Apisecure, 14 & 15 March 2023 - John Moehrke, Co-Chair at Security Working Group.
summary
FHIR (HL7) is a RESTful JSON/XML API spec that requires a published capability statement metadata endpoint telling exactly which resources and search parameters a server supports; common risks include unchecked OAuth implementations despite the SMART App Launch OAuth scopes profile, misuse of include/revinclude and patient ID increments (Alyssa found one lab ID increment returned another patient), and lax extension handling; built‑in mitigations exist — validators, implementation guides, security tags and consent resource, provenance and audit — but security depends on actual implementations (try the Happy reference server).
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:49What is FHIR and security
- 3:16FHIR API specifics
- 17:11Healthcare IT market
- 24:42Finding FHIR servers
- 31:15Search parameters abuses
- 37:45Privacy principles
- 43:59Closing remarks
