Microsoft produces outputs today where we attach security labels at the resource level (e.g. in our de-identification tool, and in our $export pipeline where de-identification options are configured).

We'd like the ability to provide security tags at the element level because different elements can be altered in different ways during de-identification process. For example, HIPAA Safe Harbor Method recommends that certain PII fields be REDACTED and first 3 digits of certain zip codes be MASKED. Current model of adding security tags at resource level does not cover this scenario.

We think this is a more general need, so we'd like a standard approach. We'd like to propose a new core extension that can be used to attach these security labels to any FHIR element, which would look something like

• URL: http://hl7.org/fhir/StructureDefinition/security-label
• Context: Element
• Value type: valueCoding
• Cardinality: 0..*