OHDSI Home | Forums | Wiki | Github

PII Exposure by WebAPI

CDM Builders
#1

Hello everyone,

I’ve recently implemented WebAPI and Atlas (2.0 is looking nice!). One concern we have before moving our WebAPI/Atlas instances to a production server is whether the WebAPI in any way exposes the individual patient information from the CDM, and if it has any way to submit a custom DB query from the client-side (which we don’t want). Is everything entirely based on server-side scripts and stored procedures?

Thank you,
Harris Weinstein

#2

There is a patient profile viewer which will extract the patient level data to present a timeline of events that occurred on a patient.

The closest thing to a custom DB query is the cohort definitions that lets you create queries based on specific criteria rules against specific tables. However, the results are stored local the the target CDM and only summary counts are returned to the client via WebAPI.

t