E15 — Cross-system identity & mobility

[Taleef7]

Epic E15 — Cross-system identity & mobility

Goal: Handle a person existing in multiple provider databases/systems (a provider-database selector), duplicate reconciliation (the DUPLICATE badge), and mobility (employee moves country; patient moves provider/oncologist) so compliance history follows the person.

Why it matters (Doug, June 15): "provider database dropdown (same employee in two different systems)" · "expatriate might move from one country to another" · "someone might move from one oncologist to another" · the DUPLICATE badge in vamsi4.png; employee search in vamsi5.png. WorkWell assumes a single directory; reality is many systems + moving people.

Acceptance

• An identity model that resolves one person across >=2 source systems (provider-DB selector in the UI; deterministic match/merge keys).
• Duplicate detection + reconciliation surface (flag + resolve), audited.
• Compliance history is continuous across a documented move (country / provider change) for a sample subject.

Notes

• Pairs with E12 (multi-source adapters) and E13 (multi-tenant). Largely design-first; identity matching is sensitive — conservative, auditable, human-in-the-loop. Owner-gated for schema.

Dependency: E12, E13.

[Taleef7]

Status (2026-07-07): PR-1 + PR-2 delivered; PR-3 blocked. Keeping open for PR-3.

• PR-1 (feat(identity): E15 PR-1 — cross-system person identity (resolution, duplicates, mobility) #223): cross-system person identity — read-time resolvePeople/duplicateCandidates/mergedComplianceTimeline (deterministic shared-identifier match key = the EMPI seam), DUPLICATE surface, mobility annotation; GET /api/identity/{people,people/:id,duplicates} + the /people route. No schema, no count change (synthetic nationalId/dateOfBirth on two existing twh↔ihn pairs).
• PR-2 (feat(identity): E15 PR-2 — reconcile write path (owner-approved person_links) #224) + merge-picker (feat(identity): E15 reconcile merge-picker (CONFIRM_LINK UI) #225): the reconcile write path — the owner-approved person_links table (first E15 schema, floor+ceiling), override-aware resolvePeople (union-find: CONFIRMED unions / BROKEN splits), POST /api/identity/people/:id/reconcile (CASE_MANAGER/ADMIN, audited IDENTITY_LINK_*), + the CONFIRM_LINK merge-picker UI.

Remaining — PR-3: real WebChart identity sources. Blocked on E12 PR-2c (live WebChart HTTP transport / the MIE FHIR API contract). Today identity resolves over the synthetic directory; PR-3 swaps in real cross-system records once the WebChart source is live. Match-don't-auto-merge stays the invariant. Descriptive only (ADR-008/ADR-022).

[Taleef7]

PR-1 (#223) + PR-2 (#224/#225) merged — read-time identity + reconcile write path live. Remaining: PR-3 (real WebChart identity sources), gated on E12 PR-2c (new issue #262). Pre-work available now: map patient_mrns (partition wc_partition, multiple MRNs per patient) onto the matchKey seam using dev-DB fixtures — can start once the fixture corpus expansion (M1 issue #259) lands. Questions doc Q11 (enterprise master-person id) feeds this.