Nexus EMR profile for Subscription (R4 criteria-based) -- server-side push notification registration managed by the subscription manager service. Infrastructure and a data-egress security surface: no effective date, and R4 gives it no identifier element. First pass; note the R5 redesign migration path.
Elements / Details
Every element this profile touches, with its full definition. Element names in the tables link here.
A standing request to be notified when resources matching a search expression change, and the
channel those notifications are delivered on.
Carries no clinical content. Defines an ongoing egress path for record content, so its criteria
and channel are a security concern as much as a routing one.
The metadata about the resource. This is content that is maintained by the infrastructure. Changes to the content might not always be associated with version changes to the resource.
May be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension.
Comments
There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
The version specific identifier, as it appears in the version portion of the URL. This value changes when the resource is created, updated, or deleted.
Comments
The server assigns this value, and ignores what the client specifies, except in the case that the server is imposing version integrity on updates/deletes.
When the resource last changed - e.g. when the version changed.
Comments
This value is always populated except when the resource is first being created. The server / resource manager sets this value; what a client provides is irrelevant. This is equivalent to the HTTP Last-Modified and SHOULD have the same value on a read interaction.
Identifies EMR instance & pipeline version the resource came from
Definition
A URI that identifies the EMR pipeline and version from which this resource originated. This tells you which EMR instance (recommend using the instance identifier), and the version of the pipeline code/transformations.
Comments
In the provenance resource, this corresponds to Provenance.entity.what[x]. The exact use of the source (and the implied Provenance.entity.role) is left to implementer discretion. Only one nominated source is allowed; for additional provenance details, a full Provenance resource should be used.
This element can be used to indicate where the current master source of a resource that has a canonical URL if the resource is no longer hosted at the canonical URL.
It is up to the server and/or other infrastructure of policy to determine whether/how these claims are verified and/or updated over time. The list of profile URLs is a set.
Security labels applied to this resource. These tags connect specific resources to the overall security policy and infrastructure.
Comments
The security labels can be updated without changing the stated version of the resource. The list of security labels is a set. Uniqueness is based the system/code, and version and display are ignored.
Tags applied to this resource. Tags are intended to be used to identify and relate resources to process and workflow, and applications are not required to consider the tags when interpreting the meaning of a resource.
Comments
The tags can be updated without changing the stated version of the resource. The list of tags is a set. Uniqueness is based the system/code, and version and display are ignored.
A set of rules under which this content was created
Definition
A reference to a set of rules that were followed when the resource was constructed, and which must be understood when processing the content. Often, this is a reference to an implementation guide that defines the special rules along with other profiles etc.
Comments
Asserting this rule set restricts the content to be only understood by a limited set of trading partners. This inherently limits the usefulness of the data in the long term. However, the existing health eco-system is highly fractured, and not yet ready to define, collect, and exchange data in a generally computable sense. Wherever possible, implementers and/or specification writers should avoid using this element. Often, when used, the URL is a reference to an implementation guide that defines these special rules as part of it's narrative along with other profiles, value sets, etc.
Cardinality
0..1
Type
uri
Modifier
yes — This element is labeled as a modifier because the implicit rules may provide additional knowledge about the resource that modifies it's meaning or interpretation
The base language in which the resource is written.
Comments
Language is provided to support indexing and accessibility (typically, services such as text to speech use the language tag). The html language tag in the narrative applies to the narrative. The language tag on the resource may be used to specify the language of other presentations generated from the data in the resource. Not all the content has to be in the base language. The Resource.language should not be assumed to apply to the narrative automatically. If a language is specified, it should it also be specified on the div element in the html (see rules in HTML5 for information about the relationship between xml:lang and the html lang attribute).
A human-readable narrative summary of the NexusEmrCoreSubscription resource for human interpretation.
Comments
Contained resources do not have narrative. Resources that are not contained SHOULD have a narrative. In some cases, a resource may only have text with little or no additional discrete data (as long as all minOccurs=1 elements are satisfied). This may be necessary for data from legacy systems where information is captured as a "text blob" or where text is additionally entered raw or narrated and encoded information is added later.
These resources do not have an independent existence apart from the resource that contains them - they cannot be identified independently, and nor can they have their own independent transaction scope.
Comments
This should never be done when the content can be identified properly, as once identification is lost, it is extremely difficult (and context dependent) to restore it again. Contained resources may have profiles and tags In their meta elements, but SHALL NOT have security labels.
May be used to represent additional information that is not part of the basic definition of the resource. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension.
Comments
There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
May be used to represent additional information that is not part of the basic definition of the resource and that modifies the understanding of the element that contains it and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer is allowed to define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions.
Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself).
Requirements
Modifier extensions allow for extensions that cannot be safely ignored to be clearly distinguished from the vast majority of extensions which can be safely ignored. This promotes interoperability by eliminating the need for implementers to prohibit the presence of extensions. For further information, see the definition of modifier extensions.
Comments
There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
Cardinality
0..*
Type
Extension
Modifier
yes — Modifier extensions are expected to modify the meaning or interpretation of the resource that contains them
The status of the subscription, which marks the server state for managing the subscription.
Comments
error and off both mean notifications are NOT being delivered, and the server sets them itself (e.g. after repeated delivery failure). A manager service that created a subscription and assumes it is still live will miss events silently -- this element must be polled or watched, not set-and-forgotten.
Cardinality
1..1
Type
code
Must Support
yes
Modifier
yes — This element is labelled as a modifier because it is a status element that contains status entered-in-error which means that the resource should not be treated as valid
The time for the server to turn the subscription off.
Comments
An expiry, NOT an effective date -- see the NoEffectiveDate declaration above. SHOULD be set: an open-ended subscription is a permanent egress path that outlives the reason it was created.
A description of why this subscription is defined.
Comments
Free text, required by R4, and worth taking seriously rather than filling with a placeholder: it is the only human-readable record of why an egress path was opened, and the first thing an audit asks.
The search expression selecting resources to notify on
Definition
An R4 search expression (e.g. Observation?patient=123) selecting the resources whose changes
trigger a notification.
⚠ This is a security boundary, not just a filter. A broad criteria string (a resource type with no
patient or category scoping) subscribes to the whole population of that type.
Comments
⚠ NOT ENFORCED HERE, and not declared by this guide either. criteria remains 1..1 with no type or parameter invariant, so a criteria posted directly to a server is checked by whatever that server chooses to check. A criteria naming a parameter the server does not support may match nothing and fire never -- silently, and indistinguishably from a period in which nothing happened. That is the failure mode to design against when accepting a subscription from an untrusted writer: validate the string against the search surface the receiving server actually declares, rather than assuming it will be rejected. This API does not offer the Subscription type to applications; see the Subscriptions page in the guide for the criteria vocabulary a future surface would use and the limits that would apply to it.
May be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension.
Comments
There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
Extensions that cannot be ignored even if unrecognized
Definition
May be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions.
Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself).
Requirements
Modifier extensions allow for extensions that cannot be safely ignored to be clearly distinguished from the vast majority of extensions which can be safely ignored. This promotes interoperability by eliminating the need for implementers to prohibit the presence of extensions. For further information, see the definition of modifier extensions.
Comments
There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
Cardinality
0..*
Type
Extension
Modifier
yes — Modifier extensions are expected to modify the meaning or interpretation of the element that contains them
The url that describes the actual end-point to send messages to.
Comments
⚠ Required in practice for every channel type except websocket. This is the egress destination -- review it, not just the criteria, when auditing what leaves the system.
MIME type of the notification body; absent means id-only notification
Definition
The mime type to send the payload in - either application/fhir+xml, or application/fhir+json. If the payload is not present, then there is no payload in the notification, just a notification. The mime type "text/plain" may also be used for Email and SMS subscriptions.
Comments
⚠ Load-bearing security semantics that read as a formatting detail. When ABSENT, the notification carries no resource content and the receiver must fetch (and be authorized to fetch) the resource itself. When PRESENT, record content is pushed to channel.endpoint directly. Prefer absent -- id-only notification keeps authorization at the read, where it can be enforced.
Headers sent with the notification (e.g. authorization)
Definition
Additional headers / information to send as part of the notification.
Comments
⚠ Secrets belong nowhere near a queryable resource. If a bearer token is placed here it is readable by anyone who can read the Subscription; scope read access accordingly, or use a channel that does not require an inline credential.