- Shipped
- August 25, 2026 at 2:23 PM UTC
- Author
- Kamo
- Commit
- d02b1ba
The indexed projection of a resource's meta.security labels, and the thing that has to exist before the first clinical read path rather than after the first behavioural-health customer. Applied at WRITE time, never computed at read time, for a mechanical reason: a label derived at read time has to be derived by every read path independently — FHIR search, the portal, C-CDA generation, the TEFCA responder, Bulk export, claim submission — and the one that forgets is the one that leaks. Written once beside the resource, it is a single predicate every path shares. Indexed rather than living only inside the resource JSON, because segmentation is a FILTER on every clinical query. A label the database cannot see means filtering in application code after the rows are loaded, which is both slow and exactly the shape that leaks under pagination. labelKind exists because the four kinds are enforced differently and must not be compared as one bag. A confidentiality level is a ceiling on who may read; a sensitivity code says which consent applies; a refrain policy is an instruction to the RECIPIENT that travels with a disclosure. Treating a refrain code as a read filter blocks nothing; treating a sensitivity code as one blocks everything. patientId is denormalised because a consent check asks what is restricted for THIS patient, and walking from every labelled resource back to its subject would be a join per row on the hot path of every clinical read. manuallyAssigned is there so an automated relabel cannot silently overwrite a clinician's explicit restriction, and assignedReason so "who decided this note is Part 2 data" has an answer that is not "the system did" — needed both to defend a restriction and to lift one applied in error. Urgent rather than theoretical: 42 CFR Part 2's compliance date passed on 16 February 2026 and OCR opened civil enforcement on the 13th. The 2024 rule relaxed physical segregation but kept the redisclosure notice and the bar on use in legal proceedings, so Part 2 provenance must still be labelled and must survive downstream.