Add to privacy and security page:   Confidentiality: In some cases when soliciting data, it may be important to transmit the level of confidentiality protection afforded information by policy.   In the US, if the level of confidentiality protection required for some/all of the information requested by a data consuming system is more stringent than the "default" confidentiality protection provided for HIPAA PHI, then the data source needs to be able to make decisions about whether to provide the information at all or whether to filter the information.  Specifically, if the level of confidentiality required for some of the information requested is more stringent than the data consuming system is authorized to receive, then the data source would need to either deny access entirely or segment the information such that the consuming system can only access the information to which it is authorized.  There is work in progress ( [link to SMART fine-grained access project] )  and the  FHIR Data Segmentation for Privacy IG  on standardizing how the requested information's confidentiality can be conveyed using OAuth.  Once a suitable approach has been agreed upon and published, it will be referenced in a future version of this guide.  In the interim, implementers should consult with their compliance department to determine what requirements exist and how best to satisfy them, whether with in-band or out-of-band communications.