Cross-Paradigm Sensitive Data and Sensitivity Flags Library and Guidance (Jira PSS-2570)

This project aims to develop, publish, and maintain:

an open library/inventory of sensitive data sets that are subject to jurisdictional privacy rules and associated sensitivity flags that represent presences of certain sensitive data in a message, document, data set, or context where such presences is relevant to communicate;

an open library of computable expressions, e.g., CQL using FHIR resource definitions, that represent the jurisdictional privacy rules using the sensitive data and sensitivity flag definitions;

an open library of common, computable patient consent rules and the data they apply to;

a process supporting definition, inclusion and publication of new and updated entries (sensitive data, sensitivity flags, privacy rules, common consent rules)

One of the goals is to enable detection of sensitive information in context and data set enabling appropriate filtering of data upon access, exchange, and use including LLM processing to identify presence of sensitive information in context, unstructured data, data sets, and/or documents. These will enable developers to detect presence of sensitive information (e.g., using LLM or other tools) in documents, free text, contextually, images, medical device associations, or data sets, and appropriately tag data, documents, messages, free text, and data sets accordingly. Guidance on how to utilize the entries in specific exchange standards are addressed in standard specific guidance, specifically, HL7 DS4P for FHIR or CDA. Where such guidance is not yet published, e.g., Hl7 v2, the project will work with the standards management team to have such guidance established published as well.

The approach is to initially focus on sensitive data in the US, initially focusing on the requirements for California and Maryland followed by other US jurisdictions as they emerge. As non-US jurisdictional examples emerge, we will consider adjusting the scope from US Realm to Universal upon determining that they can be managed the same. The approach must be able to support use of sensitive data in any context such as US 42 CFR Part 2 for Behavioral Health, demographic and social determinants of health data, HIV, etc.

The resulting documentation will be published by HL7 and is available to anybody for their use for free per regular HL7 practice where the users can freely use the content within the applicable law of their jurisdictions.