Applications mustn't receive information for which they are not authorized. It's incumbent upon the Hub to enforce authorization.  For example, a subscriber without authorization to access Observation resources, shouldn't receive Observations as part of a DxReport-update event. This is interestingly mitigated because FHIRcast's typical use-case is that the same user is using the various apps.  We will update the security section in the specification to state (editorial discretion): Authorization to receive and send events is checked upon subscription. FHIRcast hubs are not required to enforce access restrictions on FHIR resources included in events. FHIRcast assumes that applications can only access and share content the user is allowed to access.