This page is part of the FHIR Specification (v5.0.0: R5 - STU). This is the current published version in it's permanent home (it will always be available at this URL). For a full list of available versions, see the Directory of published versions . Page versions: R5R4BR4R3
This specification defines data elements, resources, formats, methods and APIs for
exchanging healthcare data between different participants in the healthcare process.
As such, Clinical Safety is a key concern with regard to the specification and its
many and various implementations.
Note to Implementers:
This page, and the concept of safety in an API specification, needs further development.
FHIR is as simple to implement as we know how to make it. However, due to the nature of
healthcare, and healthcare processes, and cultural concerns, there are a number of features in
FHIR that implementers are obliged to consider in order to implement safe systems.
This section is a checklist to help implementers be sure that they've considered all the parts
of FHIR that impact on their system design with regard to safety. Note that for this list,
safety is interpreted loosely, and the list covers security and privacy issues as well.
This safety checklist is also available as a Code System to facilitate
formal references to these checklist items. For instance, application registration processes may wish to
require applications to assert that they pass some of these checks. As an example, the formal URL for the first check
item is http://hl7.org/fhir/safety-entries#life-cycle.
7.11.2 Conformance Related Safety Checks
These basic safety checks relate to using the FHIR specification correctly.
For each resource that my system handles, my system handles the full Life cycle (status codes, currency issues, and erroneous entry status)
For each resource that my system handles, I've reviewed the Modifier elements
I've reviewed the Observation resource, and understand how focus is a mechanism for observations to be about someone or something other than the patient or subject of record.
7.11.3 Date / Timezone Related Safety Checks
Dates and timezone issues are well-known sources of confusion and safety issues in clinical applications.
My system checks for timezones and adjusts times appropriately. (note: timezones are extremely difficult to get correct - see W3C Timezone Advice , and note that some fields should be timezone corrected, and others should not be)
My system renders dates safely for changes in culture and language (the date formats D-M-Y and M-D-Y are not differentiated for many dates, and this is a well-known source of confusion. Systems should use the month name, or otherwise be specific for each date when rendering, unless
there is solid confidence that such confusion cannot arise, even in the future when information/narrative from resources will be shared much more widely)
7.11.4 Search Related Safety Checks
These basic safety checks relate to managing the search process correctly. Mismatches in expectations between
client and HTTP server (or search requester and search processor) can result in finding more resources than expected or
appropriate, or much more seriously, missing resources out in search results that were expected to be present.
My system takes care to ensure that clients can (for servers) or will (for clients) find the information they need when content that might reasonably be exposed using more than one FHIR resource. Possible patterns: Support a single search across the applicable resources, or expose data through each applicable resource. See discussion on Wiki Page for further information
My system will display warnings returned by the server to the user
My system checks whether the server processed all the requested search parameter, and is safe if servers ignore parameters (typically, either filters locally or warns the user)
My system includes appropriate default filters when searching based on patient context - e.g. filtering out entered-in-error records, filtering to only include active, living patients if appropriate, and clearly documents these
(preferably including them in the self-link for a search)
When clients have limited access to data for permission reasons (e.g. the data they receive might be SUBSETTED), my system handles update or create requests tagged in such a way by either rejecting them, or accepting them after carefully considering how to avoid accidental loss of data the updating client did not have access to, and taking into account the possibility that a client update might invalidate data the client was unaware of.
7.11.5 Deletion Safety Checks
Deleting records and/or marking records as no longer valid is a well known
source of safety issues in all applications. This specification allows for
resources to be deleted, but does not require systems to behave in any
particular fashion.
For each resource, I have checked whether resources can be deleted, and/or how records are marked as incorrect/no longer relevant
Deletion of records (or equivalent updates in status) flow through the system so any replicated copies are deleted/updated
(If a server) my documentation about deleted resources is clear, and my test sandbox (if exists) has deleted/error record cases in the test data
7.11.6 Privacy Related Safety Checks
FHIR defines a set of capabilities to support data exchange. Not all the capabilities that FHIR enables may be appropriate or
legal for use in some combinations of context and jurisdiction (e.g. HIPAA for exchange between institutions). It is the
responsibility of implementers to ensure that relevant regulations and other requirements are met.
My system checks that the right Patient consent has been granted (where applicable)
My system sends an Accounting of Disclosure to the consenter as requested when permitted actions on resources are performed using an AuditEvent Resource
7.11.7 Security Related Safety Checks
Basic Context:
My system ensures that system clocks are synchronized using a protocol like NTP or SNTP, and my server is robust against clients that have the wrong clock set
My system uses security methods for an API to authenticate where Domain Name System (DNS) responses are coming from and ensure that they are valid
Communications:
Production exchange of patient or other sensitive data will always use some form of encryption on the wire
Where resources are exchanged using HTTP, TLS should be utilized to protect the communications channel
Where resources are exchanged using email, S/MIME should be used to protect the end-to-end communication
My system uses OpenID Connect (or other suitable authentication protocol) to verify identity of end user, where it is necessary that end-users be identified to the client application, and has a clear policy on identity proofing
Access Control:
My system applies appropriate access control to every request, using a combination of requester’s clearance (ABAC) and/or roles (RBAC)
My system considers security labels on the affected resources when making access control decisions
7.11.8 Narrative / Presentation Related Safety Checks
When creating resources, careful consideration has been given for when the system should generate resource narrative to serve as a safe failback for other systems that do not recognized all elements and extensions in them (either because of lack of community agreement or because of non-simultaneous evolution of discrete data interfaces among community participants))
When generating narrative, careful consideration has been given to the human readability of the narrative, trying to appropriately highlight 'important' information to make it likely that human readers unfamiliar with the narrative organization will still find such information
When consuming resources, my system checks the Narrative.status element to inform whether the narrative should be made available in the user interface
With regard to #38, Systems SHOULD check the narrative status. Specifically, if the status is 'additional', then narrative SHOULD always be available for human consumption, if 'extensions' and the system does not render all human-relevant received extensions the narrative SHOULD be available and if 'generated' and the system does not render all human-relevant received core elements, the narrative SHOULD be available.
7.11.9 Integrity Related Safety Checks
My system validates all input received (whether in resource format or other) from other actors so that it data is well-formed and does not contain content that would cause unwanted system behavior
My system allows providers to confirm validity of source data before using it in risk models or other decision support tools.
My system allows providers to exercise appropriate clinical judgement as part of accepting or rejecting guidance received from clinical decision support tools.
My system ensures that the minimum necessary information is provided to decision support tools.
My system ensures that integrations with decision support and other related services communicate using appropriate authenticated channels and that only authorized information is sent via those channels.
My system ensures that data exchanged with decision support and other related services respects the appropriate use of information, including patient privacy and consent considerations.
7.11.11 Other Safety Checks
Obviously, this list is only a small part of the overall safety checklist for an application, which will have checks regarding jurisdictionally mandated policies, internal integrity, etc.
In addition, server developers should check these specific additional checks for client convenience:
Server: CORS (cross-origin resource sharing ) is appropriately enabled (many clients are Javascript apps running in a browser)
JSON is supported (many clients are Javascript apps running in a browser; XML is inconvenient at best)
JSON is returned correctly when errors happen (clients often don't handle HTML errors well)
The _format header is supported correctly
Errors are trapped and an OperationOutcome returned