# Break-glass FHIR access that cannot hide in cache

Canonical: https://stevenmoriasi.com/blog/fhir-consent-care-coordination
By [Steven Moriasi](https://www.linkedin.com/in/steven-moriasi/).
Source: https://github.com/steven-moriasi/fhir-consent-care-coordination-sandbox
Date: 2026-05-28

## Context

Interoperability without live consent evaluation discloses on hope. HAPI FHIR owns clinical versions. The operator surface is TypeScript. The rule is language-agnostic: if consent cannot be evaluated, do not disclose.

The [FHIR Consent & Care Coordination Sandbox](https://github.com/steven-moriasi/fhir-consent-care-coordination-sandbox) makes deny-by-default visible.

## Decision

Every decision looks up a live FHIR Consent. An unavailable policy input denies access. Emergency break-glass grants last at most thirty minutes, are never served from an authorization cache, and can be revoked immediately. Imports are replay-safe: durable receipt first, then the FHIR transaction. Coordination tasks bind to exact resource versions.

## What I rejected

Caching a “yes” for the shift, and treating break-glass as a role that stays hot in Redis. Cached emergency access is how a revoked grant keeps disclosing.

## Failure scenario

Policy lookup is down. The read is denied. An emergency grant is issued, audited, and expires. A subsequent read does not hit an authorization cache. Revocation takes effect on the next evaluation.

## Evidence

Synthetic FHIR R4 sandbox, consent version tests, and emergency-access audit that bypasses cache. This is not an EHR, not clinical decision support, and not a HIPAA certification.

Inspect: [Repository](https://github.com/steven-moriasi/fhir-consent-care-coordination-sandbox) · [Run locally](https://github.com/steven-moriasi/fhir-consent-care-coordination-sandbox#readme)

_—by [Steven Moriasi](https://www.linkedin.com/in/steven-moriasi/)_