FHIR at Scale (FAST): Scalable Registration, Authentication, and Authorization for FHIR Ecosystem Participants (Jira PSS-2631)

2025 Update:

The FAST Accelerator has published version 1.1 of this IG and would like to have STU2 published as Universal Realm to address the needs presented to them from Europe, China and the Middle East Gulf States.

The current IG Is published here: https://hl7.org/fhir/us/udap-security/ with the STU2 work being done here: https://build.fhir.org/ig/HL7/fhir-udap-security-ig/

The European Health Data System and the Gulf States Health System are reviewing this project for potential use as the basis for the security for each. The [https://digital-strategy.ec.europa.eu/en/policies/eidas-regulation|eIDAS] and [https://ec.europa.eu/digital-building-blocks/sites/display/DIGITAL/eID+@SEMIC+2024|eID] are easily supported by the FAST Security IG. For the Gulf States, it is seen as a way to improve interchange with communities in remove countries that travel to the region.

Original 2022 Project Need:

As the FHIR ecosystem grows and the number of deployed servers and clients multiplies, several aspects of the registration, authentication, and authorization processes that occur before the exchange of FHIR resources can take place have been identified as potential bottlenecks. To facilitate the effective scaling of the ecosystem, automated approaches for application registration and more robust mechanisms to reliably identify participants and manage credentials are needed. For larger ecosystems with numerous requestors and responders, a distributed system of authoritative information can be leveraged using digital certificates to enable a scalable dynamic solution for client (i.e., FHIR client / requestor) registration.

The registration problem alone is exemplified by statistics shared from a scenario analysis that considered manual registration of 60 current BlueButton API clients across 907 US Health Plans. Extrapolating from the CMS experience, the time required by human facilitated administrative activities at the Health Plans to register 60 applications (e.g., review meetings, actual generation & sharing of API credentials with app developer, etc.) was estimated at 73 person-years (Seib A and Scrimshire M, 'Making it easier for Patients and Data Holders', EHNAC AHIP Webinar, 2020). This estimate only addresses one type of registration interaction (payer/consumer), with additional registration effort required for all provider/consumer, provider/provider, provider/payer, and payer/payer pairings. The Healthcare dollars expended in non-value, manual related client registration activities can be recaptured many times over as this solution is adopted across the FHIR API ecosystem nationwide.

The ONC FHIR at Scale Taskforce’s Security Tiger Team was formed in late 2018 to investigate these issues and identify potential solutions. The Tiger Team identified the Unified Data Access Profiles (UDAP) for Dynamic client registration, client authentication, client authorization, and Tiered OAuth as building blocks to be used by implementers to address the issues above and enhance the overall scalability of the FHIR ecosystem, a recommendation that has received positive feedback from numerous cybersecurity subject matter experts.