SHARES Consent Engine (FHIR + CQL)

Deterministic, auditable segmentation of sensitive health data using FHIR, CQL, and patient consent rules.

Why I Built This

Healthcare policy and software implementation are often misaligned, especially for sensitive data sharing. I built this engine to make consent logic explicit, testable, and repeatable so policy intent can be enforced at runtime with clear provenance. The motivation came from seeing how often privacy protections fail when rules are implicit or inconsistently applied.

Engine Capabilities

  • Loads configurable sensitivity rules with contextual metadata.
  • Evaluates relevant consent context for each invocation.
  • Emits sensitivity decisions and applies redaction when configured.
  • Supports CDS Hooks-style invocation patterns and FHIR-aligned processing.

Implementation Notes

Designed as a stateless service pattern with container-friendly deployment and CQL helper tooling for artifact workflows.

Research Outcome

The SHARES evaluation covered 11,519 synthetic patient records and 197.6 million FHIR resources across 11 confidentiality thresholds. The engine processed about 18,900 resources per second on a standard laptop, with each full segmentation run costing less than one cent.