The Silicon Valley approach to app development is “move fast and break things.”
This is NOT a good approach when your data is stored in a FHIR server.
It’s tempting to focus on a feature list that looks impressive during demos, but there’s a hard reality when it comes to healthcare projects and healthcare data.
Legal and regulatory requirements impact much of what needs to be done. FHIR is no exception.
Move as fast as you want to, but here are 5 things your app MUST handle correctly on release day.
- Document the Source of the Data
Who is creating or updating FHIR resources? This will often be stored in a Provenance resource sent with the update Bundle. If data comes into your FHIR server without a Provenance or other source, you should consider rejecting it. - Handle Security Labels
These labels sit inside a resource’s Meta element and connect a resource to a specific security policy or framework. Not being aware of and correctly handling security labels can cause legal or regulatory problems. - Handle Modifier Extensions
A modifier extension changes the meaning of a resource or element. Ignoring them or not handling them correctly can be dangerous and can in some cases have legal repercussions. - Have a Data Retention Policy
When your app gathers data it should be for a specific use case. Your app and your FHIR server are only allowed to store that data until the use case is fulfilled. This may be a lifetime in the case of a GP’s surgery; it may be a few days or weeks in the case of a vaccination center. Storing data beyond the time required for its particular use case can lead to legal and regulatory problems — especially in Europe. - Keep an Audit Trail
Who did what, and when? Storing a comprehensive audit for who accessed patient data is a requirement. This may be FHIR’s AuditEvent resource or it may be a custom audit database. But it needs to be there.
These are not “nice to haves.” They are not features you can put in the backlog and get to in version 2. They need to be built into your app as part of its first release.
No exceptions.
---