| Type |
Standard / Implementation Specification |
Standards Process Maturity |
Implementation Maturity |
Adoption Level |
Federally required |
Cost |
Test Tool Availability |
|
Emerging Standard
|
|
Final
|
Production
|
Feedback Requested |
No
|
Free
|
Yes
|
|
Emerging Implementation Specification
|
|
Balloted Draft
|
Feedback requested
|
Feedback Requested |
No
|
Free
|
No
|
|
Emerging Implementation Specification
|
|
Balloted Draft
|
Feedback requested
|
Feedback Requested |
No
|
Free
|
No
|
|
Emerging Implementation Specification
|
|
In Development
|
Feedback requested
|
Feedback Requested |
No
|
Free
|
No
|
|
Emerging Implementation Specification
|
|
In Development
|
Feedback requested
|
Feedback Requested |
No
|
Free
|
No
|
= Federal FHIR Action Plan: Marks standards for coordinated federal adoption. See Appendix V: Federal FHIR Action Plan for more details.
| Federal FHIR Action Plan Alignment |
HL7® FHIR® SMART App Launch Implementation Guide (SMART App Launch IG) - This implementation specification specifies how applications connect to FHIR APIs by requesting authorization from OAuth 2.0-compliant authorization servers. It outlines the process by which an application requests authorization to access a FHIR resource and subsequently uses that authorization to retrieve the resource.
- There are multiple versions of the SMART App Launch IG, all of which are compatible with FHIR Release 4 (R4). Historically, ASTP has adopted different versions of the SMART App Launch IG based on publication timing. Currently, ASTP has identified Version 2.0.0 as ready for adoption in Certified Health IT under the ASTP HTI-1 Final Rule. Certified Health IT developers typically adopt the version specified in program requirements or the version approved by the National Coordinator through ASTP’s Standards Version Advancement Process (SVAP).
- The SMART App Launch IG facilitates a persistent application authorization process and adds a security layer to FHIR API deployments, addressing both FHIR server and FHIR application perspectives. This makes the SMART App Launch IG a foundational specification for any FHIR API implementation requiring secure access to FHIR Resources.
- Referenced in Federal Rulemaking: ASTP HTI-1 Final Rule; CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F)
UDAP Security for Scalable HL7® FHIR® FAST UDAP Security for Scalable Registration, Authentication, and Authorization Implementation Guide - This implementation specification extends OAuth 2.0 to standardize and automate the application registration process using digital certificates, while securely authenticating participants within health information networks. This specification is compatible with the SMART App Launch IG and aligns with the security requirements of the Bulk Data IG.
- ASTP has identified Version 1.0.0 of the FAST UDAP Security IG as ready for adoption in Certified Health IT. While its use is currently optional within the Trusted Exchange Framework and Common Agreement™ (TEFCA™), it is expected to become a requirement in the future.
- The FAST UDAP Security IG provides a standardized method for dynamically registering applications through secure FHIR APIs. Implementers should consider adopting this specification for use cases requiring scalable trust among participants who agree to follow common policies, eliminating the need for individual agreements between organizations to establish trust.
- ASTP anticipates that this specification will continue to evolve and mature based on implementation experience within TEFCA™.
|
| Limitations, Dependencies, and Preconditions for Consideration |
Applicable Security Patterns for Consideration
|
- The HL7 FHIR SMART Application Launch Framework Implementation Guide Release 2.0.0 is a newer version of the standard that is available for health IT developers to voluntarily update and provide to their customers. It became available when it was added to the Approved Standards for 2022 through ASTP's Standards Version Advancement Process (SVAP).
- Since FHIR transactions require the use of a FHIR client, client application registration and management is an integral component for apps using FHIR.
- UDAP Dynamic Client Registration provides an extension to RFC 7591 to better scale the registration and use of FHIR client apps. This profile has seen interest from numerous industry stakeholders as an alternative to manually re-registering apps at every different datasource and as a way to enable sharing of information about apps among datasources.
- Trusted Dynamic Client Registration provides a path for verification of attributes for apps holding valid digital certificates and the communication of these attributes (e.g. privacy policy) to the end user, increasing confidence in valid FHIR clients within the ecosystem and facilitating the connection of apps to clinical FHIR servers without manual pre-registration. This can be used together with UDAP JWT-based Client Authentication to support reusable client identity for authentication and authorization, to help scale the use of client credentials or authorization code flow, and UDAP JWT-based Client Authorization Grants can be used to transmit Purpose of Use and Consent Information.
- UDAP is an open collaborative developing profiles to increase scalability, confidence, security, and trust in Open API ecosystems, and allows the re-use of identity proofing and credentialing processes already in place in existing national health information networks. These profiles are in draft status and are in pilot stage. UDAP DCR and Authentication/Authorization have been tested successfully at several HL7 FHIR connectathons and have received positive feedback from multiple stakeholders, including national health information networks, EHR vendors, patient privacy rights advocates, and app developers. These profiles are also compatible with SMART App Launch and UMA.
- The Security FHIR IG has been established upon the recommendations of ASTP's FHIR at Scale Taskforce (FAST) Security Tiger Team, and has been adapted from IGs previously published by UDAP.org. The objective of the IG is to harmonize workflows for both consumer-facing and B2B applications to facilitate cross-organizational and cross-network interoperability.
|
- System Authentication – The information and process necessary to authenticate the systems involved.
- User Authentication – The information and process necessary to authenticate the end user.
- User Details – Identifies the end user who is accessing the data.
- User Role – Identifies the roles and clearances asserted by the individual initiating the transaction for purposes of authorization. E.g., the system must verify the initiator’s claims and match them against the security labels for the functionalities that the user attempts to initiate and the objects the user attempts to access.
- Purpose of Use – Identifies the purpose for the transaction, and for the purposes for which the end user intends to use the accessed objects.
- Patient Consent Information – Identifies the patient consent information that may be required before data can be accessed.
- May be required to authorize any exchange of patient information
- May be required to authorized access and use of patient information
- May be required to be sent along with disclosed patient information to advise the receiver about policies to which end users must comply
- Query Request ID - Query requesting application assigns a unique identifier for each query request in order to match the response to the original query.
- Security Labeling – The health information is labeled with security metadata necessary for access control by the end user.
|