HL7 Electronic Health Record System Functional Model, Release 2.1.1
2.1.1 - Normative

HL7 Electronic Health Record System Functional Model, Release 2.1.1, published by HL7 International / Electronic Health Records. This guide is not an authorized publication; it is the continuous build for version 2.1.1 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/ehrsfm-ig/ and changes regularly. See the Directory of published versions

## : POP.8 De-Identified Data Request Management (Function)

Page standards status: Normative

Raw ttl | Download

    @prefix fhir: <http://hl7.org/fhir/> .
    @prefix owl: <http://www.w3.org/2002/07/owl#> .
    @prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
    @prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
    @prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

    # - resource -------------------------------------------------------------------

     a fhir:Requirements ;
      fhir:nodeRole fhir:treeRoot ;
      fhir:id [ fhir:v "EHRSFMR2-POP.8"] ; #
      fhir:meta [
        ( fhir:profile [
    fhir:v "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/FMFunction"^^xsd:anyURI ;
    fhir:l <http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/FMFunction>     ] )
      ] ; #
      fhir:language [ fhir:v "en"] ; #
      fhir:text [
    fhir:status [ fhir:v "extensions" ] ;
    fhir:div [ fhir:v "<div xml:lang=\"en\" xmlns=\"http://www.w3.org/1999/xhtml\" lang=\"en\">\n    \n    \n    <div id=\"description\"><b>Description <a href=\"https://hl7.org/fhir/versions.html#std-process\" title=\"Informative Content\" class=\"informative-flag\">I</a>:</b> <div><p>When an internal or external party requests patient data and that party requests de-identified data (or is not entitled to identified patient information, either by law or custom), the user can export the data in a fashion that meets the requirements for de-identification in that locale or realm.</p>\n<p>An auditable record of these requests and associated exports may be maintained by the system. This record could be implemented in any way that would allow the who, what, why and when of a request and export to be recoverable for review.</p>\n<p>A random re-identification key may be added to the data, to support re-identification for the purpose of alerting providers of potential patient safety issues. For example, if it is discovered that a patient is at risk for a major cardiac event, the provider could be notified of this risk, allowing the provider to identify the patient from the random key.</p>\n</div></div>\n    \n    \n    \n    <div id=\"requirements\"><b>Criteria <a href=\"https://hl7.org/fhir/versions.html#std-process\" title=\"Normative Content\" class=\"normative-flag\">N</a>:</b></div>\n    \n    <table id=\"statements\" class=\"grid dict\">\n        \n        <tr>\n            <td style=\"padding-left: 4px;\">\n            POP.8#01\n            </td>\n            <td style=\"padding-left: 4px;\">\n            SHALL\n            \n                \n                <span style=\"border-radius: 999px;margin: 2px 2px;font-size: 10px;display: inline-block;padding: 3px 5px;letter-spacing: 0.5px;line-height: 1;white-space: nowrap;background-color: #e5f5e5;color: #388e3c;border: 1px solid #a2d1a2;\">dependent</span>\n                \n            \n            \n            \n            </td>\n            <td style=\"padding-left: 4px;\" class=\"requirement\">\n                <div><p>The system SHALL conform to function <a href=\"Requirements-EHRSFMR2-TI.1.8.html\">TI.1.8</a> (Patient Privacy and Confidentiality) when managing de-identified views of data according to scope of practice, organizational policy, and/or jurisdictional law.</p>\n</div>\n                \n            </td>\n        </tr>\n        \n        <tr>\n            <td style=\"padding-left: 4px;\">\n            POP.8#02\n            </td>\n            <td style=\"padding-left: 4px;\">\n            SHOULD\n            \n                \n            \n            \n            \n            </td>\n            <td style=\"padding-left: 4px;\" class=\"requirement\">\n                <div><p>The system SHOULD provide the ability to de-identify extracted information.</p>\n</div>\n                \n            </td>\n        </tr>\n        \n        <tr>\n            <td style=\"padding-left: 4px;\">\n            POP.8#03\n            </td>\n            <td style=\"padding-left: 4px;\">\n            SHOULD\n            \n                \n                <span style=\"border-radius: 999px;margin: 2px 2px;font-size: 10px;display: inline-block;padding: 3px 5px;letter-spacing: 0.5px;line-height: 1;white-space: nowrap;background-color: #e5f5e5;color: #388e3c;border: 1px solid #a2d1a2;\">dependent</span>\n                \n            \n            \n            \n            </td>\n            <td style=\"padding-left: 4px;\" class=\"requirement\">\n                <div><p>The system SHOULD provide the ability for authorized users to tag data for de-identification according to scope of practice, organizational policy, and/or jurisdictional law.</p>\n</div>\n                \n            </td>\n        </tr>\n        \n        <tr>\n            <td style=\"padding-left: 4px;\">\n            POP.8#04\n            </td>\n            <td style=\"padding-left: 4px;\">\n            SHOULD\n            \n                \n                <span style=\"border-radius: 999px;margin: 2px 2px;font-size: 10px;display: inline-block;padding: 3px 5px;letter-spacing: 0.5px;line-height: 1;white-space: nowrap;background-color: #e5f5e5;color: #388e3c;border: 1px solid #a2d1a2;\">dependent</span>\n                \n            \n            \n            \n            </td>\n            <td style=\"padding-left: 4px;\" class=\"requirement\">\n                <div><p>The system SHOULD provide the ability for authorized users to transmit de-identified data to authorized recipients according to scope of practice, organizational policy, and/or jurisdictional law.</p>\n</div>\n                \n            </td>\n        </tr>\n        \n        <tr>\n            <td style=\"padding-left: 4px;\">\n            POP.8#05\n            </td>\n            <td style=\"padding-left: 4px;\">\n            SHOULD\n            \n                \n                <span style=\"border-radius: 999px;margin: 2px 2px;font-size: 10px;display: inline-block;padding: 3px 5px;letter-spacing: 0.5px;line-height: 1;white-space: nowrap;background-color: #e5f5e5;color: #388e3c;border: 1px solid #a2d1a2;\">dependent</span>\n                \n            \n            \n            \n            </td>\n            <td style=\"padding-left: 4px;\" class=\"requirement\">\n                <div><p>The system SHOULD provide the ability to transmit a re-identification key to recipients of de-identified data according to scope of practice, organizational policy, and/or jurisdictional law.</p>\n</div>\n                \n            </td>\n        </tr>\n        \n        <tr>\n            <td style=\"padding-left: 4px;\">\n            POP.8#06\n            </td>\n            <td style=\"padding-left: 4px;\">\n            SHOULD\n            \n                \n                <span style=\"border-radius: 999px;margin: 2px 2px;font-size: 10px;display: inline-block;padding: 3px 5px;letter-spacing: 0.5px;line-height: 1;white-space: nowrap;background-color: #e5f5e5;color: #388e3c;border: 1px solid #a2d1a2;\">dependent</span>\n                \n            \n            \n            \n            </td>\n            <td style=\"padding-left: 4px;\" class=\"requirement\">\n                <div><p>The system SHOULD provide the ability to edit discrete patient identifiers from all reports containing data on multiple patients according to scope of practice, organizational policy, and/or jurisdictional law (e.g., replace \"John Smith\" with \"***\").</p>\n</div>\n                \n            </td>\n        </tr>\n        \n    </table>\n</div>"^^rdf:XMLLiteral ]
      ] ; #
      fhir:extension ( [
    fhir:url [
    fhir:v "http://hl7.org/fhir/StructureDefinition/structuredefinition-standards-status"^^xsd:anyURI ;
    fhir:l <http://hl7.org/fhir/StructureDefinition/structuredefinition-standards-status>     ] ;
    fhir:value [
    a fhir:Code ;
    fhir:v "normative"     ]
      ] [
    fhir:url [
    fhir:v "http://hl7.org/fhir/StructureDefinition/structuredefinition-wg"^^xsd:anyURI ;
    fhir:l <http://hl7.org/fhir/StructureDefinition/structuredefinition-wg>     ] ;
    fhir:value [
    a fhir:Code ;
    fhir:v "ehr"     ]
      ] ) ; #
      fhir:url [
    fhir:v "http://hl7.org/ehrs/uv/ehrsfmr2/Requirements/EHRSFMR2-POP.8"^^xsd:anyURI ;
    fhir:l <http://hl7.org/ehrs/uv/ehrsfmr2/Requirements/EHRSFMR2-POP.8>
      ] ; #
      fhir:version [ fhir:v "2.1.1"] ; #
      fhir:name [ fhir:v "POP_8_De_Identified_Data_Request_Management"] ; #
      fhir:title [ fhir:v "POP.8 De-Identified Data Request Management (Function)"] ; #
      fhir:status [ fhir:v "active"] ; #
      fhir:date [ fhir:v "2025-12-13T09:06:06+00:00"^^xsd:dateTime] ; #
      fhir:publisher [ fhir:v "HL7 International / Electronic Health Records"] ; #
      fhir:contact ( [
        ( fhir:telecom [
    fhir:system [ fhir:v "url" ] ;
    fhir:value [ fhir:v "http://www.hl7.org/Special/committees/ehr" ]     ] )
      ] ) ; #
      fhir:description [ fhir:v "Provide patient data in a manner that meets applicable requirements for de-identification."] ; #
      fhir:jurisdiction ( [
        ( fhir:coding [
    fhir:system [
    fhir:v "http://unstats.un.org/unsd/methods/m49/m49.htm"^^xsd:anyURI ;
    fhir:l <http://unstats.un.org/unsd/methods/m49/m49.htm>       ] ;
    fhir:code [ fhir:v "001" ] ;
    fhir:display [ fhir:v "World" ]     ] )
      ] ) ; #
      fhir:purpose [ fhir:v "When an internal or external party requests patient data and that party requests de-identified data (or is not entitled to identified patient information, either by law or custom), the user can export the data in a fashion that meets the requirements for de-identification in that locale or realm.\n\nAn auditable record of these requests and associated exports may be maintained by the system. This record could be implemented in any way that would allow the who, what, why and when of a request and export to be recoverable for review.\n\nA random re-identification key may be added to the data, to support re-identification for the purpose of alerting providers of potential patient safety issues. For example, if it is discovered that a patient is at risk for a major cardiac event, the provider could be notified of this risk, allowing the provider to identify the patient from the random key."] ; #
      fhir:statement ( [
        ( fhir:extension [
    fhir:url [
    fhir:v "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent"^^xsd:anyURI ;
    fhir:l <http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent>       ] ;
    fhir:value [
    a fhir:Boolean ;
    fhir:v true       ]     ] ) ;
    fhir:key [ fhir:v "EHRSFMR2-POP.8-01" ] ;
    fhir:label [ fhir:v "POP.8#01" ] ;
        ( fhir:conformance [ fhir:v "SHALL" ] ) ;
    fhir:conditionality [ fhir:v false ] ;
    fhir:requirement [ fhir:v "The system SHALL conform to function [TI.1.8](Requirements-EHRSFMR2-TI.1.8.html) (Patient Privacy and Confidentiality) when managing de-identified views of data according to scope of practice, organizational policy, and/or jurisdictional law." ] ;
    fhir:derivedFrom [ fhir:v "EHR-S_FM_R1.1 S.1.5#1" ]
      ] [
        ( fhir:extension [
    fhir:url [
    fhir:v "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent"^^xsd:anyURI ;
    fhir:l <http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent>       ] ;
    fhir:value [
    a fhir:Boolean ;
    fhir:v false       ]     ] ) ;
    fhir:key [ fhir:v "EHRSFMR2-POP.8-02" ] ;
    fhir:label [ fhir:v "POP.8#02" ] ;
        ( fhir:conformance [ fhir:v "SHOULD" ] ) ;
    fhir:conditionality [ fhir:v false ] ;
    fhir:requirement [ fhir:v "The system SHOULD provide the ability to de-identify extracted information." ] ;
    fhir:derivedFrom [ fhir:v "EHR-S_FM_R1.1 S.1.5#2" ]
      ] [
        ( fhir:extension [
    fhir:url [
    fhir:v "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent"^^xsd:anyURI ;
    fhir:l <http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent>       ] ;
    fhir:value [
    a fhir:Boolean ;
    fhir:v true       ]     ] ) ;
    fhir:key [ fhir:v "EHRSFMR2-POP.8-03" ] ;
    fhir:label [ fhir:v "POP.8#03" ] ;
        ( fhir:conformance [ fhir:v "SHOULD" ] ) ;
    fhir:conditionality [ fhir:v false ] ;
    fhir:requirement [ fhir:v "The system SHOULD provide the ability for authorized users to tag data for de-identification according to scope of practice, organizational policy, and/or jurisdictional law." ] ;
    fhir:derivedFrom [ fhir:v "PHFP S.1.5#3" ]
      ] [
        ( fhir:extension [
    fhir:url [
    fhir:v "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent"^^xsd:anyURI ;
    fhir:l <http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent>       ] ;
    fhir:value [
    a fhir:Boolean ;
    fhir:v true       ]     ] ) ;
    fhir:key [ fhir:v "EHRSFMR2-POP.8-04" ] ;
    fhir:label [ fhir:v "POP.8#04" ] ;
        ( fhir:conformance [ fhir:v "SHOULD" ] ) ;
    fhir:conditionality [ fhir:v false ] ;
    fhir:requirement [ fhir:v "The system SHOULD provide the ability for authorized users to transmit de-identified data to authorized recipients according to scope of practice, organizational policy, and/or jurisdictional law." ]
      ] [
        ( fhir:extension [
    fhir:url [
    fhir:v "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent"^^xsd:anyURI ;
    fhir:l <http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent>       ] ;
    fhir:value [
    a fhir:Boolean ;
    fhir:v true       ]     ] ) ;
    fhir:key [ fhir:v "EHRSFMR2-POP.8-05" ] ;
    fhir:label [ fhir:v "POP.8#05" ] ;
        ( fhir:conformance [ fhir:v "SHOULD" ] ) ;
    fhir:conditionality [ fhir:v false ] ;
    fhir:requirement [ fhir:v "The system SHOULD provide the ability to transmit a re-identification key to recipients of de-identified data according to scope of practice, organizational policy, and/or jurisdictional law." ]
      ] [
        ( fhir:extension [
    fhir:url [
    fhir:v "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent"^^xsd:anyURI ;
    fhir:l <http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent>       ] ;
    fhir:value [
    a fhir:Boolean ;
    fhir:v true       ]     ] ) ;
    fhir:key [ fhir:v "EHRSFMR2-POP.8-06" ] ;
    fhir:label [ fhir:v "POP.8#06" ] ;
        ( fhir:conformance [ fhir:v "SHOULD" ] ) ;
    fhir:conditionality [ fhir:v false ] ;
    fhir:requirement [ fhir:v "The system SHOULD provide the ability to edit discrete patient identifiers from all reports containing data on multiple patients according to scope of practice, organizational policy, and/or jurisdictional law (e.g., replace \"John Smith\" with \"***\")." ]
      ] ) . #