Configuring Rules
Rules define the PatientSecure events, such as Person Enrolled or Person Deleted, that can trigger PatientSecure to send messages. Messages can include HL7 outbound events or EMPI events.
Adding a Rule

An EMPI rule can be triggered under the following conditions:
- The registrar must take the matching action.
- If any filter is configured, at least one filter must be matched.
- For a location filter to match, at least one configured location must match.
-
For an identifier filter to match, at least one configured identifier must match.
When an action occurs that there is a rule configured for, such as adding a person, the EMPI service is notified of that event.
-
If the patient who triggered the rule has any of the configured EMPI identifiers for that system, the EMPI system is queried.
-
The EMPI system returns all of the known identifiers for that patient.
-
If any of the identifiers are patient identifiers that PatientSecure is aware of, they are added to the patient record.
-
If the identifier hasn't been added for the specified patient, and the EMPI-returned identifier is valid in at least one configured EMR, the identifier will be added to the patient record.
-
If another person has the identifier to be added, PatientSecure logs an error for now, and does not add the identifier.
-
Otherwise, if the identifier is mutable and the EMPI identifier has a different value, PatientSecure updates the identifier to that value.
-
To add an EMPI Event rule:
-
Click Add New Rule and select EMPI Event from the drop-down list.
-
Specify the following information:
-
Name. Enter a meaningful display name for the EMPI Event rule.
Recommended display names could be the EMPI name plus the trigger type.
-
Description (optional). Enter a meaningful description for the rule's use.
-
When this happens. From the drop-down list, select the action that triggers this rule.
For example, when a Person is enrolled.
One or more patient identifier filters may be applied to the rule to reduce the scope. To add a patient identifier filter:
-
Click Add/Edit filter to add a filter or to edit an existing one.
-
For locations, select Location, and select an Organization, Facility, or Department to filter by. Leave the box blank to filter by all.
-
For identifiers, select Identifier and select a patient identifier to filter by. Leave the box blank to filter by all.
-
Click Apply. A summary of the selected filters is displayed next to the Add/Edit filters link.
-
-
Select an external system to query from the Query this system drop-down list.
-
Click Add/Edit systems to add systems or edit existing ones.
- Click Save Rule.
-

HL7 Outbound rules must have patient identifiers configured to send within the HL7 message.
The Person Identified action is triggered by an Identification or a Verification.
To add an HL7 Outbound Event rule:
-
From the Admin Console menu, select Settings > Rules.
The Rules page opens.
-
Click Add New Rule and select HL7 Outbound Event from the drop-down list.
-
Specify the following information:
-
Name. Enter a display name for the HL7 Outbound Event rule.
-
Description (optional). Enter a meaningful description for the rule's use.
-
When this happens. From the drop-down list, select the action that triggers this rule.
-
For example, when a Patient Identifier is deleted.
-
The Person Identified action is triggered by both an Identification or a Verification.
When Patient Identifier Updated is selected, one or more patient identifier filters may be applied to the rule to reduce the scope.
-
With these conditions. Define optional filters that apply to this rule.
-
Click Add/Edit filter to add a filter or to edit an existing one.
-
For locations, select Location, and select an Organization, Facility, or Department to filter by. Leave the box blank to filter by all.
-
-
Click the Identifiers box to select specific patient identifiers, or leave the box blank for all, and click Apply.
A summary of the selected filters is displayed next to the Add/Edit filters link.
-
-
Send Patient Identifiers. Define which patient identifiers to send and where they should appear in the HL7 message.
-
Click Add/Edit Patient Identifiers to add patient identifiers or to edit existing ones.
Add or edit patient identifiers:
-
Click Add new.
-
Select the identifier from the Name drop-down list.
-
(Optional) Enter an ID in the Identifier Type ID box.
-
(Optional) Enter the name assigning authority in the Assigning Authority box.
-
Select a location from the Location drop-down list.
-
Select Required if the identifier must be defined.
When a matching action occurs, and the specified patient does not have required identifier to send, no HL7 outbound message is sent.
-
Click Additional Information to indicate additional information including:
-
Patient Identifier Length. Select or enter the desired identifier length using a number from 2 to 100. Identifiers that are shorter than this length will have leading zeros prepended to reach the desired length. Identifiers that are longer than this length will not be changed.
-
Send as Double Quotes. Click Send as Double Quotes to send values as double quotes.
NOTE: This option only applies to deletions when the HL7 system receiving the message requires this configuration.
-
If the selected ID is a PVID and the environment uses an EMPI, select an organization from the Linked Organization drop-down list.
To use linked organizations, you must enable the Organization Link ID setting, which allows a patient's records using different patient identifiers to be linked on the client when the palm scan matches.
When a patient is enrolled in one organization, PatientSecure queries the EMPI to determine it if can use IDs from other organizations and send the PVID to that organization. On subsequent visits to the other organization, the patient can be identified without having to perform the Link ID flow.
-
Click Add.
-
-
Click the √ (check mark) at the end of the row to save the patient identifier, or click x to remove it.
-
Click Add.
-
-
Exclude patients with no biometrics. Select to filter out HL7 messages for patients created without a biometric (the patient opted out of a biometric).
By default, this setting is not selected.
For non-Cerner EMRs, to track patients in your EMR that have enrolled a palm vein biometric, select this option when you configure your Person Enrolled and Person Deleted triggers.
-
When a patient opted out originally, and then later adds a biometric, the Person Enrolled event is sent at that point.
-
For a rule configured for the Person Enrolled trigger with biometric required, when a person is enrolled without a biometric, the HL7 message is not sent.
-
For a rule configured for the Person Enrolled trigger with biometric required, when a person is enrolled with a biometric, the HL7 message is sent.
-
For a rule configured for the Person Enrolled trigger with biometric not required, when a person is enrolled without a biometric, the HL7 message is sent.
-
For a rule configured for the Person Deleted trigger with biometric required, when a person without a biometric is deleted, the HL7 message is not sent.
-
For a rule configured for the Person Deleted trigger with biometric required, when a person with a biometric is deleted, the HL7 message is sent.
-
When the patient has more than one active biometric, the HL7 message is not sent. This scenario can occur when you are migrating to R-format biometrics, the type captured by the Gen 2 touchless authentication palm scanner.
-
-
-
To this destination. Select the HL7 outbound system to receive the HL7 message.
-
Click Add/Edit systems to add systems or edit existing ones.
-
-
Click Save Rule.
NOTE: The rule may take several minutes to take effect.
-

The table below includes HL7 outbound events and samples of their corresponding HL7 outbound messages:
Event | Sample HL7 Message |
---|---|
Person enrolled |
MSH|^~\&|PATIENTSECURE||{RECEIVING APPLICATION}|{RECEIVING FACILITY}|{DATETIME}||ADT^A31|||2.3\nEVN|A31|{DATETIME}|\nPID|1|{IDENTIFIERS}|{IDENTIFIERS}|{IDENTIFIERS}|{LAST}^{FIRST}||{DOB}|{GENDER}
|
Person identified |
MSH|^~\&|PATIENTSECURE||{RECEIVING APPLICATION}|{RECEIVING FACILITY}|{DATETIME}||ADT^A31|||2.3\nEVN|A31|{DATETIME}|\nPID||{IDENTIFIERS}|{IDENTIFIERS}|{IDENTIFIERS}|{LAST}^{FIRST}||{DOB}|{GENDER} |
Person deleted | MSH|^~\&|PATIENTSECURE||{RECEIVING APPLICATION}|{RECEIVING FACILITY}|{DATETIME}||ADT^A29|||2.3\nEVN|A29|{DATETIME}|\nPID||{IDENTIFIERS}|{IDENTIFIERS}|{IDENTIFIERS}|{LAST}^{FIRST}||{DOB}|{GENDER} |
Patient identifier updated | MSH|^~\&|PATIENTSECURE||{RECEIVING APPLICATION}|{RECEIVING FACILITY}|{DATETIME}||ADT^A31|||2.3\nEVN|A31|{DATETIME}|\nPID||{IDENTIFIERS}|{IDENTIFIERS}|{IDENTIFIERS}|{LAST}^{FIRST}||{DOB}|{GENDER}
|
Patient identifier deleted | MSH|^~\&|PATIENTSECURE||{RECEIVING APPLICATION}|{RECEIVING FACILITY}|{DATETIME}||ADT^A31|||2.3\nEVN|A31|{DATETIME}|\nPID||{IDENTIFIERS}|{IDENTIFIERS}|{IDENTIFIERS}|{LAST}^{FIRST}||{DOB}|{GENDER}
|
Photo updated | MSH|^~\&|PATIENTSECURE||{RECEIVING APPLICATION}|{RECEIVING FACILITY}|{DATETIME}||ADT^A31|||2.3\nEVN|A31|{DATETIME}|\nPID|1|{IDENTIFIERS}|{IDENTIFIERS}|{IDENTIFIERS}|{LAST}^{FIRST}||{DOB}|{GENDER}\nOBX|1|ED|IJL||^^JPG^BASE64^{BASE64 IMAGE} |
Photo deleted | MSH|^~\&|PATIENTSECURE||{RECEIVING APPLICATION}|{RECEIVING FACILITY}|{DATETIME}||ADT^A31|||2.3\nEVN|A31|{DATETIME}|\nPID|1|{IDENTIFIERS}|{IDENTIFIERS}|{IDENTIFIERS}|{LAST}^{FIRST}||{DOB}|{GENDER}\nOBX|1|RP|IJL||"" |
RECEIVING APPLICATION
and RECEIVING FACILITY
map to the HL7 Outbound settings in Setting Up External Systems
The HL7 outbound message templates can be modified by opening a Support ticket.

The HL7 outbound message tokens and data elements used in PatientSecure.
The tokens in the table below are replaced when they are encountered in the template.
Token | Description |
---|---|
{AUTHDATE}
|
The date of the patient authentication. |
{AUTHTIME}
|
The time of the patient authentication. |
{ENROLLDATE}
|
The date of the patient enrollment. |
{ENROLLTIME}
|
The time of the patient enrollment. |
{RECEIVING APPLICATION}
|
The receiving application. Maps to the HL7 Outbound settings in Setting Up External Systems |
{RECEIVING FACILITY}
|
The receiving facility. Maps to the HL7 Outbound settings in Setting Up External Systems |
{USERID}
|
The user ID of the registrar who initiated the workflow that generated the HL7 message. |
Template Example
MSH|^~\&|PATIENTSECURE|PatientIdentified-EnrollDate{ENROLLDATE}EnrollTime{ENROLLTIME}UserId{USERID}|{RECEIVING APPLICATION}|{RECEIVING FACILITY}|{DATETIME}||ADT^A31|||2.3\nEVN|A31|{DATETIME}|\nPID|1|{IDENTIFIERS}|{IDENTIFIERS}|{IDENTIFIERS}|{LAST}^{FIRST}||{DOB}|{GENDER}
Final HL7 Message
MSH|^~\&|PATIENTSECURE|TokenExamples-EnrollDate-20190102-EnrollTime-134720-UserId-636e8112-4992-4a3e-830c-7b0ace931888|
ReceivingApp|ReceivingFac|20190102084722||ADT^A31|||2.3/nEVN|A31|20190102084722|\nPID|1||2||Smith^Jane||19880715|F
Enabling or Disabling a Rule
Enable or disable a rule by toggling the Status setting ON or OFF.