The policy
Every HL7 message, ticket excerpt, article draft, and example in this repository is synthetic from birth — generated by the included message generator with fictional patients, fictional providers, and a fictional site.
Nothing here derives from production clinical data. Not raw, not scrubbed, not de-identified, not “based on” a real message with the names changed.
Why de-identified real data is also excluded
De-identification removes identifiers. It does not remove provenance.
A scrubbed production message still carries site-local code values in OBX and OBR fields, custom Z-segment structures, sending/receiving application and facility naming conventions, timestamp and control-ID patterns reflecting real system behavior, and order-volume characteristics. Any of these can fingerprint an organization, and several of them are exactly the details that make a message useful as a test fixture.
There is also a simpler argument: “this artifact was derived from production clinical data” is a sentence that should not appear anywhere in a public repository’s history, regardless of how thorough the scrubbing was. Generating from scratch removes the question rather than answering it.
What is generated, and how
The generator produces structurally valid ORM, ORU, ADT, and SIU messages with seedable output for reproducible test runs, plus a deliberately malformed set for negative testing — truncated segments, field-count mismatches, invalid code values, and out-of-sequence events.
Fictional identity data is drawn from an included name pool with no
correspondence to real individuals. Site details reference the fictional
example site profile in examples/, not any real institution.
The de-identification gate
Separate from the corpus policy, an ingress gate exists for the messages users paste in. It is deterministic script code — not an instruction asking a model to be careful — covering:
- PID, NK1, IN1, and GT1 segment scrub/synthesize
- A second pass over free-text fields (OBX, NTE) where identifiers commonly leak in practice
- Test coverage against the synthetic corpus, including cases with PHI deliberately planted in free text
Compliance reviewers can read the gate and its tests directly. That is the point of implementing it in code rather than in a prompt.
Contributions
Pull requests containing real clinical data — identified or de-identified — are closed without merge. Add test cases by extending the generator or contributing fictional fixtures produced by it.
Reporting a concern
If you believe anything in this repository derives from real patient data, please open an issue without including the data in question, and it will be investigated and removed.