{
  "resourceType": "CodeSystem",
  "status": "draft",
  "content": "complete",
  "name": "ResourceHiddenCS",
  "id": "resource-hidden",
  "title": "Resource Hidden Tag CodeSystem",
  "description": "The visibility tag carried on `Resource.meta.tag`. A resource tagged `true` under this system is\nwithheld from ordinary search results.\n\n**The filter is applied by the server, not by the caller.** Unless a search query names this system\nitself, the Nexus EMR FHIR gateway appends a `_tag:not` term excluding `true` before the search\nreaches the store. A client that does not know this tag exists still gets a filtered bundle, and\nnothing in the response says so. Where completeness matters -- reconciliation, export, matching an\ninbound record against what is already held -- name the system in the query rather than assuming an\nunqualified search saw everything.\n\n**`all` is a query token and not a code in this system.** A search naming `<system>|all` asks for\nhidden and visible records together. It is never stored on a resource, so a reader matching stored\ntags against it matches nothing.\n\n**Absent and `false` mean the same thing: visible.** Both forms occur in stored data -- unhiding is\nwritten in one place by removing the tag and in another by setting it to `false` -- and a reader\nmust treat them identically. Codes are written in lower case; compare case-insensitively, which is\nwhat the readers in this estate do.\n\n**At most one tag under this system.** Writers replace rather than append, and a reader should take\nthe first and not attempt to reconcile two.\n\n**This is not a confidentiality label.** It says a record is not wanted in search results, not that\nit is sensitive and not that a caller is unauthorised to see it. Confidentiality belongs on\n`meta.security`; authorization is decided by the scopes on the request. Nor is hiding a substitute\nfor `entered-in-error` or for deletion: a hidden record is a current record that a search does not\nsurface.\n\nContent is `complete` for the tag vocabulary defined here (`true`, `false`).\n\n**MIGRATION.** Nexus EMR writes this tag today under\n`http://services.well.com/fhir/tags/hidden` (FHIR-381): that address is live in stored `meta.tag`\ncodings, in code, and in the server-side search filter that reads them, and is under migration to\nthe canonical declared here. Match both addresses exactly when reading stored tags. When QUERYING,\nname the address the endpoint's own CapabilityStatement carries: this is the one artifact in this\nposition whose address a request has to name to change what comes back, so during the migration the\ntwo are not interchangeable in a query the way they are in stored data.",
  "url": "https://fhir.apps.health/CodeSystem/resource-hidden",
  "concept": [
    {
      "code": "true",
      "display": "Hidden",
      "definition": "The resource is withheld from ordinary search results. It still exists, is still readable by direct read, and is still resolvable as a reference target -- it is excluded from search only."
    },
    {
      "code": "false",
      "display": "Visible",
      "definition": "The resource is returned by ordinary search. Carries no information that an absent tag does not also carry; it exists so a writer can clear the flag in place rather than remove the coding, and a reader should treat `false` and absent as the same fact."
    }
  ],
  "experimental": false,
  "caseSensitive": true,
  "count": 2
}