FHIR-Based Data Segmentation for Substance Use Disorders: Current Landscape and the Promise of Large Language Models

By Abhishek Singh Dhadwal, MS in Computer Science (Concentration: Biomedical Informatics) student , Arizona State University | Graduate Student Researcher – ASU SHARES

Introduction

People receiving care for substance use disorders (SUDs) need confidence that highly personal details are shared only with the right clinicians. In the United States, regulation 42 CFR Part 2 applies stronger privacy protections than HIPAA, so routine data exchange can become complicated when SUD information is involved [2]. FHIR (Fast Healthcare Interoperability Resources) helps by attaching security labels to individual data elements, letting software reveal or redact information according to patient consent. Recent advances in standards, open-source tooling and large language models (LLMs) suggest a future in which privacy can coexist with safe, coordinated treatment.

Where We Stand Today

Early segmentation projects such as SAMHSA’s open-source Consent2Share allowed patients to issue digital consents, yet rule-based logic often disagreed with clinicians on what counted as sensitive [4]. Most electronic health records therefore, still rely on a blunt visible-versus-hidden switch, losing nuance found in free-text notes. HL7’s Data Segmentation for Privacy (DS4P) value sets have existed for years, but real-world adoption has been uneven. As a result, clinicians sometimes remain unaware of critical SUD history, while patients fear accidental exposure.

The field has gradually moved from concept to execution during the last 12 months. Standards are clearer, consent engines are open-sourced and LLMs can both detect nuanced SUD language and generate valid FHIR output.

Momentum Over the Past Year

Modern FHIR consent engines

In February 2025, Lee and colleagues released an open-source consent engine that tags SUD entries with probabilistic sensitivity scores and stores patient choices in FHIR R5 Consent resources [1]. The engine plugs into common workflows through CDS Hooks, so segmentation happens automatically when clinicians open a chart.

The SHARES Project

At Arizona State University, the SHARES research team, led by Dr. Adela Grando and Dr. Preston Lee, contributed to the design and pilot testing of an open-source FHIR consent engine. They evaluated the tool with synthetic patient bundles, adjusted its sensitivity thresholds with clinician feedback, and shared observations that informed updates later adopted by the HL7 Community-Based Care and Privacy work group[7].

Standards gathering pace

The initial FHIR DS4P Implementation Guide was released by HL7 in 2024, offering a tried-and-true formula for security labels, secrecy codes, and policy references. [8]. Regulators have taken notice. In April 2025, the US Food and Drug Administration opened a docket exploring FHIR packages for real-world-data submissions, specifically asking how privacy labels should be handled [9]. Signals like these indicate that granular segmentation is moving from pilot status to mainstream infrastructure.

LLMs for better labeling

LLMs excel at spotting subtle language that fixed rules miss. A 2025 study showed that an off-the-shelf Flan-T5 model could assign DSM-5 SUD severity levels in veterans’ notes with higher recall than a handcrafted pipeline [5]. Another investigation used GPT-3.5 to extract tobacco, alcohol and drug-use snippets from discharge summaries; zero-shot prompts excelled at detecting spans while few-shot prompts improved status classification [6]. Once captured, these details can populate FHIR Condition or Observation elements, enriching decision support without added coding effort.

LLM-to-FHIR conversion

Researchers have also begun asking LLMs to emit complete, syntactically valid FHIR bundles. Delaunay and colleagues found that a two-step prompt strategy reduced hallucinations and improved resource mapping accuracy across eight FHIR types [7]. Such pipelines could let smaller clinics create standards-compliant records without writing custom interfaces.

Toward equitable sharing

The adolescent-privacy Shift task force reported that value sets for sensitive data remain immature, urging broader DS4P adoption [3]. Although Shift focuses on minors, the conclusion mirrors SUD needs: patients should decide who sees sensitive information, and technology must honor those decisions seamlessly.

Looking Ahead

Expect deeper interplay between LLMs and FHIR security labels. When a clinician types “relapsed on oxycodone last month,” an AI helper could suggest marking the sentence as SUD-confidential while also flagging the importance of opioid history for safe prescribing. Explainability will be critical: any AI that tags content must show its reasoning so patients and providers can correct mistakes.

Standards will evolve in parallel. An HL7 Security Labeling Service playbook is scheduled for ballot in 2025, and new guides are likely to bundle Part 2 scenarios with default label sets. Federal regulators have already harmonized HIPAA and Part 2 compliance timelines, setting February 2026 as the deadline for new notice-of-privacy-practice formats [2]. Open-source communities continue to modernize Consent2Share by exploring an FHIR-R5 upgrade branch and SMART-on-FHIR user interfaces [10].

Internationally, the modular design of FHIR and the transparency of LLM prompts mean the same toolkit can be localized for European GDPR or Australian rules. Low-resource clinics may find that an LLM-based mapper paired with an off-the-shelf consent engine offers the most affordable route to compliance.

Conclusion

The field has gradually moved from concept to execution during the last 12 months. Standards are clearer, consent engines are open-sourced and LLMs can both detect nuanced SUD language and generate valid FHIR output. Academic efforts prove that rigorous privacy protections can coexist with clinically useful data. If developers, regulators and clinicians continue to build on this progress, sensitive SUD information can move from “locked away” to “shared responsibly,” improving safety and trust for people living with addiction.

References
1. Lee P., Mendoza D., Kaiser M. et al. FHIR granular sensitive-data segmentation. Applied Clinical Informatics 16(1):156-166 (2025). DOI 10.1055/a-2466-4371. https://doi.org/10.1055/a-2466-4371
2. U.S. Department of Health & Human Services. Final rule: Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2). Feb 8 2024. https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html
3. Sarabu C., Sharko M., Petersen C., Galvin H. Shifting into action: from data segmentation to equitable interoperability for adolescents. Applied Clinical Informatics 14(3):544-554 (2023). DOI 10.1055/s-0043-1769924. https://www.thieme-connect.de/products/ejournals/html/10.1055/s-0043-1769924
4. Grando M.A., Sottara D., Singh R. et al. Pilot evaluation of sensitive-data segmentation technology for privacy. International Journal of Medical Informatics 138:104121 (2020). DOI 10.1016/j.ijmedinf.2020.104121. https://pubmed.ncbi.nlm.nih.gov/32278288/
5. Mahbub M., Dams G.M., Srinivasan S. et al. Decoding substance use disorder severity from clinical notes using a large language model. npj Mental Health Research 4:5 (2025). DOI 10.1038/s44184-024-00114-6. https://www.nature.com/articles/s44184-024-00114-6
6. Shah-Mohammadi F., Finkelstein J. Extraction of substance-use information from clinical notes: GPT-based investigation. JMIR Medical Informatics 12:e56243 (2024). DOI 10.2196/56243. https://medinform.jmir.org/2024/1/e56243/ 
7. Delaunay J., Girbes D., Cusido J. Evaluating the effectiveness of large language models in converting clinical data to FHIR format. Applied Sciences 15(6):3379 (2025). DOI 10.3390/app15063379. https://www.mdpi.com/2076-3417/15/6/3379 
8. HL7 International. FHIR Implementation Guide: Data Segmentation for Privacy (DS4P), Release 1 – STU Publication. 2024. https://build.fhir.org/ig/HL7/fhir-security-label-ds4p/
9. U.S. Food and Drug Administration. Exploration of HL7 FHIR for use in study data created from real-world data sources. Federal Register 90 FR 17067 (2025). https://www.federalregister.gov/documents/2025/04/23/2025-06967/exploration-of-health-level-seven-fast-healthcare-interoperability-resources-for-use-in-study-data
10. BHITS Project. Consent2Share open-source consent management platform. GitHub, accessed 23 Jul 2025. https://bhits.github.io/consent2share/