Patient Relationships and Data Access

Your organization can always access the data it contributes to Zus. Access to third-party data, meaning records from connected health data networks and from other organizations on Zus, depends on an asserted patient relationship and applicable legal, contractual, network, and platform requirements.

Zus uses the FHIR Patient.active field on your organization's patient record to represent that active relationship.

How Patient.active controls access

Setting Patient.active

Patient.active can be set through:

• Monitoring enrollment or a Chart Build request. Your consent and relationship assertion causes Zus to set the patient to active, including when the patient was previously inactive.
• An EHR integration. Depending on the integration, it may populate this field automatically.
• The FHIR API. You can update the field directly.

Always set Patient.active explicitly to true or false. Zus treats null as false; a null value pauses active data subscriptions and removes access to previously retrieved third-party data.

For example, an active Patient resource includes:

{
  "resourceType": "Patient",
  "active": true
}

Only enroll or query patients when your organization can make the required relationship and consent assertions. See Patient Monitoring & Chart Builds.

Access after unenrollment

For an actively enrolled Monitoring patient with Patient.active = true, Zus stores clinical data and makes it accessible to your organization, subject to the access and restriction rules above.

When a patient is unenrolled from Monitoring, or when you use a Chart Build instead of ongoing Monitoring, the current access policy for third-party network data (data retrieved from connected health data networks) provides:

These periods are measured from the unenrollment date or the last patient history query date, whichever is later. They apply to retained access to previously retrieved data; they do not provide ongoing network refreshes after enrollment ends.

An active relationship remains required. The access periods above do not override the loss of third-party access when your organization's Patient.active becomes false or null.

These are minimum access periods, not a promise that data will be deleted at day 30 or month 12. Unenrollment, loss of access, patient opt-out, and deletion are different actions. Your organization continues to have access to its own contributed data when its relationship with the patient becomes inactive.

Inactive is not an opt-out

Patient.active describes your organization's relationship with the patient. Setting your patient record to inactive ends your access to third-party and cross-organization data, but another organization with its own qualifying relationship can still access eligible data you previously contributed. See Common Patient Record within Zus.

Use the Patient Opt Out process when a patient requests an opt-out from the Zus Network. Once processed, the opt-out covers both sharing and retrieval from third-party networks.

Common scenarios

Related pages

• ZAP Data and Access
• Patient Monitoring & Chart Builds
• Network Requirements
• Common Patient Record within Zus
• Patient Opt Out