Form / Submission

Instrument identity, version lineage and publication state

The instrument carries a canonical identifier plus business identifiers, an ordered version string with a declared ordering algorithm, a publication status, an experimental flag, an effective period and approval/review dates. Submissions bind to a specific version, so version identity is a correctness requirement, not metadata hygiene.

1. Which identifier is authoritative for this form definition: the issuing authority's official form number, a governed canonical URI, or a locally minted UUID? identity
2. How is a substantive new version distinguished from an editorial correction, and which algorithm orders versions? lifecycle
3. In which publication state is the instrument, and during exactly which period may it accept new submissions? state
4. Which authority owns the instrument and may approve or retire a version? authority

Item tree and link identifier contract

Items form an ordered, nestable tree of groups, display elements and answerable questions. Each item carries a link identifier that is the sole contract between definition and response; FHIR makes item.linkId mandatory on every response item and requires the response structure to stay consistent with the definition's grouping and nesting.

1. Is each item's link identifier unique within the instrument and immutable across the version lineage, and is reuse for a different question forbidden? identity
2. How are groups, repeating groups and display-only items distinguished from answerable questions? classification
3. Must the response tree mirror the definition tree exactly, including nesting and sibling order? composition
4. Is the presentation and transmission order of items semantically significant for interpretation or for legal completeness? constraint

Answer datatypes and value domains

Each answerable item declares a value type and a permitted value domain: a governed code list, an enumerated option set, numeric bounds, string length and pattern, or a unit-bearing quantity. Whether free text may accompany or replace coded options is itself a declared mode.

1. Which datatype system defines the permitted value type for each item, and is it declared in the instrument or inherited from a schema? definition
2. Is the answer restricted to a governed value set, and may free text be supplied alongside or instead of a coded option? constraint
3. For quantity answers, which unit of measure and which precision or significant figures are required? measurement
4. Which value-domain rules are declared in the instrument versus enforced only by the receiving system, and is any format keyword treated as an assertion rather than an annotation? validation

Conditional enablement and derived values

Items may be enabled by conditions over other answers with a declared combination behaviour, may be read-only or computed, and may be irrelevant. XForms prunes irrelevant nodes at serialization, so relevance directly changes what is transmitted and therefore what is validated and retained.

1. Under what conditions is each item enabled, and how are multiple conditions combined? constraint
2. Are values for disabled or irrelevant items pruned from the transmitted payload, retained as explicit nulls, or retained with a coded reason? composition
3. Which items are computed rather than entered, and is the computation re-evaluated authoritatively by the receiver at submission time? process
4. How are dependency cycles among conditional and calculated items detected, and is a cyclic instrument rejected at publication? exception

Regulatory notice block and burden statement

Where a collection is regulated, the instrument must display specified content on the form itself: the authorising authority, whether response is mandatory or voluntary, the principal purposes and routine uses, the effects of not responding, a currently valid control number with its expiration, and an estimated burden. These are properties of the instrument, and an expired control number invalidates the collection rather than merely the paperwork.

1. Which statutory or delegated authority permits or compels this collection, and is response mandatory, voluntary, or required to obtain a benefit? authority
2. What control number and expiration date are displayed, and how are submissions received after expiry handled? requirement
3. What are the stated principal purposes and routine uses of the collected data, and where are they published? privacy
4. What per-respondent burden is estimated, how was it derived, and what evidence of practical utility supports the collection? measurement

Submission identity and instrument version binding

A submission carries the receiving authority's identifier, the submitter's own reference and, where neither exists, a locally minted UUID/ULID. It binds to exactly one instrument version; FHIR makes that canonical reference mandatory. Drafts created against a version that is later superseded are the sharp edge: the binding must either be pinned or explicitly migrated with a recorded decision.

1. Which identifier is authoritative for this submission: the receiving authority's receipt or filing number, the submitter's own reference, or an internally minted UUID? identity
2. To exactly which instrument version is this submission bound, and is that binding immutable once the submission leaves draft? relationship
3. What happens to an in-progress draft when the bound instrument version is superseded or retired? exception
4. What is this submission about, and which prior request, order or submission is it based on or part of? relationship

Answer set composition and missingness semantics

An item may carry several answers and groups may repeat, so the payload is a tree, not a map. RFC 7578 forbids coalescing identically named parts and asks that ordering be preserved. The hardest distinction is missingness: not asked, disabled by logic, asked and left blank, not applicable, and declined are five different facts that a single absent key cannot express.

1. How are multiple answers to one item and repeated groups represented so that duplicates are not collapsed and occurrence identity is preserved? composition
2. How is not asked distinguished from disabled by logic, left blank, not applicable and declined to answer? definition
3. Is the transmitted order of answer entries semantically significant, and must it be preserved through every projection? constraint
4. Is a partial payload a valid instance, and which items may be absent while the package remains well-formed? state

Attachment parts and supporting evidence

Files accompanying the answers carry field name, filename, media type, character encoding and size. ECF distinguishes lead from connected documents and prefers a binary URI reference over inline base64; RFC 7578 requires receivers to validate filenames against traversal attacks.

1. Which attached document is the lead document and which are connected or supporting, and does that role affect adjudication? classification
2. What filename, media type, character encoding and size limits apply, and how are unsafe or ambiguous filenames neutralised on receipt? security
3. Is the attachment carried inline in the package or referenced by URI, and which party guarantees its continued availability for the retention period? interoperability
4. What integrity value is recorded so the attachment can later be proven unaltered and reproduced as an accurate and complete copy? evidence

Constraint model and validity states

Constraints are declared on items and produce specific validity states on failure (value missing, type mismatch, pattern mismatch, too long, too short, range underflow/overflow, step mismatch, bad input, custom error). Crucially, elements can be barred from constraint validation - disabled, read-only or irrelevant items never block submission - and a novalidate/validate=false path exists by design for saving incomplete work.

1. Which constraint is declared on each item and which validity state does its failure produce? validation
2. Which items are barred from constraint validation because they are disabled, read-only or irrelevant, and therefore never block submission? exception
3. Is a declared format treated as a non-blocking annotation or as an enforced assertion, and who made that choice? validation
4. May validation be deliberately bypassed to save an incomplete draft, and under whose authority is the bypass recorded? authority

Validation tiers and authoritative revalidation

Validation occurs at several tiers: declarative in-form checks, receiver structural revalidation, and business or eligibility rules applied later. Only one tier can be authoritative. 21 CFR 11.10(a) requires validated systems able to discern invalid or altered records, and ECF has the court validate on receipt before docketing - so the receiver, not the client, decides.

1. When the sending and receiving systems disagree on validity, whose verdict is authoritative and how is the disagreement recorded? authority
2. Is the full constraint set re-evaluated on receipt, and against which instrument version - the bound one or the current one? validation
3. How is a validation outcome recorded so it can be replayed and audited after rule sets have changed? evidence
4. What is the disposition of a payload that passes structural validation but fails a business or eligibility rule? decision

Submission status model

FHIR defines a required status value set (in-progress, completed, amended, entered-in-error, stopped) and marks status as a modifier element - status changes how the content may be interpreted, not merely how it is displayed. ECF tracks review status and docketing status separately, plus per-document statuses, precisely because a filing can be accepted for review yet fail to record.

1. What is the current status of the submission, and is status a modifier that changes how the payload may lawfully be used? state
2. Are review status and recording or docketing status tracked separately, and what does it mean when they disagree? state
3. Is status tracked per item or per document as well as per submission, and does a part-level rejection reject the whole? composition
4. Which status values mean the content must not be used for clinical, legal, statistical or operational purposes? exception

Transition rules and sequencing controls

Not every status pair is a legal transition. 21 CFR 11.10(f) requires operational system checks that enforce permitted sequencing of steps and events, and 11.10(g) requires authority checks so only authorised individuals may perform an operation - together these make the transition table an enforced control, not documentation.

1. Which status transitions are permitted, which are terminal, and what precondition guards each one? lifecycle
2. What operational system check prevents steps from being performed out of order, for example signing before validation completes? process
3. Which role is authorised to trigger each transition, and how is that authority checked at execution time? authority
4. May a submission in a terminal state be reopened, and what record must that create? exception

Decision outcome and reason codes

An adjudication records who decided, under what authority, the coded outcome, a human-readable explanation and any remediation instruction. ECF returns an error code with zero meaning success and notifies review completion asynchronously. Whether acceptance backdates to original receipt is a substantive legal question, not a storage detail.

1. Who reviewed the submission and under what delegated authority did they accept, reject or return it? authority
2. Which coded reason and human-readable explanation accompany a rejection or return, and are they drawn from a governed code list? decision
3. Can a submission be partly accepted, and what is the status and disposition of the unaccepted parts? exception
4. Does acceptance take effect from the original receipt time or from the decision time, and which governs any deadline? temporal

Amendment, withdrawal and resubmission

Corrections after submission are not edits. FHIR distinguishes amended from entered-in-error; CDISC requires an audit record with a reason for change on updates; 21 CFR 11 requires that changes not obscure previously recorded information. The choice between amending in place with version history and creating a superseding submission is a governance decision that must be declared.

1. Is a correction recorded as a new version of the same submission or as a new submission that supersedes the prior one, and who decided that convention? lifecycle
2. What explicitly links a resubmission to the rejected or withdrawn submission it replaces? relationship
3. Is superseded or entered-in-error content retained and retrievable, and how is it excluded from downstream use without being destroyed? retention
4. Who may withdraw a submission and up to which point in the lifecycle? authority

Respondent, author and submitter roles

FHIR keeps source (who answered), author (who recorded) and subject (who the answers are about) as three separate elements, and ECF adds a filer/sender distinct from all three. Assisted or proxy completion, interviewer-administered forms and agent-filed packages all produce different combinations, and the difference is legally material.

1. Who supplied the answers, who recorded them and who transmitted the package, and are any of these the same party? ownership
2. Is the submission made on behalf of another party, and what evidence establishes that representation? authority
3. At which site, organisational unit or jurisdiction was the data captured, and does that affect which rules apply? spatial
4. What identity proofing or authentication was performed on the submitter before the package was accepted? security

Declaration and signature manifestation

21 CFR 11.50 requires a signed record to carry the printed name of the signer, the date and time of signing, and the meaning of the signature (review, approval, responsibility, authorship); 11.70 requires the signature be linked so it cannot be excised, copied or transferred. The declaration text the signer accepted must be retained verbatim, not regenerated from a current template.

1. What exact declaration or certification text did the signer accept, and what meaning is attached to the signature? evidence
2. By what method was the record signed, and how is the signature bound to this exact payload so it cannot be excised or transferred to another record? security
3. What identity assurance and authority check were performed before the signature was accepted? security
4. Is the signature manifestation reproducible in human-readable form on any export or printed copy? interoperability

Audit record and reason for change

21 CFR 11.10(e) requires secure, computer-generated, time-stamped audit trails that independently record the date and time of operator entries and actions that create, modify or delete records, without obscuring prior values. CDISC pairs each change with user, location, timestamp, reason for change and source identifier, plus a transaction type distinguishing insert from update and removal.

1. What audit entry is generated for each create, modify and delete action on the submission, and does it capture the prior value? provenance
2. For which classes of change is a reason for change mandatory, and is a free-text reason acceptable or must it be coded? requirement
3. Is the audit trail generated independently of the operator and protected from modification or deletion by the parties it records? security
4. For how long is the audit trail retained relative to the submission itself, and is it disposed of together with the record? retention

Temporal model, deadlines and timeliness

A submission has many distinct times: started, last saved, authored, signed, transmitted, received, decided and disposed. RFC 3339 requires an explicit offset or Z on each, and reserves -00:00 for a known UTC instant with unknown local offset. Deadlines are evaluated in the receiving authority's timezone, which is frequently not the respondent's - and ECF requires submission date and time as filing metadata precisely because that instant has legal effect.

1. Which distinct time points are recorded for this submission: started, last saved, authored, signed, transmitted, received, decided and disposed? temporal
2. How is event time (when the respondent answered or signed) kept separate from observation or ingestion time (when the receiver recorded it), and which is used for reporting? provenance
3. In which timezone is a deadline evaluated, and is an explicit offset recorded with every stored timestamp? temporal
4. If a submission is rejected and corrected within a grace period, which time counts for deadline compliance? temporal
5. How long may a draft remain untouched before it expires, and is the respondent warned before expiry? lifecycle

Access control and field-level sensitivity

Authority checks must ensure only authorised individuals can use the system, sign, access the operation or alter a record. Submissions are rarely uniformly sensitive: a single package can mix routine fields with identifiers, health data or protected identities, so authorisation granularity below the package is normal rather than exceptional.

1. Which roles may read, amend, decide on or export the submission, and at what granularity is that authorisation expressed? access
2. Which items carry heightened sensitivity requiring separate authorisation or separate storage? privacy
3. Is any part of the submission sealed or restricted from the submitting or responding parties themselves? exception
4. How is each access to and export of a submission logged, and are denied attempts recorded too? security

Redaction and public release

Some submissions are published - court filings, public comments, regulatory disclosures. Release produces a distinct derived artifact with its own identifier, its own integrity value and a recorded authorisation, and the redaction rule set applied must be retained so the release can be audited against what was actually withheld.

1. Is any version of this submission published or disclosed beyond the receiving authority, and to whom? privacy
2. Which items or document regions must be redacted before release, and under which rule set? requirement
3. Who authorises release, and is the authorisation recorded separately from the release itself? authority
4. Is the redacted release a distinct artifact with its own identifier and integrity value, so it is never confused with the original? identity

Retention, disposition and erasure reconciliation

Records must remain accurately and readily retrievable throughout the retention period, and disposal or transfer happens under a named authority. Drafts and abandoned answers are the neglected case - they contain personal data but often no disposition instruction. Erasure requests and statutory retention genuinely conflict, and the model must record the outcome of that conflict rather than resolve it silently.

1. Which event starts the retention clock - receipt, final decision, or closure of the parent matter - and how long is the period? retention
2. Under which named disposition authority is the submission destroyed or transferred, and to which destination? authority
3. How are abandoned drafts and never-submitted answers disposed of differently from accepted submissions? lifecycle
4. How is an erasure or correction request from the respondent reconciled with a statutory retention obligation, and is a refusal recorded? exception
5. Is a legal hold or preservation order in force that suspends the disposition schedule? constraint

Serialization profile and format neutrality

The semantics live in the abstract answer tree; urlencoded pairs, multipart parts, XML and JSON are projections. This matters operationally because signatures and digests must cover a single named canonical form, and because flat name/value encodings cannot represent repeating nested groups without a declared convention.

1. Which serialization is the canonical form for digesting and signing, as distinct from the transport encodings permitted on the wire? interoperability
2. What character encoding is asserted for text values, and how is it signalled when the transport cannot carry an explicit declaration? interoperability
3. How are hierarchical and repeating groups represented in a flat name/value encoding without loss of nesting or occurrence identity? composition
4. Which encodings are permitted for a given channel, and who decides when they diverge from the instrument's declared serialization? constraint

Definition binding and downstream extraction

Items may carry a definition URI pointing at a target data element, enabling answers to be extracted into semantic records. The boundary must be explicit: FHIR keeps the question-faithful response distinct from derived observations, so extraction produces new entities and does not displace the submission as source of truth.

1. To which target data element does each item map, and is the mapping declared in the instrument or maintained externally? interoperability
2. Once answers are extracted downstream, is the extracted record authoritative or does the submission remain the source of truth? provenance
3. How is the exact question wording preserved when answers are extracted into semantically typed records that discard phrasing? evidence
4. How are extraction failures surfaced without invalidating an otherwise accepted submission? exception

Populate, extract and standard alignments

SDC populate builds an initial QuestionnaireResponse from existing data; after human review the filler must ensure validity. Extraction uses submitted answers to create or update other resources. Alignments to HTML, XForms, FHIR, PRA and eForms are not claims of joint conformance. Conflicts (R5 required questionnaire canonical versus older optional; XFA deprecated in PDF 2.0; eForms as notices not respondent forms) must be recorded.

1. Was this response pre-populated, from which sources, and which answers were then edited by a human? provenance
2. Into which target records or resources were answers extracted after submit, and with what mapping? interoperability
3. Which external standards is this instance aligned to, and which known conflicts or non-conformances apply? interoperability
4. If this instrument is an eForms notice, what form type and subtype govern mandatory and conditionally mandatory fields? classification

Submission channel and acknowledgement

XForms names the endpoint, method and replace behaviour and raises distinct done and error events; ECF returns a synchronous message status with an error code where zero means success, and reports the review result asynchronously afterwards. Three failure classes must stay distinguishable: transport failure, structural rejection and business rejection.

1. Through which channel and endpoint was the submission transmitted, and was acceptance acknowledged synchronously or asynchronously? process
2. What does the acknowledgement contain that lets the submitter prove the package was received at a particular instant? evidence
3. How are transport errors distinguished from structural rejections and from business rejections in the response? exception
4. What subsequent notification is owed to the submitter, and within what interval must it arrive? requirement

Duplicate detection and idempotency

At-least-once delivery and impatient respondents both produce repeated transmissions. FHIR treats each completion for a different subject or time as a distinct response, and ECF carries sender/receiver identifiers with a submission date and time - together these give the keys for deciding sameness. Note that a normative idempotency-key mechanism is common practice rather than a requirement in the sources consulted.

1. Which key determines that two received packages are the same submission rather than two legitimately distinct ones? identity
2. Within what window is a repeated transmission treated as a retry rather than a new submission? temporal
3. What is returned when a duplicate is detected - the original receipt, a conflict error, or a new receipt referencing the original? exception

Error identification and suggestion

WCAG 2.2 requires at Level A that input errors be automatically detected, the item identified and the error described in text (3.3.1), and that labels or instructions be provided where input is required (3.3.2); at Level AA it requires correction suggestions where known (3.3.3) and that status messages be programmatically determinable without receiving focus (4.1.3). These bind the shape of the validation issue objects, not just the styling.

1. For each failed constraint, is the erroneous item identified and the error described in text rather than by colour or position alone? quality
2. Is a correction suggestion provided when one is known, and is it deliberately withheld where suggesting it would compromise security or purpose? exception
3. Are validation results and progress exposed programmatically so assistive technology is notified without moving focus? access
4. Does every item requiring input carry a label or instruction, and do headings and labels describe topic or purpose? requirement

Error prevention and confirmation

WCAG 2.2 requires at Level AA that submissions with legal or financial consequences, or that modify user-controlled data, be reversible, checked, or confirmed (3.3.4), and at Level A that previously entered information not be redundantly re-requested (3.3.7). Whether a submission is legally binding therefore changes the mandatory interaction design, so the classification must be recorded on the instrument.

1. Is this submission legally binding, financial, or a modification of user-controlled data, and therefore subject to the reversible, checked or confirmed requirement? classification
2. Is a review-and-confirm step presented before irreversible submission, and is the respondent's confirmation itself recorded? process
3. Is information the respondent already supplied in the same process re-requested, and if so on what justification? requirement
4. Is the purpose of each personal-data input programmatically identified so autofill and personalisation can operate? interoperability

Submission quality metrics and paradata

Regulated collections must estimate burden and demonstrate practical utility that is actual rather than theoretical, and records must be accurate, relevant, timely and complete. Observed paradata - time to complete, abandonment point, item non-response, edit-check failure concentration and rejection rate - is the falsification test for those claims and the input to instrument revision.

1. What measured time to complete is observed, and how does it compare with the published burden estimate? measurement
2. What proportion of started submissions are abandoned, and at which item does abandonment concentrate? measurement
3. Which items generate the most validation failures or rejections, and has the instrument been revised in response? quality
4. What evidence shows the collected data is actually used, and which items have never been consumed downstream? evidence