Data Ownership Model

Patient = User Identity

A person exists once in the system. Organizations see the patient through org-scoped relationships (encounters, appointments, claims) but never "own" the patient record itself.

User AMI Schema

Patient AMI Schema

Short GUID Convention

All primary keys use a Base62-encoded Short GUID: 22 characters, URL-safe, case-sensitive.

Worked Example

JavaScript Reference Implementation

const BASE62 = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';

function uuidToShortGuid(uuid) {
  const hex = uuid.replace(/-/g, '');
  let num = BigInt('0x' + hex);
  let result = '';
  while (num > 0n) {
    result = BASE62[Number(num % 62n)] + result;
    num = num / 62n;
  }
  return result.padStart(22, '0');
}

function shortGuidToUuid(short) {
  let num = 0n;
  for (const ch of short) {
    num = num * 62n + BigInt(BASE62.indexOf(ch));
  }
  const hex = num.toString(16).padStart(32, '0');
  return [hex.slice(0,8), hex.slice(8,12), hex.slice(12,16),
          hex.slice(16,20), hex.slice(20)].join('-');
}

Data Ownership Classification

Every entity is classified as Global (patient-centric, no org owner) or Org-scoped (belongs to a specific organization).

Global Entities (Patient-Owned)

Org-Scoped Entities

Billing Nuance

Read-Access Audit Trail

Every read of clinical data generates an audit entry recording who, what, when, how, and why.

Authorization Chain Types

AuditLog AMI Schema

Classification Flow

graph TD
  A["New Entity"] --> B{"Has OrganizationID?"}
  B -- No --> C["Global Entity"]
  B -- Yes --> D["Org-Scoped Entity"]
  C --> E{"Clinical fact?"}
  E -- Yes --> F["Add SourceOrganizationID
for provenance"]
  E -- No --> G["Pure global
(User, Patient, ProblemList)"]
  D --> H{"Patient-related?"}
  H -- Yes --> I["PatientID partition key"]
  H -- No --> J["Org-only partition
(Schedule, Slot, Resource)"]
  

Authorization Evaluation Flow

graph TD
  REQ["Data Access Request"] --> AUTH["Identify Actor & Role"]
  AUTH --> RBAC["RBAC Check:
Role has permission?"]
  RBAC -- No --> DENY["Deny"]
  RBAC -- Yes --> ABAC["ABAC Check:
Context attributes match?"]
  ABAC -- No --> BTG{"Break-the-Glass
available?"}
  BTG -- No --> DENY
  BTG -- Yes --> JUSTIFY["Require Justification"]
  JUSTIFY --> ALERT["Trigger Alert + Audit"]
  ALERT --> GRANT
  ABAC -- Yes --> SCOPE["Scope Check:
CareRelationship or
valid AuthorizationChain?"]
  SCOPE -- No --> DENY
  SCOPE -- Yes --> GRANT["Grant + Audit Entry"]
  

Provenance Model & Trust Tiers