- Shipped
- October 18, 2026 at 9:32 PM UTC
- Author
- Kamo
- Commit
- 27ac60d
18 ehr_* tools (EhrPack) over SecurityService's EHR controllers as the SI member; each names the right SecurityService checks there, and anything inside one chart also needs the care relationship (a refusal is a 404 that confirms nothing). - Schedule: ehr_schedule_availability (open times + visit types), ehr_schedule_day, ehr_book_appointment, ehr_cancel_appointment (who and why), ehr_check_in. - Front desk: ehr_patients_search (identity only), ehr_patients_get (purpose of use), ehr_patients_register (duplicates checked first; registers only with confirmNotDuplicate). - Chart: ehr_chart_summary (chosen sections, minimum fields), ehr_fhir_read, ehr_fhir_search (one patient, at most 50; read as application/fhir+json). The purpose of use has no default. - Notes: ehr_notes_draft and ehr_notes_revise write UNSIGNED notes (SecurityService marks an SI's version SI-assisted); ehr_notes_list (a patient's, a note's versions, the SI's own drafts). - Revenue cycle: ehr_billing_worklist (nine worklists), ehr_claims_get, ehr_coverage_get (never a card image; may-bill with its reason); ehr_post_payment is money (FINANCIAL_TRANSACTION, the plan carries the amount, money sent as decimal strings). Never here: signing/co-signing, prescribing, orders, immunizations, break-glass, merge, export (the SI floor), claim create/submit, portal invites. Every tool is phiSensitive and offered only where the org has the Patient Records app AND has declared it handles PHI (new ToolVisibility rule PHI_TENANT: the capability guard says yes to NOT_PHI tenants), and refused for outside readers. Clinical text is untrusted; the billing ledger is trusted so a posting run keeps its money tool. Guards: ehr_ prefix, ContentReadTools, DisclosingTools (five NOTE/SHARE writes), CollabTools, catalogue counts, the schema golden (+18). The tools/list snapshots are NOT_PHI orgs, so they do not change.