...
For reasons of implementation efficiency, the resource ID is sometimes returned as a Coding in the meta.security element of a resource.
The extension which represents the same information when not in a Coding is: http://fhir.patientsknowbest.com/structuredefinition/source-person (but note that this is a more general extension which can capture a source person that is not necessarily a patient).