"If information is privacy restricted, the information SHOULD be treated as if it does not exist. The provider SHOULD ask the patient if they want to share the information with the payer."

This seems like guidance that belongs in a security/privacy section.  However, it's not complete/sufficient:

• should be pointing to the HRex security/privacy page as a foundation
• should be addressing the fact that data is going to be auto-populated that may be sensitive - so there may be a need for a human to review and confirm that the information is appropriate to be shared (and be able to remove it without risk of it being put back if they wish)
• that the app may not have access to certain data for retrieval because of security considerations
• whether 'hidden' or 'readOnly' questions are allowed - and if so, what constraints there are on what they contain
• other things?