HL7 Electronic Health Record System Functional Model, Release 2.1.1
2.1.1 - Normative

HL7 Electronic Health Record System Functional Model, Release 2.1.1, published by HL7 International / Electronic Health Records. This guide is not an authorized publication; it is the continuous build for version 2.1.1 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/ehrsfm-ig/ and changes regularly. See the Directory of published versions

## : TI.1.8 Patient Privacy and Confidentiality (Function)

Page standards status: Normative

Raw xml | Download

    <Requirements xmlns="http://hl7.org/fhir">
      <id value="EHRSFMR2-TI.1.8"/>
      <meta>
        <profile
                 value="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/FMFunction"/>
      </meta>
      <language value="en"/>
      <text>
        <status value="extensions"/>
        <div xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" lang="en">

        <div id="description"><b>Description <a href="https://hl7.org/fhir/versions.html#std-process" title="Informative Content" class="informative-flag">I</a>:</b> <div><p>Patients' privacy and the confidentiality of EHRs are violated if access to EHRs occurs without authorization. Violations or potential violations can impose tangible economic or social losses on affected patients, as well as less tangible feelings of vulnerability and pain. Fear of potential violations discourages patients from revealing sensitive personal information that may be relevant to diagnostic and treatment services. Rules for the protection of privacy and confidentiality may vary depending upon the vulnerability of patients and the sensitivity of records. Strongest protections should apply to the records of minors and the records of patients with stigmatized conditions. Authorization to access the most sensitive parts of an EHR is most definitive if made by the explicit and specific consent of the patient. Please see the definition of masking in the glossary.</p>
    <p>Organizational practices related to privacy and security jurisdictional laws could be called into question during a legal proceeding. Adherence to applicable laws supports the credibility and trustworthiness of the organization.</p>
    </div></div>

        <div id="requirements"><b>Criteria <a href="https://hl7.org/fhir/versions.html#std-process" title="Normative Content" class="normative-flag">N</a>:</b></div>

        <table id="statements" class="grid dict">

            <tr>
                <td style="padding-left: 4px;">
                TI.1.8#01
                </td>
                <td style="padding-left: 4px;">
                SHALL

                    <span style="border-radius: 999px;margin: 2px 2px;font-size: 10px;display: inline-block;padding: 3px 5px;letter-spacing: 0.5px;line-height: 1;white-space: nowrap;background-color: #e5f5e5;color: #388e3c;border: 1px solid #a2d1a2;">dependent</span>

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>The system SHALL provide the ability to maintain compliance with requirements for patient privacy and confidentiality according to scope of practice, organizational policy, and/or jurisdictional law (e.g., US HIPAA Privacy Rules, US Federal Conditions of Participation for Medicare/Medicaid Providers).</p>
    </div>

                </td>
            </tr>

            <tr>
                <td style="padding-left: 4px;">
                TI.1.8#02
                </td>
                <td style="padding-left: 4px;">
                SHALL

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>The system SHALL conform to function <a href="Requirements-EHRSFMR2-TI.1.1.html">TI.1.1</a> (Entity Authentication).</p>
    </div>

                </td>
            </tr>

            <tr>
                <td style="padding-left: 4px;">
                TI.1.8#03
                </td>
                <td style="padding-left: 4px;">
                SHALL

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>The system SHALL conform to function <a href="Requirements-EHRSFMR2-TI.1.2.html">TI.1.2</a> (Entity Authorization).</p>
    </div>

                </td>
            </tr>

            <tr>
                <td style="padding-left: 4px;">
                TI.1.8#04
                </td>
                <td style="padding-left: 4px;">
                SHALL

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>The system SHALL conform to function <a href="Requirements-EHRSFMR2-TI.1.3.html">TI.1.3</a> (Entity Access Control).</p>
    </div>

                </td>
            </tr>

            <tr>
                <td style="padding-left: 4px;">
                TI.1.8#05
                </td>
                <td style="padding-left: 4px;">
                SHALL

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>The system SHALL conform to function <a href="Requirements-EHRSFMR2-TI.1.5.html">TI.1.5</a> (Non-Repudiation).</p>
    </div>

                </td>
            </tr>

            <tr>
                <td style="padding-left: 4px;">
                TI.1.8#06
                </td>
                <td style="padding-left: 4px;">
                SHALL

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>The system SHALL conform to function <a href="Requirements-EHRSFMR2-TI.1.6.html">TI.1.6</a> (Secure Data Exchange).</p>
    </div>

                </td>
            </tr>

            <tr>
                <td style="padding-left: 4px;">
                TI.1.8#07
                </td>
                <td style="padding-left: 4px;">
                SHALL

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>The system SHALL conform to function <a href="Requirements-EHRSFMR2-TI.2.html">TI.2</a> (Audit).</p>
    </div>

                </td>
            </tr>

            <tr>
                <td style="padding-left: 4px;">
                TI.1.8#08
                </td>
                <td style="padding-left: 4px;">
                SHALL

                    <span style="border-radius: 999px;margin: 2px 2px;font-size: 10px;display: inline-block;padding: 3px 5px;letter-spacing: 0.5px;line-height: 1;white-space: nowrap;background-color: #e5f5e5;color: #388e3c;border: 1px solid #a2d1a2;">dependent</span>

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>The system SHALL provide the ability to maintain varying levels of confidentiality according to patient preferences, user role, scope of practice, organizational policy, and/or jurisdictional law.</p>
    </div>

                </td>
            </tr>

            <tr>
                <td style="padding-left: 4px;">
                TI.1.8#09
                </td>
                <td style="padding-left: 4px;">
                SHALL

                    <span style="border-radius: 999px;margin: 2px 2px;font-size: 10px;display: inline-block;padding: 3px 5px;letter-spacing: 0.5px;line-height: 1;white-space: nowrap;background-color: #e5f5e5;color: #388e3c;border: 1px solid #a2d1a2;">dependent</span>

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>The system SHALL provide the ability to mask parts of the electronic health record (e.g., medications, conditions, sensitive documents) from disclosure according to patient preferences, user role, scope of practice, organizational policy, and/or jurisdictional law.</p>
    </div>

                </td>
            </tr>

            <tr>
                <td style="padding-left: 4px;">
                TI.1.8#10
                </td>
                <td style="padding-left: 4px;">
                SHALL

                    <span style="border-radius: 999px;margin: 2px 2px;font-size: 10px;display: inline-block;padding: 3px 5px;letter-spacing: 0.5px;line-height: 1;white-space: nowrap;background-color: #e5f5e5;color: #388e3c;border: 1px solid #a2d1a2;">dependent</span>

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>The system SHALL provide the ability to unmask (override a mask) in emergency or other specific situations in accordance with users' role, and according to scope of practice, organizational policy, and/or jurisdictional law.</p>
    </div>

                </td>
            </tr>

            <tr>
                <td style="padding-left: 4px;">
                TI.1.8#11
                </td>
                <td style="padding-left: 4px;">
                SHOULD

                    <span style="border-radius: 999px;margin: 2px 2px;font-size: 10px;display: inline-block;padding: 3px 5px;letter-spacing: 0.5px;line-height: 1;white-space: nowrap;background-color: #e5f5e5;color: #388e3c;border: 1px solid #a2d1a2;">dependent</span>

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>The system SHOULD provide the ability to maintain indicators (flags) to health record users that content has been masked in accordance with users' role, and according to scope of practice, organizational policy, and/or jurisdictional law.</p>
    </div>

                </td>
            </tr>

            <tr>
                <td style="padding-left: 4px;">
                TI.1.8#12
                </td>
                <td style="padding-left: 4px;">
                SHALL

                <span style="border-radius: 999px;margin: 2px 2px;font-size: 10px;display: inline-block;padding: 3px 5px;letter-spacing: 0.5px;line-height: 1;white-space: nowrap;background-color: #f3e5ff;color: #7b1fa2;border: 1px solid #d1a3ff;">conditional</span>

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>IF the system allows a user to unmask (override a mask) in an emergency or other specific situation, THEN the system SHALL provide the ability to capture the reason for unmasking or overriding the mask.</p>
    </div>

                </td>
            </tr>

            <tr>
                <td style="padding-left: 4px;">
                TI.1.8#13
                </td>
                <td style="padding-left: 4px;">
                SHALL

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>The system SHALL provide the ability to manage patient consents to, or restrictions against, any access to data.</p>
    </div>

                </td>
            </tr>

            <tr>
                <td style="padding-left: 4px;">
                TI.1.8#14
                </td>
                <td style="padding-left: 4px;">
                SHALL

                    <span style="border-radius: 999px;margin: 2px 2px;font-size: 10px;display: inline-block;padding: 3px 5px;letter-spacing: 0.5px;line-height: 1;white-space: nowrap;background-color: #e5f5e5;color: #388e3c;border: 1px solid #a2d1a2;">dependent</span>

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>The system SHALL provide the ability to manage a privacy policy according to patient preferences, user role, scope of practice, organizational policy, and/or jurisdictional law.</p>
    </div>

                </td>
            </tr>

            <tr>
                <td style="padding-left: 4px;">
                TI.1.8#15
                </td>
                <td style="padding-left: 4px;">
                SHALL

                    <span style="border-radius: 999px;margin: 2px 2px;font-size: 10px;display: inline-block;padding: 3px 5px;letter-spacing: 0.5px;line-height: 1;white-space: nowrap;background-color: #e5f5e5;color: #388e3c;border: 1px solid #a2d1a2;">dependent</span>

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>The system SHALL provide the ability to control access by specified user(s) to a particular patient health record either by inclusion or exclusion according to patient preferences, user role, scope of practice, organizational policy, and/or jurisdictional law.</p>
    </div>

                </td>
            </tr>

        </table>
    </div>
      </text>
      <extension
                 url="http://hl7.org/fhir/StructureDefinition/structuredefinition-standards-status">
        <valueCode value="normative"/>
      </extension>
      <extension
                 url="http://hl7.org/fhir/StructureDefinition/structuredefinition-wg">
        <valueCode value="ehr"/>
      </extension>
      <url value="http://hl7.org/ehrs/uv/ehrsfmr2/Requirements/EHRSFMR2-TI.1.8"/>
      <version value="2.1.1"/>
      <name value="TI_1_8_Patient_Privacy_and_Confidentiality"/>
      <title value="TI.1.8 Patient Privacy and Confidentiality (Function)"/>
      <status value="active"/>
      <date value="2025-12-13T09:06:06+00:00"/>
      <publisher value="HL7 International / Electronic Health Records"/>
      <contact>
        <telecom>
          <system value="url"/>
          <value value="http://www.hl7.org/Special/committees/ehr"/>
        </telecom>
      </contact>
      <description
                   value="Enable the enforcement of the applicable jurisdictional and organizational patient privacy rules as they apply to various parts of an EHR-S through the implementation of security mechanisms."/>
      <jurisdiction>
        <coding>
          <system value="http://unstats.un.org/unsd/methods/m49/m49.htm"/>
          <code value="001"/>
          <display value="World"/>
        </coding>
      </jurisdiction>
      <purpose
               value="Patients' privacy and the confidentiality of EHRs are violated if access to EHRs occurs without authorization. Violations or potential violations can impose tangible economic or social losses on affected patients, as well as less tangible feelings of vulnerability and pain. Fear of potential violations discourages patients from revealing sensitive personal information that may be relevant to diagnostic and treatment services. Rules for the protection of privacy and confidentiality may vary depending upon the vulnerability of patients and the sensitivity of records. Strongest protections should apply to the records of minors and the records of patients with stigmatized conditions. Authorization to access the most sensitive parts of an EHR is most definitive if made by the explicit and specific consent of the patient. Please see the definition of masking in the glossary.

    Organizational practices related to privacy and security jurisdictional laws could be called into question during a legal proceeding. Adherence to applicable laws supports the credibility and trustworthiness of the organization."/>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="true"/>
        </extension>
        <key value="EHRSFMR2-TI.1.8-01"/>
        <label value="TI.1.8#01"/>
        <conformance value="SHALL"/>
        <conditionality value="false"/>
        <requirement
                     value="The system SHALL provide the ability to maintain compliance with requirements for patient privacy and confidentiality according to scope of practice, organizational policy, and/or jurisdictional law (e.g., US HIPAA Privacy Rules, US Federal Conditions of Participation for Medicare/Medicaid Providers)."/>
        <derivedFrom value="EHR-S_FM_R1.1 IN.1.9#1"/>
      </statement>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="false"/>
        </extension>
        <key value="EHRSFMR2-TI.1.8-02"/>
        <label value="TI.1.8#02"/>
        <conformance value="SHALL"/>
        <conditionality value="false"/>
        <requirement
                     value="The system SHALL conform to function [TI.1.1](Requirements-EHRSFMR2-TI.1.1.html) (Entity Authentication)."/>
        <derivedFrom value="EHR-S_FM_R1.1 IN.1.9#2"/>
      </statement>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="false"/>
        </extension>
        <key value="EHRSFMR2-TI.1.8-03"/>
        <label value="TI.1.8#03"/>
        <conformance value="SHALL"/>
        <conditionality value="false"/>
        <requirement
                     value="The system SHALL conform to function [TI.1.2](Requirements-EHRSFMR2-TI.1.2.html) (Entity Authorization)."/>
        <derivedFrom value="EHR-S_FM_R1.1 IN.1.9#3"/>
      </statement>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="false"/>
        </extension>
        <key value="EHRSFMR2-TI.1.8-04"/>
        <label value="TI.1.8#04"/>
        <conformance value="SHALL"/>
        <conditionality value="false"/>
        <requirement
                     value="The system SHALL conform to function [TI.1.3](Requirements-EHRSFMR2-TI.1.3.html) (Entity Access Control)."/>
        <derivedFrom value="EHR-S_FM_R1.1 IN.1.9#4"/>
      </statement>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="false"/>
        </extension>
        <key value="EHRSFMR2-TI.1.8-05"/>
        <label value="TI.1.8#05"/>
        <conformance value="SHALL"/>
        <conditionality value="false"/>
        <requirement
                     value="The system SHALL conform to function [TI.1.5](Requirements-EHRSFMR2-TI.1.5.html) (Non-Repudiation)."/>
        <derivedFrom value="EHR-S_FM_R1.1 IN.1.9#5"/>
      </statement>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="false"/>
        </extension>
        <key value="EHRSFMR2-TI.1.8-06"/>
        <label value="TI.1.8#06"/>
        <conformance value="SHALL"/>
        <conditionality value="false"/>
        <requirement
                     value="The system SHALL conform to function [TI.1.6](Requirements-EHRSFMR2-TI.1.6.html) (Secure Data Exchange)."/>
        <derivedFrom value="EHR-S_FM_R1.1 IN.1.9#6"/>
      </statement>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="false"/>
        </extension>
        <key value="EHRSFMR2-TI.1.8-07"/>
        <label value="TI.1.8#07"/>
        <conformance value="SHALL"/>
        <conditionality value="false"/>
        <requirement
                     value="The system SHALL conform to function [TI.2](Requirements-EHRSFMR2-TI.2.html) (Audit)."/>
        <derivedFrom value="EHR-S_FM_R1.1 IN.1.9#7"/>
      </statement>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="true"/>
        </extension>
        <key value="EHRSFMR2-TI.1.8-08"/>
        <label value="TI.1.8#08"/>
        <conformance value="SHALL"/>
        <conditionality value="false"/>
        <requirement
                     value="The system SHALL provide the ability to maintain varying levels of confidentiality according to patient preferences, user role, scope of practice, organizational policy, and/or jurisdictional law."/>
        <derivedFrom value="EHR-S_FM_R1.1 IN.1.9#8"/>
      </statement>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="true"/>
        </extension>
        <key value="EHRSFMR2-TI.1.8-09"/>
        <label value="TI.1.8#09"/>
        <conformance value="SHALL"/>
        <conditionality value="false"/>
        <requirement
                     value="The system SHALL provide the ability to mask parts of the electronic health record (e.g., medications, conditions, sensitive documents) from disclosure according to patient preferences, user role, scope of practice, organizational policy, and/or jurisdictional law."/>
        <derivedFrom value="EHR-S_FM_R1.1 IN.1.9#9"/>
      </statement>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="true"/>
        </extension>
        <key value="EHRSFMR2-TI.1.8-10"/>
        <label value="TI.1.8#10"/>
        <conformance value="SHALL"/>
        <conditionality value="false"/>
        <requirement
                     value="The system SHALL provide the ability to unmask (override a mask) in emergency or other specific situations in accordance with users' role, and according to scope of practice, organizational policy, and/or jurisdictional law."/>
        <derivedFrom value="EHR-S_FM_R1.1 IN.1.9#10"/>
      </statement>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="true"/>
        </extension>
        <key value="EHRSFMR2-TI.1.8-11"/>
        <label value="TI.1.8#11"/>
        <conformance value="SHOULD"/>
        <conditionality value="false"/>
        <requirement
                     value="The system SHOULD provide the ability to maintain indicators (flags) to health record users that content has been masked in accordance with users' role, and according to scope of practice, organizational policy, and/or jurisdictional law."/>
      </statement>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="false"/>
        </extension>
        <key value="EHRSFMR2-TI.1.8-12"/>
        <label value="TI.1.8#12"/>
        <conformance value="SHALL"/>
        <conditionality value="true"/>
        <requirement
                     value="IF the system allows a user to unmask (override a mask) in an emergency or other specific situation, THEN the system SHALL provide the ability to capture the reason for unmasking or overriding the mask."/>
      </statement>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="false"/>
        </extension>
        <key value="EHRSFMR2-TI.1.8-13"/>
        <label value="TI.1.8#13"/>
        <conformance value="SHALL"/>
        <conditionality value="false"/>
        <requirement
                     value="The system SHALL provide the ability to manage patient consents to, or restrictions against, any access to data."/>
      </statement>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="true"/>
        </extension>
        <key value="EHRSFMR2-TI.1.8-14"/>
        <label value="TI.1.8#14"/>
        <conformance value="SHALL"/>
        <conditionality value="false"/>
        <requirement
                     value="The system SHALL provide the ability to manage a privacy policy according to patient preferences, user role, scope of practice, organizational policy, and/or jurisdictional law."/>
      </statement>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="true"/>
        </extension>
        <key value="EHRSFMR2-TI.1.8-15"/>
        <label value="TI.1.8#15"/>
        <conformance value="SHALL"/>
        <conditionality value="false"/>
        <requirement
                     value="The system SHALL provide the ability to control access by specified user(s) to a particular patient health record either by inclusion or exclusion according to patient preferences, user role, scope of practice, organizational policy, and/or jurisdictional law."/>
      </statement>
    </Requirements>