Skip to main content
Feature ID: CL-46 (publisher) ↔ PM-07 (subscriber) Status: 📝 Planned (pending CL-46 Phase 1 + compliance review) Spec Reference: CL-46-problem-list-management-icd10.md Last Updated: 2026-05-12

Table of Contents


Overview

CL-46 owns the longitudinal patient problem list (ICD-10-CM coded, status-managed: active, resolved, inactive, entered_in_error). Two downstream consumers depend on problem-list state:
  1. CL-08 (Clinical Decision Support) — re-evaluates rules (drug-disease interactions, monitoring, quality-measure gaps) when active problems change.
  2. PM-07 (Encounter Diagnosis Capture / Charge Entry) — pre-populates encounter diagnoses from the patient’s active problem list at encounter creation/check-in, so coders/clinicians do not re-enter chronic conditions.
Integration is event-driven (Pattern 2) for write notifications and read-API (Pattern 1, via @/platform/clinical) for synchronous lookups. No direct core-to-core imports.

Quick Reference


Integration Points


Event Contract: cl_problem_list_updated

Trigger

AFTER INSERT OR UPDATE OF status, icd10_code, resolved_date OR DELETE on cl_problems.

Payload (JSONB)

No PHI in payload. Patient name, DOB, narrative description are deliberately excluded; subscribers fetch via the read API under their own RLS context.

Action mapping

Subscribers


Cross-Core Read API

PM-07 (and any other consumer) MUST use the platform integration layer rather than querying cl_problems directly.
Server-side / edge functions call the SECURITY DEFINER helper:
The helper enforces pf_has_org_access(organization_id) and the cl.problems.read permission, returns only status = 'active' rows, and orders by priority ASC NULLS LAST, onset_date DESC.

Security and RLS

  • cl_problems has RLS enabled with FORCE ROW LEVEL SECURITY; all CRUD policies scope by organization_id via cl_user_has_problem_permission(action).
  • Cross-core reads from PM-07 execute under the calling user’s auth context — RLS still applies. The SECURITY DEFINER helper does not bypass tenant scoping; it only avoids the need for PM code to know CL table internals.
  • Event payload contains no PHI; consumers MUST re-fetch via the read API to obtain ICD-10 display text or clinician description.
  • Status state-machine enforcement (e.g., entered_in_error is terminal) is implemented in a BEFORE UPDATE trigger on cl_problems, not in the RLS WITH CHECK clause (which has no access to OLD).

Idempotency, Retry, and Ordering

  • Idempotency key: problem_id || ':' || action || ':' || changed_at (ISO-8601, millisecond precision). Subscribers MUST de-duplicate using this key for at least 24 h.
  • Ordering: Not strictly guaranteed across the domain_events channel. Subscribers MUST treat events as state notifications (re-fetch on receipt) rather than authoritative deltas.
  • Retry: PF event dispatcher retries with exponential backoff (per PF-70 event publishing standards). Failed deliveries land in the dead-letter queue after 5 attempts.
  • Backfill: On subscriber outage recovery, consumers may call the read API to reconcile state; no replay of historical events is provided.

Failure Modes