Reference architecture · current proposal

Let provenance travel with the clinical document.

Keep the EHR, FHIR interfaces, identity, access controls and clinical governance. Add a portable document layer that records lineage and lets a recipient verify an exact sealed state.

Reference flow

1. Source system: an EHR or other governed system creates a human-readable document from authorized clinical data.
2. Living state: a UDR records revisions, authorship assertions and addenda while the document changes.
3. Exchange context: FHIR DocumentReference, Composition, Provenance or another interface can reference and transport the document and its metadata.
4. Final state: an authorized workflow seals the exact bytes as a UDS. Signing-key trust and real-world identity remain separate checks.
5. Human handoff: BrowserCarrier presents the document offline without installation while preserving the embedded original.
6. Recipient verification: a compatible Reader verifies integrity locally; policy can separately evaluate signer trust, identity and current status.
7. Later correction: an addendum or amendment derives a new UDR and preserves the relationship to the prior sealed state.

Boundaries

• This is a reference architecture, not a production EHR integration.
• Integrity does not prove clinical accuracy, medical necessity or identity assurance.
• HIPAA compliance depends on the full implementation, organization and safeguards—not a file format.
• Public demonstrations use synthetic or de-identified content only.

Primary healthcare standards context

HL7 FHIR Provenance describes who, what and when for resource activity. FHIR DocumentReference indexes documents, and FHIR Composition defines a clinical document structure. UD is proposed as a complementary portable artifact, not a replacement for these standards.