At this level
health.hats · 11- health.hats.answerAsk procedure The asked clinician answers: done, after correcting or verifying the record in their own repo, or declined with a reason. Either ends the access the ask opened. Authenticated as the clinician (service auth).
- health.hats.answerRequest procedure not from the namespace authority Approve or decline one waiting request. Approving names the grant record the patient wrote to their health.hats.audit.log space and how long it lasts; the coordinator then grants exactly what was picked, until then. Authenticated as the patient (service auth).
- health.hats.ask procedure not from the namespace authority A patient asks one named clinician to correct a record they wrote, or to verify one the patient wrote. Asking is consent: the clinician may read and write that record's section, and record those reads in the audit log, under PATRQT until they answer or the ask is due, 60 days on (45 CFR 164.526(b)(2)). Authenticated as the patient (service auth).
- health.hats.defs defs not from the namespace authority Definitions shared across HATS records: the amendment chain and attestations (Record Integrity).
- health.hats.describeCoordinator query not from the namespace authority Describe this coordinator, so anyone can stand up a clone and check that it runs the same code. A clone is not accredited: accreditation follows the operator, not the code.
- health.hats.listAccessOptions query not from the namespace authority The menu: what the caller may ask for under a reason. Built only from policy (the requester's role and institution, from authentication, and the reason), never from any patient, so it is the same for every patient.
- health.hats.listAsks query not from the namespace authority Asks the caller made, as a patient, and was asked, as a clinician, newest first. Service auth, so each caller sees only their own.
- health.hats.listGrants query not from the namespace authority Grants the caller gave, as a patient, and grants the caller holds, as a grantee: one entry per request, newest first. Authenticated by service auth, so each caller sees only their own.
- health.hats.listRequests query not from the namespace authority The requests waiting on the caller: access asked for their own spaces that policy leaves to them. Authenticated as the patient (service auth), so each patient sees only their own.
- health.hats.requestAccess procedure not from the namespace authority Pick options from the menu for one patient. The coordinator decides by policy and returns, per pick, the space address or pending while a patient or circle approval is outstanding. It never says whether a space holds records; the requester learns that by syncing. Authenticated as the clinician (service auth) and the institution node (client attestation).
- health.hats.revokeAccess procedure not from the namespace authority End every grant the caller has given one grantee. The space host asks the coordinator before issuing each space credential, so the grantee gets no new credential from then on; a credential already issued lasts until it expires. Authenticated as the patient (service auth).
- health.hats.audit.breakGlass record not from the namespace authority A break-glass record: clinician DID, institution, reason, sections, and window. Written by the institution node that requested emergency access, into its own repo in the patient's health.hats.audit.log space; signed by the clinician, with a transparency receipt. The coordinator logs the same decision before granting and never writes into spaces.
- health.hats.audit.log space not from the namespace authority The access ledger: grants, break-glass records, derived grants, and legal disclosure records. The coordinator never reads it; each grant reaches the coordinator when it's made.
- health.hats.fhir.adverseEvent record not from the namespace authority A FHIR R4 AdverseEvent resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.allergyIntolerance record not from the namespace authority A FHIR R4 AllergyIntolerance resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.auditEvent record A FHIR R4 AuditEvent resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.carePlan record not from the namespace authority A FHIR R4 CarePlan resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.clinicalImpression record not from the namespace authority A FHIR R4 ClinicalImpression resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.communication record A FHIR R4 Communication resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.composition record not from the namespace authority A FHIR R4 Composition resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.condition record A FHIR R4 Condition resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.consent record not from the namespace authority A FHIR R4 Consent resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.deviceUseStatement record not from the namespace authority A FHIR R4 DeviceUseStatement resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.diagnosticReport record not from the namespace authority A FHIR R4 DiagnosticReport resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.documentReference record A FHIR R4 DocumentReference resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.encounter record not from the namespace authority A FHIR R4 Encounter resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.flag record A FHIR R4 Flag resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.immunization record not from the namespace authority A FHIR R4 Immunization resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.immunizationRecommendation record not from the namespace authority A FHIR R4 ImmunizationRecommendation resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.location record A FHIR R4 Location resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.measureReport record not from the namespace authority A FHIR R4 MeasureReport resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.medicationAdministration record A FHIR R4 MedicationAdministration resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.medicationDispense record not from the namespace authority A FHIR R4 MedicationDispense resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.medicationRequest record not from the namespace authority A FHIR R4 MedicationRequest resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.medicationStatement record not from the namespace authority A FHIR R4 MedicationStatement resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.observation record not from the namespace authority A FHIR R4 Observation resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.organization record A FHIR R4 Organization resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case. An institution's own description of itself, one per account: its NUCC taxonomy type, its endpoints, and its contacts.
- health.hats.fhir.patient record A FHIR R4 Patient resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.practitionerRole record A FHIR R4 PractitionerRole resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case. Published by an institution, one per person who works there, keyed by that person's DID: the coordinator reads a role by key. Forwards are contained Endpoints (docs/institution/people.md#when-someone-leaves).
- health.hats.fhir.procedure record not from the namespace authority A FHIR R4 Procedure resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.provenance record A FHIR R4 Provenance resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.serviceRequest record not from the namespace authority A FHIR R4 ServiceRequest resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.fhir.task record A FHIR R4 Task resource. The record is the resource itself: its JSON fields as FHIR defines them, plus $type and the HATS integrity fields. Decimals are strings, since atproto has no floats; codes keep their code system's case.
- health.hats.institution.endRole procedure An administrator ends someone's role at their institution, when the person didn't choose to go, or records a leaving by revoking the credential. The node writes the ended PractitionerRole, pointing its forward where the administrator says, and a Provenance naming the administrator. Authenticated as the administrator (service auth), who must hold institution.administrator there.
- health.hats.institution.leaveRole procedure A clinician leaves an institution: their role there ends now. It's their own act, honored at once, since giving up a role only removes access; an administrator revokes the role credential after. The institution's node writes the ended PractitionerRole and a Provenance naming the clinician. Authenticated as the clinician (service auth).
- health.hats.institution.pneumatic.alert space Clinical alerts routed between departments or institutions, acknowledged by a Communication in response. Authority is the institution's DID; the skey is the partner institution's DID, or a unit or care team within one institution.
- health.hats.institution.pneumatic.bedRequest space Bed availability and capacity coordination, with no PHI: Location status, MeasureReport capacity, and the ask as a Task. Authority is the institution's DID; the skey is the partner institution's DID, or a unit or care team within one institution.
- health.hats.institution.pneumatic.handoff space On-call or care handoffs: the outgoing clinician's Communication and the incoming clinician's response. Authority is the institution's DID; the skey is the partner institution's DID, or a unit or care team within one institution.
- health.hats.institution.pneumatic.incident space Incident and emergency coordination: patient-safety events (AdverseEvent) and emergency alerts (Communication). Authority is the institution's DID; the skey is the partner institution's DID, or a unit or care team within one institution.
- health.hats.institution.public space not from the namespace authority Referrals, transfers, and consults between two institutions: the requester's ServiceRequest and the receiver's Task. Authority is the requesting institution's DID; the skey is the partner institution's DID.
- health.hats.institution.sharingGrant record not from the namespace authority A patient-signed pre-authorization of a sharing class: a FHIR R4 Consent (scope patient-privacy) under the HATS profile. Stored in the patient's health.hats.audit.log space; read by the coordinator when it answers checkUserAccess.
- health.hats.records.advanceDirectives space IPS section 42348-3: advance directives. The skey is the HL7 confidentiality code, lowercase (n, r, v), or 42cfrpart2 for 42 CFR Part 2 records.
- health.hats.records.alerts space IPS section 104605-1: alerts. The skey is the HL7 confidentiality code, lowercase (n, r, v), or 42cfrpart2 for 42 CFR Part 2 records.
- health.hats.records.allergies space IPS section 48765-2: allergies and intolerances. The skey is the HL7 confidentiality code, lowercase (n, r, v), or 42cfrpart2 for 42 CFR Part 2 records.
- health.hats.records.consent space Clinical consents (to treatment, to procedures). Access and sharing grants live in health.hats.audit.log, not here. The skey is the HL7 confidentiality code, lowercase (n, r, v), or 42cfrpart2 for 42 CFR Part 2 records.
- health.hats.records.encounters space Encounter notes and discharge summaries. ER write-back lands here. The skey is the HL7 confidentiality code, lowercase (n, r, v), or 42cfrpart2 for 42 CFR Part 2 records.
- health.hats.records.functionalStatus space IPS section 47420-5: functional status. The skey is the HL7 confidentiality code, lowercase (n, r, v), or 42cfrpart2 for 42 CFR Part 2 records.
- health.hats.records.immunizations space IPS section 11369-6: immunizations. The skey is the HL7 confidentiality code, lowercase (n, r, v), or 42cfrpart2 for 42 CFR Part 2 records.
- health.hats.records.medicalDevices space IPS section 46264-8: medical devices. The skey is the HL7 confidentiality code, lowercase (n, r, v), or 42cfrpart2 for 42 CFR Part 2 records.
- health.hats.records.medications space IPS section 10160-0: medication summary. The skey is the HL7 confidentiality code, lowercase (n, r, v), or 42cfrpart2 for 42 CFR Part 2 records.
- health.hats.records.pastProblems space IPS section 11348-0: history of past problems. The skey is the HL7 confidentiality code, lowercase (n, r, v), or 42cfrpart2 for 42 CFR Part 2 records.
- health.hats.records.patient space The subject of the IPS document (FHIR Patient); required by Patient/$summary, so it opens with any emergency access. The skey is the HL7 confidentiality code, lowercase (n, r, v), or 42cfrpart2 for 42 CFR Part 2 records.
- health.hats.records.patientStory space IPS section 81338-6: patient story. The skey is the HL7 confidentiality code, lowercase (n, r, v), or 42cfrpart2 for 42 CFR Part 2 records. IPS allows any resource here; only DocumentReference is declared, since collections may not be a wildcard.
- health.hats.records.planOfCare space IPS section 18776-5: plan of care. The skey is the HL7 confidentiality code, lowercase (n, r, v), or 42cfrpart2 for 42 CFR Part 2 records.
- health.hats.records.pregnancy space IPS section 10162-6: history of pregnancy. The skey is the HL7 confidentiality code, lowercase (n, r, v), or 42cfrpart2 for 42 CFR Part 2 records.
- health.hats.records.problems space IPS section 11450-4: problems. The skey is the HL7 confidentiality code, lowercase (n, r, v), or 42cfrpart2 for 42 CFR Part 2 records.
- health.hats.records.procedures space IPS section 47519-4: history of procedures. The skey is the HL7 confidentiality code, lowercase (n, r, v), or 42cfrpart2 for 42 CFR Part 2 records.
- health.hats.records.results space IPS section 30954-2: results. The skey is the HL7 confidentiality code, lowercase (n, r, v), or 42cfrpart2 for 42 CFR Part 2 records.
- health.hats.records.socialHistory space IPS section 29762-2: social history. The skey is the HL7 confidentiality code, lowercase (n, r, v), or 42cfrpart2 for 42 CFR Part 2 records.
- health.hats.records.vitalSigns space IPS section 8716-3: vital signs. The skey is the HL7 confidentiality code, lowercase (n, r, v), or 42cfrpart2 for 42 CFR Part 2 records.