Context
Interoperability without live consent evaluation discloses on hope. HAPI FHIR owns clinical versions. The operator surface is TypeScript. The rule is language-agnostic: if consent cannot be evaluated, do not disclose.
The FHIR Consent & Care Coordination Sandbox makes deny-by-default visible.
Decision
Every decision looks up a live FHIR Consent. An unavailable policy input denies access. Emergency break-glass grants last at most thirty minutes, are never served from an authorization cache, and can be revoked immediately. Imports are replay-safe: durable receipt first, then the FHIR transaction. Coordination tasks bind to exact resource versions.
What I rejected
Caching a “yes” for the shift, and treating break-glass as a role that stays hot in Redis. Cached emergency access is how a revoked grant keeps disclosing.
Failure scenario
Policy lookup is down. The read is denied. An emergency grant is issued, audited, and expires. A subsequent read does not hit an authorization cache. Revocation takes effect on the next evaluation.
Evidence
Synthetic FHIR R4 sandbox, consent version tests, and emergency-access audit that bypasses cache. This is not an EHR, not clinical decision support, and not a HIPAA certification.
Inspect: Repository · Run locally