Stream: united states
Topic: When is Provenance required?
Brendan Keeler (Oct 14 2021 at 15:28):
USCDI is basically a list of data types/fields, in some cases with specific codesets (which one could find in US Core, but they are independent).
USCDI lists the Author Organization and Author Time Stamp fields for Provenance, so CFR 170.315(10)(i)(A) (linked above) requires that the fields be "supported" within the FHIR & US Core specs by EHR APIs. If an actor has data stored to them via APIs and only has the identity that made the API call, does that actually constitute "Author" provenance information per the meaning of the FHIR and US Core specs?
For instance, we may only know that an app created a resource, but not the specific user or actual underlying covered entity / organization where the clinical information was recorded.
Brendan Keeler (Oct 14 2021 at 15:29):
The USCDI page says that:
The following data-elements are mandatory (i.e. data MUST be present) or must be supported if the data is present in the sending system (Must Support definition).
and the "must support" definition further echoes the "must be supported if data is present":
In situations where information on a particular data element is not present and the reason for absence is unknown, US Core Responders SHALL NOT include the data elements in the resource instance returned as part of the query results.
So it seems that we aren't required to produce a Provenance resource for every resource in our system if we lack the information to do so -- the USCDI spec says that twice.
John Moehrke (Oct 14 2021 at 16:15):
the basic Provenance would have you simply claim that your organization has exported the data. The main reason this bar is so low, is as you point out... and also to enable the next custodian to be able to declare where they got the data.
Brendan Keeler (Oct 14 2021 at 19:02):
But what about when receiving writes from apps? Would we list the app? Or our organization?
John Moehrke (Oct 14 2021 at 21:46):
is that app an organization deployed app? Provenance could record turtles-all-the-way-down. Basic Prov is only demanding Organizations give/get Provenance credit.
Eric Haas (Oct 18 2021 at 15:27):
Brendan Keeler said:
But what about when receiving writes from apps? Would we list the app? Or our organization?
We discuss this in the Argo Write project and based on the implementer feedback we assume that the EHR would a have a "small p" provenance once the data crosses its threshold. But we are conspicuously silent on using Provenance and instead implement a meta tag of "uploaded-data" and rely on the resource elements to provide the context.
as an aside I think you mis-attribute the quotes above to USCDI page to USCDIwhen you mean US Core
Last updated: Apr 12 2022 at 19:14 UTC
