Test for PHI exposure in resource ID - All resources, explicit (Test30)

[nir-r]

Requirement
Resource IDs may be exposed on GET over HTTP and hence should not include protected health information (PHI)

Implementation

• Extract Patient.identifier.value from all sampled patients and write it into "a PHI" file

• Patient.id

• Patient.identifier.value

• Patient.identifier.system

• Loop over all resources (including Patient), for each resource, compare (Resource.id) to all identifier values (Patient.identifier.value) in the "PHI" file