Skip to content

Statements of Disagreement

Introduction

Where a custodian refuses to correct a record, PHIPA entitles the individual to require that a statement of disagreement be attached to it. The requirement has a second half that is easy to miss and hard to implement: the custodian must ensure the statement is included wherever that information is shared, and must notify people the information was already disclosed to.

The statement is a Statement of Disagreement — a Communication carrying the individual's own words.

This obligation does not end

Every other message in this estate is finished when it has been delivered. This one is finished when the record it disputes stops being disclosed, which is to say never.

Closing the correction task does not end it. The task reaches disagreement-logged and later completed; both describe the clinic's workflow. An implementation that stops carrying the statement once its task closed has broken the requirement at exactly the moment it looked finished.

The associations, and why there are two of them

about names the disputed records. Carry the content twice:

Reference form What it is for
Observation/x/_history/3 Pins the exact content the individual disputed. What an auditor needs
Observation/x What a current-state export actually reads

A version-pinned reference alone will not cause today's chart export to include the statement — a consumer assembling the current record never looks at that version. A statement associated only with a superseded version silently stops being disclosed the moment the record is edited for any unrelated reason.

partOf carries the refused correction task. That is the audit trail — who decided, when, on what stated reason — and it is deliberately not where a release path looks, because the obligation attaches to the clinical record and the workflow closes.

This reverses HL7's Patient Request for Corrections guide, which puts the task in an about slice and uses partOf for threading. A consumer converting between the two must move the reference rather than copy it.

The disclosure assembly contract

None of this is implemented. It is what a release path must do:

  1. Identify the information being disclosed.
  2. Find every statement of disagreement associated with any of it — through the logical record, not only the exact version in hand.
  3. Deliver the statement in a form the receiving workflow can consume. A FHIR Bundle can carry the Communication. A PDF export needs a clearly associated section or attachment. A dangling reference the recipient cannot resolve does not discharge the obligation.
  4. Where a channel cannot carry the statement, block the disclosure or route it through a channel that can. Sending the disputed information alone is the one outcome the requirement exists to prevent.

Every channel needs deciding, and they behave differently: single-resource reads, search results, referral packets, patient summaries, printing, portal downloads, bulk export, subscriptions, and generated summaries.

There is a second question here that is easy to overlook. A statement may itself contain sensitive information the recipient is not entitled to. Appending unrestricted patient narrative to whoever receives the record is not automatically safe.

Notifying prior recipients

The obligation is to notify people the disputed information was already disclosed to — and, where applicable, to disclose the statement to them.

That is unanswerable without a record of who received what. Provenance will not answer it: it describes authorship and is written selectively, so its absence is inconclusive. The AuditEvent disclosure entry is the only place the question can be asked, and those entries are a first pass.

This is the strongest practical argument for taking disclosure auditing seriously early. A statement of disagreement filed against a record that has already been sent to four specialists creates four notification obligations, and nothing in the model currently knows there were four.

Authorship

sender is the individual or their substitute decision-maker. Nobody else. A statement authored by the clinic is the custodian's account wearing the individual's name.

A substitute decision-maker is a RelatedPerson, never the Patient. The Communication profile was widened in this release to admit RelatedPerson for exactly this reason: flattening a proxy onto the patient loses the fact that authority was delegated, which is what gets examined when the statement is challenged.

The words are the payload

The statement is disclosed as written. Not summarised, not paraphrased, not condensed into a chart note. A clinic that rewrites it has substituted its own account for the one the individual is entitled to have carried, which is the failure the right exists to prevent.

Withdrawal

entered-in-error is the only route, and it is for statements recorded in error — not for statements the custodian would rather not carry. An individual changing their statement supplies a new one; the original stays in version history.

The model deliberately offers no clean way for a custodian to delete an individual's account of a dispute.

What is not implemented

  • No release path consults about.
  • No channel refuses a disclosure it cannot carry the statement through.
  • No prior-recipient list can be produced, so the notification obligation cannot be discharged from the record.
  • Nothing re-associates a statement when the disputed record is replaced for an unrelated reason.