Callers request a smaller analytical representation with standard Bulk Data _elements. The UI offers two choices:

• Pseudonymized: omit _elements.
• Minimized: send the documented analytical root-element allowlist through _elements.

Minimization therefore happens after mandatory pseudonymization and never weakens the server privacy boundary. Partial resources carry the standard SUBSETTED tag.

Scope

This is a deterministic local prototype, not a certified anonymization mechanism. It does not implement consent evaluation, user authorization, formal disclosure-risk scoring, k-anonymity, differential privacy, or legal certification.