Privacy and retention
Configure EDFlow privacy and access settings: patient and family access windows, sharing limits, the data profile, youth-confidential ages, results display delay, retention periods and de-identification.
Every privacy and access setting shows its allowed range and a plain explanation. Changes that reduce privacy need a typed confirmation and are audited with before and after values.
Access windows
How long patients and family keep read-only access after departure:
| Setting | Default | Allowed values | What it does |
|---|---|---|---|
access.patientGraceHours | 72 | 0–168 hours | How long patient access lasts after departure (D-05). (Reduces privacy) |
access.familyGraceMinutes | 120 | 0–1440 minutes | How long family links last after departure. (Reduces privacy) |
access.guardianAge | 16 | 0–18 age_years | Guardian mode applies below this age. (Reduces privacy) |
access.youthConfidentialAges.min | 12 | 10–18 age_years | Youngest age for youth-confidential mode (D-43). (Reduces privacy) |
access.youthConfidentialAges.max | 17 | 10–18 age_years | Oldest age for youth-confidential mode. (Reduces privacy) |
access.recipientPrompt | true | boolean | Triage asks who receives the card (D-43). (Reduces privacy) |
access.visitCodeSource | edflow | edflow, ehr_visit_number | Random codes or the EHR visit number (only with attested non-sequential numbers; never under minimal). (Reduces privacy) |
Sharing
| Setting | Default | Allowed values | What it does |
|---|---|---|---|
sharing.enabled | true | boolean | Patients can share with family. (Reduces privacy) |
sharing.maxLinks | 5 | 1–5 count | Active family links per visit. (Reduces privacy) |
sharing.maxDevicesPerLink | 3 | 1–5 count | Devices per family link (D-14). (Reduces privacy) |
| Setting | Default | Allowed values | What it does |
|---|---|---|---|
family.showPhotos | false | boolean | Care-team photos in the family view. (Reduces privacy) |
Data profile and masking
- Standard: patients sign in with last name, date of birth and an 8-character visit code.
- Minimal: a 10-character visit code only; patients type the first name they want to be called. Staff register initials.
| Setting | Default | Allowed values | What it does |
|---|---|---|---|
privacy.dataProfile | standard | standard, minimal | Data minimization profile (EHR §11.3). (Reduces privacy) |
privacy.maskConfidentialNamesOnBoard | true | boolean | Mask confidential names on the board. (Reduces privacy) |
Results
| Setting | Default | Allowed values | What it does |
|---|---|---|---|
results.displayDelayMinutes | 0 | 0–30 minutes | Delay before a completed result shows as "Back" to the patient. |
results.holdAllowed | true | boolean | Clinicians may hold results (D-29). |
Retention
| Setting | Default | Allowed values | What it does |
|---|---|---|---|
retention.operationalWindowDays | 30 | 7–90 days | Days PHI is kept before de-identification (F-21.2). (Reduces privacy) |
retention.auditDays | 730 | 730–3650 days | Audit log retention. (Reduces privacy) |
retention.analyticsDays | 730 | 365–2555 days | De-identified analytics retention. (Reduces privacy) |
retention.safetyRecordYears | 10 | 2–30 years | Retention of care records (D-36). (Reduces privacy) |
Safety records (requests, call-backs, pauses, the going-home summary) are kept for the safety-record period so the hospital can answer complaints and reviews. Analytics use de-identified rows with no link to a visit. Legal holds pause deletion. See Access requests and retention.
Related
Last updated on