Medical data provenance explained

What provenance records on every write to a FHIR R4 record — author type, person, organisation, source system, versions — how to set it with headers, how to read it, and how it labels data given to AI models.

Provenance is the record of where a piece of medical data came from: who wrote it, on behalf of which organisation, from which system, when, and what changed in each version. In a record that collects data from patients, devices, clinics, laboratories and AI, provenance is what makes a value trustworthy: a blood-pressure reading typed at home and one measured in a clinic look identical without it. In Anpheros every write to an HL7 FHIR R4 record produces a FHIR Provenance resource automatically. This page explains what it contains, how to fill it in correctly and how to read it.

Why provenance matters

Clinical trust. A doctor weighs a laboratory result differently from a value the patient entered or a number an AI extracted from a photo.
AI safety. A model given a record has to know which items are facts and which are notes another model wrote. Without labels it treats them the same.
Corrections and disputes. When a value changes, everyone needs to know what it was before, who changed it and why.
Accountability. Under GDPR and the European Health Data Space, an organisation must be able to show what it did with a person's health data.
Sharing. When a patient lets a second clinic read their record, that clinic needs to know which data the first clinic wrote.

What Anpheros records on every write

Question	Where it is recorded	How you set it
What kind of author?	`agent.who.identifier` (author type)	`author_type` in `/v1`, or `X-Anpheros-Author-Type` header: `patient`, `practitioner`, `device`, `import`, `ai`
Which person?	`agent.who.reference`	`X-Anpheros-Author-Ref: Practitioner/<id>`, or `X-Anpheros-Acting-As`
For which organisation?	`agent.onBehalfOf`	the organisation of the `PractitionerRole`, or `X-Anpheros-On-Behalf-Of: Organization/<id>`
From which system?	`entity` with role `source`	`X-Anpheros-Source-System: <name>`
Which record in that system?	origin id	`X-Anpheros-Origin-Id: <id>`
When, and what happened?	`recorded`, `activity` (CREATE, UPDATE, DELETE)	automatic
Which version?	`target` points to `<Resource>/<id>/_history/<version>`	automatic

If you do not say who the author is, the platform records import. It never assumes patient, because a value wrongly attributed to the patient is worse than one honestly labelled as imported.

A write with full provenance

A cardiologist at a clinic records a heart rate during a visit, through the clinic's software:

curl -X POST https://platform.anpheros.com/fhir/R4/Observation -H "Authorization: Bearer $KEY" \
     -H "Content-Type: application/fhir+json" \
     -H "X-Anpheros-Author-Type: practitioner" \
     -H "X-Anpheros-Acting-As: PractitionerRole/$ROLE" \
     -H "X-Anpheros-Source-System: ccn-emr" \
     -d '{ "resourceType": "Observation", "status": "final", "code": {"coding": [{"system": "http://loinc.org", "code": "8867-4"}]}, … }'

The Provenance the platform writes:

{"resourceType": "Provenance",
 "target": [{"reference": "Observation/8660eb7c-…/_history/1"}],
 "recorded": "2026-10-12T20:41:47.469000Z",
 "activity": {"coding": [{"system": "http://terminology.hl7.org/CodeSystem/v3-DataOperation", "code": "CREATE"}]},
 "agent": [{"type": {"coding": [{"system": "http://terminology.hl7.org/CodeSystem/provenance-participant-type", "code": "author"}]},
            "who": {"reference": "PractitionerRole/e6d8c227-…",
                    "identifier": {"system": "https://anpheros.com/fhir/CodeSystem/author-type", "value": "practitioner"}},
            "onBehalfOf": {"reference": "Organization/c3a56a4b-…", "display": "Clinica Cardio Nord"}}],
 "entity": [{"role": "source", "what": {"identifier": {"system": "ccn-emr"}}}]}

The doctor's role, their clinic, the kind of author and the source system are all there, in standard FHIR. The PractitionerRole must exist in your project's directory and be active. A request naming someone else's practitioner is refused:

{"resourceType": "OperationOutcome", "issue": [{"severity": "error", "code": "invalid",
  "diagnostics": "Unknown or inactive Practitioner in X-Anpheros-Acting-As."}]}

Setting up the directory is covered in How to integrate clinic systems with a FHIR backend.

Versions: nothing is silently overwritten

Each update creates a new version of the resource and a new Provenance for it. After the heart rate above is corrected from 92 to 88:

curl https://platform.anpheros.com/fhir/R4/Observation/$OBS/_history -H "Authorization: Bearer $KEY"

returns version 2 (88) and version 1 (92). The REST view summarises the Provenance of each version:

curl https://platform.anpheros.com/v1/patients/$PID/provenance/Observation/$OBS -H "Authorization: Bearer $KEY"

{"data": [
  {"version": 1, "activity": "CREATE", "recorded": "2026-10-12T20:41:47.469000Z", "author_type": "practitioner", "source_system": "ccn-emr", "fhir": "Provenance/6ed91529-…"},
  {"version": 2, "activity": "UPDATE", "recorded": "2026-10-12T20:41:47.500000Z", "author_type": "practitioner", "fhir": "Provenance/3fbf270f-…"}],
 "total": 2}

Deletions are soft: a deleted resource disappears from searches, but its history and Provenance remain.

Reading provenance

# who wrote this resource (all versions)
GET /fhir/R4/Provenance?target=Observation/{id}
# everything a practitioner recorded
GET /fhir/R4/Provenance?agent=PractitionerRole/{id}
# the same, summarised, per resource
GET /v1/patients/{pid}/provenance/Observation/{id}

Provenance in AI contexts

The context API carries provenance into every item it gives a model, as author_type and source. In text form:

- Type 2 diabetes mellitus (E11), active, onset 2024-10-15 [import/anpheros-sandbox]
- Metformin 1000 mg 1 tablet twice daily with meals, active [patient/anpheros-sandbox]
- Glucose [Mass/volume] in Blood: 2026-09-16: 140.0 mg/dL [device/anpheros-sandbox]

Measurements written with author_type: ai never appear among these facts. They are listed separately under ai_notes and marked as not verified, so a model cannot mistake an earlier model's guess for a measurement. Tell the model what the labels mean and ask it to cite them; How to build an AI healthcare app with a FHIR backend shows a prompt that does.

What the patient sees

Provenance is also what the patient sees. Their record shows who added each item, and their connections list shows, for each application, who accessed what, by name when a practitioner was acting ("Dr. Ana Popescu · Clinica Cardio Nord read your lab results"). See Consent and access model.

Rules that make provenance useful

Always set the author type. It costs one field and is the most important label in the record.
Name the person when a person wrote it. Use X-Anpheros-Acting-As for clinical staff.
Name the source system, and pass the source's own id as the origin id when there is one.
Correct by updating, never by deleting and re-creating. An update keeps the link between the old and the new value.
Label AI output as ai, including values a model extracted from a document. Values derived from a document can also point back to it with derived_from.

Frequently asked questions

What is data provenance in healthcare?

The documented origin and history of a piece of health data: who created or changed it, on whose behalf, from which system and when. In HL7 FHIR it is represented by the Provenance resource, which points to the exact version of the resource it describes.

Is provenance the same as an audit log?

No. Provenance describes the data: who wrote each version. An audit log describes access: who read or wrote what, when, under which consent. Anpheros keeps both; the patient sees the access log for every application connected to their record.

Can I write my own Provenance resources?

Anpheros writes one for every create, update and delete, so you normally do not. Use the headers above to make it precise. A client-supplied Provenance must target resources of a single patient.