How to secure access to FHIR data: users, clients and permissions 

You’ve decided to make healthcare data integrations easier by adopting FHIR. You know how to map your data and how to cleanly sync to your FHIR Server. You now support a standard backed by governments and healthcare industries worldwide. But there’s one problem. 

How will you control access to your FHIR data? 

Security is a top priority. You don’t want anyone to be able to see everything. Different users, organizations, apps, and integrations require different levels of access to different data. Security standards are mandated for FHIR, but it can be difficult to implement detailed access controls. 

Firely Auth is an authorization server and identity provider designed to solve these challenges. It has a visual interface and APIs for managing users, clients, and permissions with standard security protocols. In this blog, we’ll explain how Firely Auth supports a wide variety of use cases and enables an ecosystem of secure integrations for your FHIR server. 

Standardized security with flexibility

Security in FHIR is based on OAuth 2.0, the de facto standard for web authorization. SMART on FHIR extends OAuth with standard permissions for any FHIR server. In the US, it’s mandated for EHRs in the 21st Century Cures Act and for payers in the CMS-0057-F Interoperability Rule. 

Firely Auth supports SMART on FHIR v1 and v2. What does that mean? First, clients can be authorized to perform different actions on different types of data (“role-based access”). Second, more fine-grained access can be based on identifiers for particular resources or users (“attribute-based access”). For example: 

• The 21st Century Cures Act requires providers to grant patients access to their own data. A patient portal user can be restricted to reading only their data by matching them to a FHIR Patient resource using a unique identifier. 

• The CMS-0057-F Provider Access API requires payers to share patient data with providers. A provider can be authorized by matching them to a FHIR Group resource that represents their relationship to the patient and payer.

• An ophthalmic imaging app could be granted access to only FHIR Observation, DiagnosticReport, and ImagingStudy resources, and only those tagged with ophthalmic codes from ICD or SNOMED. 

How granular can you go? Any FHIR search query can be used as an access filter. Any metadata about specific users or clients can be added to these filters when provided as OpenID Connect (OIDC) claims. 

An ecosystem for unlimited interfaces

Beyond ensuring security and compliance, SMART on FHIR enables an ecosystem for innovation. Each healthcare app or integration can be registered as a client in Firely Auth with its own permissions and settings. You could enable multi-factor authentication for your patient-facing app, while configuring an automated backend service for more direct yet restricted access. But that’s only the beginning of what’s possible. 

FHIR is not only a standard for exchanging common data. It can be used with highly specialized user interfaces. Want to extend your EHR with a condition risk calculator, a telehealth app, or an analytics dashboard? SMART on FHIR defines a standard way to directly launch these from an EHR and exchange “context”, such as a currently selected patient. Firely Auth can also launch standalone clients, such as a patient portal, provider directory, or personal health app. 

Switching healthcare applications is no longer a major investment that requires being locked into different data silos. If an app doesn’t work for you, simply replace it with another while keeping your data in FHIR. No data migration required. One data model. One API. Unlimited user interfaces — all managed in one place.

Who is accessing your data?

Data access is managed by assigning permissions to users and clients. But how can you trust that someone is who they say they are? Firely Auth offers two options for managing the identity of users: Create new users with Firely Auth’s visual interface or user API, or securely integrate with an existing user system. 

If you have an existing user system that supports OpenID Connect (OIDC), such as Microsoft Entra, users can log into Firely Auth using Single Sign-On (SSO). No need to create an extra login and password to manage. Delegate the responsibility of managing users to third parties, even while retaining control of what data they can access. This is especially powerful for sharing and partitioning data between multiple tenants. 

How do you know what users are doing? Firely Auth tracks which clients each user has consented to using. Meanwhile, access to specific data is tracked in Firely Server using a variety of logs, from HTTP requests to detailed AuditEvent FHIR resources.

Customize your FHIR user experience

Firely Auth is the front door to all your healthcare data and apps integrated with FHIR, so you might want to dress it up to fit your organization’s look. How can you give users a seamless experience? With Firely Auth, you can set custom logos, text, disclaimers, and consent prompts. 

Between specialized interfaces and data profiled in FHIR for specific use cases, users may not even realize they are using a FHIR-based system. That’s why Firely Auth offers the ability to display and track customizable consent prompts that users must accept, so both you and your users know exactly what they signed up for and when. Users can review and revoke access they’ve granted to clients at any time.

The future of healthcare integrations

Once you’ve reached the point where everything’s integrated — from complex data, to access controls, to the look-and-feel of your apps — it won’t matter that no one can tell it’s all based on FHIR. All that matters is that it works. Interoperability enables health tech companies to focus on innovation and providers to focus on actually improving healthcare.

Want to know more?

Questions about whether Firely Auth can support your use cases? Connect with one of our experts.

Want to know more about the technical details? Check out our documentation on Firely Auth, SMART on FHIR, and related security solutions. 

Ready to try Firely Auth? Download it here.