Record Severed Extension

Canonical	../StructureDefinition/nexus-record-severed
Status	draft (experimental) · 1.26.0
Base	Extension (constraint)
Context	Resource (element)
Source	FSH · JSON

Marks a record as SEVERED: retained and traceable, but removed from ordinary clinical view because it was found to be incorrect.

FSH

The authored source of truth: extensions/RecordCorrectionExtensions.fsh (edit on GitHub). One FSH file may define several related artifacts.

// RecordCorrectionExtensions.fsh
// Two extensions that make a correction visible ON the record, rather than only in its history.
//
// WHAT R4 ALREADY DOES, SO THAT THESE DO NOT DUPLICATE IT. Most resource types can already say
// that their content was wrong: `Observation.status` has `corrected` and `entered-in-error`,
// `Condition.verificationStatus` and `AllergyIntolerance.verificationStatus` have
// `entered-in-error`, `DocumentReference` has `status`, `docStatus` and a `relatesTo` of
// `replaces`. Version history retains what the record used to say, and Provenance records who
// changed it and why. None of that is re-modelled here.
//
// WHAT IS MISSING, AND IT IS TWO SPECIFIC THINGS.
//
// FIRST, THERE IS NO PORTABLE POINTER FROM A WRONG RECORD TO ITS REPLACEMENT. DocumentReference
// has `relatesTo`; Observation, Condition, AllergyIntolerance and Patient have nothing equivalent
// in R4. So an EMR can mark an observation `entered-in-error` and store the corrected one, and a
// reader holding the wrong one has no way to reach the right one. The tender requires "maintaining
// a link in the record for traceability, and notifying users where information is incorrect to
// direct them to corrected information" -- direct them to it, which needs an address.
//
// SECOND, SEVERING HAS NO REPRESENTATION AT ALL. The tender requires incorrect information to be
// "severed" and "stored separately" while remaining traceable. That is neither deletion nor an
// error status: the content stays retrievable to those entitled to it, and disappears from
// ordinary clinical view. A status code cannot express it because status is about the content's
// truth, and severing is about who may see it.
//
// WHY AN EXTENSION AND NOT A LOCAL STATUS CODE. A status code would have to be added to every
// resource type's own required-bound status element, which is not something a guide can do, and
// would mean a reader had to learn one rule per resource type. An extension is read the same way
// wherever it appears.

// ===========================================================================
// Corrected by -- where the right information now lives
// ===========================================================================

Extension: NexusCorrectedByExtension
Id:        nexus-corrected-by
Title:     "Corrected By Extension"
Description: """
Points from a record known to be incorrect to the record that carries the corrected information.

Answers the question a reader holding a wrong record cannot otherwise answer: where is the right
one? R4 gives DocumentReference a `relatesTo` for this and gives most other resource types
nothing, so this extension is how the link is carried uniformly.

Does not say the record is wrong -- the resource's own status element does that -- and does not
replace version history, which remains the record of what changed and when.
"""
* ^url = "../StructureDefinition/nexus-corrected-by"
* ^status = #draft
* ^experimental = true
* ^context[0].type = #element
* ^context[0].expression = "Resource"

* value[x] only Reference(Resource)
* value[x] 1..1
* value[x] ^short = "The resource carrying the corrected information"
* value[x] ^definition = """
A reference to the resource that supersedes this one.

**Points forward, from wrong to right.** The direction is the opposite of DocumentReference's
`relatesTo`/`replaces`, which points from the new record back to the old one. Both directions are
useful and this one is chosen because the reader who needs help is the one holding the stale
record: they have it in hand and need somewhere to go. A reader holding the correction usually
already knows what it replaced.

Usually within one resource type, but not required to be: a wrongly recorded observation may be
corrected by a differently typed resource where the original entry was the wrong kind of record
altogether.
"""

// ===========================================================================
// Severed -- retained, traceable, out of ordinary view
// ===========================================================================

Extension: NexusRecordSeveredExtension
Id:        nexus-record-severed
Title:     "Record Severed Extension"
Description: """
Marks a record as SEVERED: retained and traceable, but removed from ordinary clinical view
because it was found to be incorrect.

Severing is what a custodian does when incorrect information cannot simply be overwritten -- it
must remain retrievable, because a correction has to be auditable, while ceasing to be presented
as though it were part of the patient's clinical picture.

**Distinct from deletion, and from an error status.** A deleted record cannot be audited. A record
marked `entered-in-error` is still returned by ordinary reads and is still rendered by clients
that do not check status. Severing is an instruction about VISIBILITY, and it is carried
separately for exactly that reason.
"""
* ^url = "../StructureDefinition/nexus-record-severed"
* ^status = #draft
* ^experimental = true
* ^context[0].type = #element
* ^context[0].expression = "Resource"

* extension contains
    severedDate 1..1 MS and
    reason 0..1 MS and
    retainedFor 0..1 MS

* extension[severedDate].value[x] only dateTime
* extension[severedDate].value[x] 1..1
* extension[severedDate] ^short = "When the record was severed"

* extension[reason].value[x] only string
* extension[reason].value[x] 1..1
* extension[reason] ^short = "Why, in the words a reader needs"
* extension[reason] ^definition = "Free text. Uncoded deliberately: the reason a specific entry was found incorrect is particular to that entry, and a code set would either be uselessly generic or would grow without bound."

* extension[retainedFor].value[x] only string
* extension[retainedFor].value[x] 1..1
* extension[retainedFor] ^short = "The basis on which the severed content is still kept"
* extension[retainedFor] ^definition = """
Why this content is retained despite being wrong -- the retention obligation, the open complaint,
the correction audit it supports.

Present because a severed record raises the obvious question of why it is still here, and the
answer has to be on the record rather than in somebody's memory. It is also what tells a later
retention sweep whether the content may now go.
"""

// `value[x]` needs no explicit 0..0 here: defining sub-extensions makes this a complex extension,
// and SUSHI applies the mutual exclusion between `extension` and `value[x]` itself.