availability of data and safety

Intended to address -- 
Fixes: #502, #503

docs/hooks/patient-view.md

@@ -12,14 +12,18 @@ The user has just opened a patient's record.
 
 ## Context
 
-The patient whose record was opened, including their encounter, if applicable.
+The patient whose record was opened, including their encounter, if applicable. 
+
+The FHIR ids referenced in `context` are expected to be available via the FHIR Server (if `fhirServer` is populated in the request) or via prefetch, if supported. However, the specification does not explicitly require this behavior and implementations should be aware that integrations may not fully support this expectation.
 
 Field | Optionality | Prefetch Token | Type | Description
 ----- | -------- | ---- | ---- | ----
 `userId` | REQUIRED | Yes | *string* | The id of the current user.<br />For example, if the user represents a FHIR resource on the given FHIR server, the resource type would be one of [Practitioner](https://www.hl7.org/fhir/practitioner.html), [Patient](https://www.hl7.org/fhir/patient.html), or [RelatedPerson](https://www.hl7.org/fhir/relatedperson.html).<br />If the user was a Practitioner, this value would be `Practitioner/123`
 `patientId` | REQUIRED | Yes | *string* | The FHIR `Patient.id` of the current patient in context
 `encounterId` | OPTIONAL | Yes | *string* | The FHIR `Encounter.id` of the current encounter in context
 
+For information on patient safety issues see [Security & Safety](../../specification/1.0/#security-and-safety).
+
 ### Examples
 
 ```json