change guidance to say: "The Provider publishes notifications when there are changes to the Task instance. Typically , the notification does not expose the data itself. The subscriber would then fetch the data using a FHIR RESTful query. clarify bullet point  in notes to say: "The publisher can not guarantee who has access to the nominated subscription endpoint.  By omitting the payload, the client is forced to authenticate before accessing the data which mitigates privacy and security risks on the publisher"