Record FHIR Provenance resources to attribute EHR write-back data and document data lineage

In-depth guide

Steps

1. After creating or updating a clinical resource (e.g., Condition, Observation) via a FHIR write operation, create a Provenance resource to document the creation event
2. Set Provenance.target to reference the newly created or updated resource (e.g., Condition/123); Provenance.target can be a list if multiple resources were created in a single activity
3. Set Provenance.recorded to the timestamp of the write event; set Provenance.activity to a code from the FHIR activity type value set (e.g., CREATE, UPDATE) using the http://terminology.hl7.org/CodeSystem/v3-DataOperation system
4. Populate Provenance.agent: add at least one agent with agent.type='author' (the person or system that created the data) and agent.who referencing the Practitioner, PractitionerRole, or Device; add a second agent with agent.type='informant' or 'transmitter' if the data came from an external system
5. For US Core Provenance compliance, set agent[transmitter].who to the Organization that transmitted the data (the 'last hop'); US Core Provenance focuses on organizational-level attribution using the us-core-provenance profile
6. Store the Provenance resource on the FHIR server via POST /Provenance; later retrieve it using GET /Provenance?target=<resource-reference> to audit who created or modified a given resource