Is there any validation on identifier strings for searches?

[Carl Marshall]

Whilst trying to determine how to do a search in our non-Prod Ignite system for an NHS Number (still not got a working query at time of writing), I discovered that I could put in any kind of rubbish in the identifier field, and get a 200 OK response.

For example:

https://fhir-ehr.eu.cerner.com/r4/NON-PROD/Patient?identifier=https:%2F%2Fthis.is.fake.com%2F%7C7740594454

and I get back a:

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: application/fhir+json; charset=utf-8

Date: Wed, 29 Sep 2021 20:09:32 GMT

Etag: W/"05e49355903263046db9988601990aa7"

Server-Response-Time: 2629.1545969999997

Vary: Origin

X-Request-Id: c60222c285a66c9ee1787fe9db098546

X-Runtime: 2.628818

Transfer-Encoding: chunked

Connection: close

{"resourceType":"Bundle","id":"c4749153-c6e3-4c10-829a-cd19883152fe","type":"searchset","total":0,"link":[{"relation":"self","url":"https://fhir-ehr.eu.cerner.com/r4/NON-PROD/Patient?identifier=https%3A%2F%2Fthis.is.fake.com%2F%7C7740594454"}]}

This behaviour seems highly incorrect, and given the propensity to give back 422 Unprocessible responses for almost every issue under the sun, I would have much preferred to find that invalid and unsupported identifier searches were being screened and rejected that way, rather than blandly returning zero results.

Can anyone explain the logic behind this please?

Regards,

Carl

[Fenil Desani (Cerner)]

Hello Carl.

Technically, the request is fine but there were no patients matched for that identifier and hence a 200 with empty bundle.

In future, if you were to create a system with that URL and had a patient identifier associated with that, it would yield results.

Thanks,
Fenil