diff --git a/crates/erp-health/src/fhir/handler.rs b/crates/erp-health/src/fhir/handler.rs
index 6cbf507..eff7ae0 100644
--- a/crates/erp-health/src/fhir/handler.rs
+++ b/crates/erp-health/src/fhir/handler.rs
@@ -687,6 +687,7 @@ pub async fn patient_everything(
     // 2. Observations（设备读数）
     let readings = crate::entity::device_readings::Entity::find()
         .filter(crate::entity::device_readings::Column::PatientId.eq(id))
+        .filter(crate::entity::device_readings::Column::TenantId.eq(ctx.tenant_id))
         .filter(crate::entity::device_readings::Column::DeletedAt.is_null())
         .limit(200)
         .all(&state.db)
@@ -700,6 +701,7 @@ pub async fn patient_everything(
     // 3. Devices
     let devices = crate::entity::patient_devices::Entity::find()
         .filter(crate::entity::patient_devices::Column::PatientId.eq(id))
+        .filter(crate::entity::patient_devices::Column::TenantId.eq(ctx.tenant_id))
         .filter(crate::entity::patient_devices::Column::DeletedAt.is_null())
         .all(&state.db)
         .await?;
@@ -710,6 +712,7 @@ pub async fn patient_everything(
     // 4. Encounters（咨询会话）
     let consultations = crate::entity::consultation_session::Entity::find()
         .filter(crate::entity::consultation_session::Column::PatientId.eq(id))
+        .filter(crate::entity::consultation_session::Column::TenantId.eq(ctx.tenant_id))
         .filter(crate::entity::consultation_session::Column::DeletedAt.is_null())
         .all(&state.db)
         .await?;
@@ -720,6 +723,7 @@ pub async fn patient_everything(
     // 5. Appointments
     let appointments = crate::entity::appointment::Entity::find()
         .filter(crate::entity::appointment::Column::PatientId.eq(id))
+        .filter(crate::entity::appointment::Column::TenantId.eq(ctx.tenant_id))
         .filter(crate::entity::appointment::Column::DeletedAt.is_null())
         .all(&state.db)
         .await?;
@@ -730,6 +734,7 @@ pub async fn patient_everything(
     // 6. Tasks（随访任务）
     let tasks = crate::entity::follow_up_task::Entity::find()
         .filter(crate::entity::follow_up_task::Column::PatientId.eq(id))
+        .filter(crate::entity::follow_up_task::Column::TenantId.eq(ctx.tenant_id))
         .filter(crate::entity::follow_up_task::Column::DeletedAt.is_null())
         .limit(50)
         .all(&state.db)
@@ -741,6 +746,7 @@ pub async fn patient_everything(
     // 7. DiagnosticReports（化验报告）
     let reports = crate::entity::lab_report::Entity::find()
         .filter(crate::entity::lab_report::Column::PatientId.eq(id))
+        .filter(crate::entity::lab_report::Column::TenantId.eq(ctx.tenant_id))
         .filter(crate::entity::lab_report::Column::DeletedAt.is_null())
         .limit(50)
         .all(&state.db)