Confidentiality restrictions

When confidentiality restrictions are enabled for a practice, restricted patients and clinical resources are unavailable through the Open API.

This applies in addition to existing access-group permissions. A request must have normal access-group permission and the requested data must not be confidentially restricted.

Restricted data is omitted from lists and searches. Direct reads and writes to restricted patients or resources are treated as inaccessible. This includes records, prescriptions, letters, patient documents and prescription PDFs.

Open API tokens are role-based and cannot be granted an individual user's confidential access. Integrations needing restricted data should continue to use an approved user-facing workflow until a named service-account option is available.