Electronic Health Information (EHI) Export

This documentation is published in satisfaction of the ten elements required by §170.315(b)(10): supported export types, instructions, authorized roles, no-charge statement, syntax and format, data dictionary, terms of use, implementation guides, physical-media statement, and ongoing maintenance.

1. Supported Export Types

Retinex Health supports two EHI export operations:

• Single-patient EHI export — complete export of all Designated Record Set (DRS) data for one patient, including structured C-CDA, human-readable HTML, print-friendly PDF, and original binary attachments.
• Patient-population EHI export — bulk export of the same DRS payload for many patients in a single password-protected 7z archive, one sub-folder per patient.

Both export types are self-service: an authorized user may run an export at any time without assistance from Retinex Health staff and without any developer involvement.

2. Instructions for Generating an Export

Single-patient export (UI)

1. Sign in to the Retinex application.
2. Open the patient’s chart.
3. Select Export → EHI Export (7z, encrypted).
4. The archive is downloaded to your browser. The decryption password is shown in the UI and (when the patient has an email on file) delivered to the patient by email.

Single-patient export (API)

GET /resources/patient/{patientId}/ccda
GET /resources/patient/{patientId}/ccda/html
GET /resources/patient/{patientId}/ccda/pdf
GET /resources/patient/{patientId}/ccda/sevenzip

All endpoints require a bearer token (JWT) and the ehi_export:write permission. The sevenzip endpoint returns an encrypted 7z archive containing CCDA.xml, CCDA.html, CCDA.pdf, the Attachment folder, a SHA-256 digest, and a README.txt referencing this page.

Patient-population export (UI)

1. Sign in as a System Administrator or Compliance Officer.
2. Navigate to Bulk Export.
3. Choose the organization, optional patient filter, and click Start Export.
4. The job processes asynchronously. When complete, a download link becomes available; an email notification is sent to the initiator.

Patient-population export (API)

POST   /resources/patient/ccda/bulk-export
GET    /resources/patient/ccda/bulk-export
GET    /resources/patient/ccda/bulk-export/{jobId}/status
GET    /resources/patient/ccda/bulk-export/{jobId}/download
POST   /resources/patient/ccda/bulk-export/{jobId}/retry

3. Authorized User Roles (RBAC)

EHI export is gated by the gateway’s RBAC layer (JwtAuthGuard + PermissionGuard with @ProtectModule(MODULES.ehi_export)). The ehi_export module exposes four actions: read, write, delete, full. The default role grants are:

Customers may further restrict or expand these grants through the Access Admin UI. Every export attempt is recorded in export_job and export_job_item with the initiating user, organization, timestamps, patient IDs, output URL, and final status.

4. No-Charge Statement

Retinex Health does not charge any fee for the EHI export capability described on this page. There is no per-export fee, no per-patient fee, no per-record fee, and no subscription fee. There is no fee to patients exporting their own records and no fee to a provider, organization, or successor system requesting a single-patient or patient-population export for the purpose of transition of care, system replacement, or audit. Access to this documentation, the schema, and the implementation guides referenced below is also provided at no charge.

Optional value-added services that go beyond the scope of (b)(10) — bespoke ETL, custom transformation, or third-party-system connectors — may be offered separately under a written agreement and, where applied, will conform to the Information Blocking Fees Exception (45 CFR 171.302).

5. Syntax and File Format Details

Archive

• Container: 7-Zip (7z) with AES-256 encryption, encrypted headers (-mhe=on), LZMA2 compression at level 9. Magic bytes 37 7A BC AF 27 1C.
• File naming: {PatientName}_{MRN}_{YYYY-MM-DD}.7z for single-patient and {Organization}_bulk_{YYYY-MM-DD}.7z for population.

Single-patient archive layout

PatientName_MRN_YYYY-MM-DD.7z
├── CCDA.xml                    HL7 C-CDA R2.1, UTF-8
├── CCDA.html                   HTML5, UTF-8
├── CCDA.pdf                    PDF/A-compatible
├── CCDA-SHA256-DIGEST.txt      SHA-256 digest of CCDA.xml
├── Attachment/
│   ├── manifest.json           ID, filename, MIME, size
│   └── {original files}        PDF, DICOM, JPG, etc.
└── README.txt                  Points to this documentation page

Patient-population archive layout

Organization_bulk_YYYY-MM-DD.7z
├── README.txt                  Points to this documentation page
└── {one folder per patient}/
    ├── CCDA.xml
    ├── CCDA.html
    ├── CCDA.pdf
    └── Attachment/

C-CDA XML

• Conforms to HL7 C-CDA Release 2.1 (US Realm Header).
• Code systems: LOINC (2.16.840.1.113883.6.1), SNOMED CT (2.16.840.1.113883.6.96), RxNorm (2.16.840.1.113883.6.88), CVX (2.16.840.1.113883.12.292), ICD-10-CM (2.16.840.1.113883.6.90).
• The CCDA document carries 25 sections, listed in the accompanying CCDA.html’s Table of Contents and detailed row-by-row in the Data Dictionary below.

6. Data Dictionary (Designated Record Set)

Every field stored by Retinex Health as part of the Designated Record Set (DRS) is included in the export. The DRS covers clinical records, scheduling, and attachments used to make decisions about an individual. Psychotherapy notes and information compiled for legal proceedings are excluded by HIPAA definition (45 CFR 164.501) and are not part of the export.

The authoritative, version-controlled data dictionary is the Prisma schema (backend-retinex/prisma/schema.prisma), regenerated on every release. A summary of the domains and their backing models is below; the full field-level dictionary is included in the in-repository document EHI-EXPORT-DOCUMENTATION.md, which is the long-form companion to this page.

The CCDA.html rendering that ships in every export archive contains the 25 sections listed below. Each row maps a CCDA section to the Prisma model(s) it is sourced from and the canonical code system(s) used.

Original binary attachments (PDF, DICOM, JPG, etc.) referenced from any of the above sections are included in the export archive’s Attachment/ folder alongside the CCDA, with a manifest.json listing ID, filename, MIME type, and size.

Data types

• String: UTF-8
• Date: ISO 8601 (YYYY-MM-DD); DateTime: ISO 8601 with Z
• Period: start + end (ISO 8601)
• Quantity: value + unit (UCUM — e.g. 120 mm[Hg])
• Coded value: system + code + display
• Identifier: system + value
• Reference: FHIR resource reference
• Boolean, Decimal, Integer: native
• Binary / Attachment: base64 or URL + MIME

7. Terms of Use

By generating, downloading, transmitting, or otherwise using an EHI export produced by Retinex Health, the requesting user, organization or recipient agrees to the following terms. These terms exist solely to satisfy HIPAA, federal privacy law, and the documentation requirement of §170.315(b)(10) — they do not impose any commercial restriction, license fee, or technical limitation that would constitute information blocking under 45 CFR Part 171.

1. Permitted use. The exported EHI may be used for any lawful purpose, including patient access (45 CFR 164.524), transition of care, treatment/payment/operations, business-associate activity under a valid BAA, third-party recipients designated by the patient, and population-level data migration.
2. Snapshot. The export reflects EHI as stored at the time of generation; the recipient is responsible for verifying critical clinical data and performing patient-identity reconciliation when importing.
3. HIPAA. The export contains PHI subject to HIPAA Privacy and Security Rules. Keep the archive and its decryption password separate; do not share with unauthorized parties.
4. No warranty. The export is provided AS IS and AS AVAILABLE for the purpose of satisfying §170.315(b)(10). Retinex Health disclaims warranties of merchantability and fitness for a particular purpose with respect to the exported file (but not its ONC/ASTP certification obligations, which remain in force).
5. No reuse restriction. Nothing in these terms restricts the recipient from importing the data into any other system, converting it to another format, transmitting it to a patient-authorized third party, or retaining a copy for as long as legally permitted.
6. Information-blocking acknowledgment. Retinex Health does not impose any practice that would interfere with the access, exchange, or use of EHI, except as required by law or permitted under a published exception (45 CFR Part 171).
7. Governing law. United States and the applicable state law of the operating customer. Nothing in these terms supersedes HIPAA, ONC/ASTP certification obligations, or the patient’s federal right of access.

8. Implementation Guides and References

Normative standards

• HL7 C-CDA Release 2.1 — HL7
• HL7 C-CDA Companion Guide R2.1 (and STU 4) — HL7
• HL7 FHIR R4 — hl7.org/fhir/R4
• US Core IG — hl7.org/fhir/us/core

EHI-export-specific implementation guides

• Argonaut EHI Export FHIR API Implementation Guide
• ONC/ASTP (b)(10) EHI Export Companion Guide
• ONC/ASTP (b)(10) EHI Export Fact Sheet
• Drummond Group (b)(10) Knowledge Base

Code systems and value sets

• LOINC (Regenstrief)
• SNOMED CT (US Edition) (NLM)
• RxNorm (NLM)
• ICD-10-CM (CMS / CDC NCHS)
• CVX (vaccine codes) (CDC)
• UCUM (units of measure)
• HL7 Terminology (THO)
• NUCC Provider Taxonomy

Regulatory references

• ONC/ASTP HTI-1 Final Rule — 89 FR 1192 (January 9, 2024)
• 45 CFR 170.315(b)(10) — EHI Export
• 45 CFR Part 171 — Information Blocking Regulations
• 45 CFR 171.302 — Information Blocking Fees Exception
• 45 CFR Parts 160 and 164 — HIPAA Privacy & Security
• 45 CFR 164.501 — Definition of Designated Record Set
• 45 CFR 171.102 — Definition of EHI

9. Physical Media

Not applicable. Retinex Health does not deliver EHI exports on physical media (USB drives, optical discs, magnetic tape, paper, etc.). All EHI exports are delivered electronically through one of the following channels:

1. Direct HTTPS download from the gateway API.
2. 24-hour pre-signed Azure Blob Storage URL delivered by email to the requesting patient or designated recipient.
3. Programmatic retrieval through the bulk-export job API for downstream systems.

If a customer organization independently copies the downloaded archive onto physical media for internal use, that handling is outside the scope of Retinex Health’s certified EHI export functionality and is the customer’s responsibility under their own HIPAA Security policies.

10. Up-to-Date Export Format Information

This page is the canonical, version-controlled documentation for Retinex Health EHI exports. It is updated whenever the export format changes. The link to this page is embedded in every export archive’s README.txt and in every patient notification email; both single-patient and patient-population exports point here.

Version history

Support

For technical assistance, missing data, or questions about a specific export:

• Email: support@retinex.ai
• Compliance & certification: support@retinex.ai