Content rules
These rules protect patients, contributors, and the organisations they work for. Submissions that break them are not merged.
Never include
Section titled “Never include”- Patient data of any kind — names, dates of birth, medical record numbers, addresses, phone
numbers, or anything else that could identify a patient, even partly. Use
Synthea data or a vendor’s public sandbox, and make
example ids obviously fake (
patient-123). - Credentials — client ids, client secrets, private keys, access tokens, or internal URLs.
- Customer or health-system names tied to how their environment behaves.
- Vendor documentation copied in — many EHR developer programmes restrict republishing their documentation. Describe what you observed in your own words and link to the vendor’s page.
Screenshots
Section titled “Screenshots”Avoid screenshots of EHR screens. They are the easiest way to leak patient data, and vendor terms often restrict sharing images of their software. Describe the navigation in text instead (“Admin → Integrations → FHIR apps”). Screenshots taken in a public vendor sandbox may be accepted after review.
Write about behaviour you observed
Section titled “Write about behaviour you observed”Good recipes say what the EHR actually did — “returns HTTP 400 without a patient parameter”,
“returns 10 results per page by default” — and when you last saw it happen. Set lastVerified to
the date you last confirmed the recipe works.
If something slips through
Section titled “If something slips through”If you spot patient data or a credential on the site, email [email protected] straight away so it can be removed from the site and from its history.