Operation-patient-everything

This operation is used to return all the information related to one or mores patient described in the resource or context on which this operation is invoked. The response is a bundle of type "searchset". At a minimum, the patient resource(s) itself is returned, along with any other resources that the server has that are related to the patient(s), and that are available for the given user. The server also returns whatever resources are needed to support the records - e.g. linked practitioners, medications, locations, organizations etc. The intended use for this operation is to provide a patient with access to their entire record (e.g. "Blue Button"), or for bulk data download. The server SHOULD return at least all resources that it has that are in the patient compartment for the identified patient(s), and any resource referenced from those, including binaries and attachments. In the US Realm, at a mimimum, the resources returned SHALL include all the data covered by the meaningful use common data elements as defined in DAF. Other applicable implementation guides may make additional rules about how much information that is returned

The key differences between this operation and simply searching the patient compartment are:

• unless the client requests otherwise, the server returns the entire result set in a single bundle (rather than using paging)
• the server is responsible for determining what resources to return as included resources (rather than the client specifying which ones). This frees the client from needing to determine what it could or should ask for

It is assumed that the server has identified and secured the context appropriately, and can either associate the authorization context with a single patient, or determine whether the context has the rights to the nominated patient, if there is one, or can determine an appropriate list of patients to provide data for from the context of the request. If there is no nominated patient (e.g. the operation is invoked at the system level) and the context is not associated with a single patient record, then the server may choose to return an error. Specifying the relationship between the context, a user and patient records is outside the scope of this specification.

When this operation is used to access multiple patient records at once (GET /Patient/$everything), the actual list of patients is all patients that the user associated with the request has access to. This may be all patients in the family that the patient has access to, or it may be all patients that a care provider has access to. In the second case, this could be a lot of patient; servers may choose to require that the such requests are made asynchronously, and associated with bulk data formats.