GDPR Compliance: Deletion of a resource with its entire history.

[aignatovich]

What am I trying to achieve?
Implement GDPR compliance in one of 2 forms: deletion or anonymization of the data. Deleting is my default option of choice.

How am i trying to achieve it?
-Removing all the resources related to Patient, as well as _history. Removing of the history seems to be crucial, though process is not documented in the specification: https://www.hl7.org/fhir/http.html#history .

What am I having issues with?
-Removing _history records. I have encountered the article: https://learn.microsoft.com/en-us/azure/healthcare-apis/fhir/fhir-rest-api-capabilities which gave me some hope that hardDelete=true is supported with latest self-hosted fhir-server offering (and not just cloud offering). This is not the case. Conditional-delete operation seems to be applied by Fhir Server and 204 response code is returned, but resource is still present and i am able to query it.

Question
How I can achieve complete wipe-out of a resource with its history? Any suggestion?

[aignatovich]

$purge-history in combination with an individual resource removal did the job for me.

[EXPEkesheth]

@aignatovich - did $purge-history solve the issue for you? Also with conditional delete, did you pass in the parameter harddelete=true in the request?

When using conditionaldelete with harddelete flag, there should be a header "Items-Deleted" returned stating items deleted. This should confirm the number of records deleted.

[aignatovich]

@EXPEkesheth solution with harddelete=true did the trick for me, could avoid using $purge-history.