You are required to if you’re handling FHIR data. They are not something you can ignore or plead ignorance of.
Security Labels are part of the Meta element of every FHIR resource. They are tags that “connect resources in specific ways to the overall security policy and infrastructure.”
Labels tend to fall into one of three categories.
– Purpose of Use
From ‘clinical trial’ to ‘coordination of care’
If a resource is labelled as ‘clinical trial’ data, you should not be handling it as if it were regular data.
– Confidentiality Codes
From ‘unrestricted’ to ‘very restricted’
A ‘very restricted’ label might signify a VIP patient, or sensitive psychiatric data that should not be shared without explicit permission.
– Control of Flow
From ‘Delete After Use’ to ‘Test Data’
If it comes with a ‘Delete After Use’ label, you shouldn’t store it — not even inside an audit trail.
The above examples illustrate the diverse nature of what can be contained in a Security Label, and hint at the dangers to your app and to patients if you handle them incorrectly.
More: http://hl7.org/fhir/R4/security-labels.html
ValueSet: http://hl7.org/fhir/R4/valueset-security-labels.html
Again: You are required to understand Security Labels.
Don’t take my word for it: https://youtu.be/U2za4fGRwq8?t=1797
---
Sign up to “The Tuesday FHIR Sessions” and receive an email every Tuesday where I go deep on a single FHIR topic.