FHIR Resource Content

When participating in exchanges described in the Hybrid / Intermediary FHIR IG, the destination server SHALL populate references to itself within FHIR resources it returns (e.g., in the Bundle.entry.fullUrl element) and in HTTP header parameters (e.g., Content-Location within the FHIR Asynchronous Pattern) with its public FHIR service base URL.

FHIR RESTful Capabilities

• Destination server SHALL support the JSON source format.
• Destination server SHOULD support the XML source format.

Security

• Destination server SHALL implement Transport Layer Security (TLS) for all exchanges covered in this IG.
• Destination server MAY implement the HL7 / UDAP Security for Scalable Registration, Authentication, and Authorization FHIR Implementation Guide.
• For general security considerations refer to FHIR Security and Privacy Considerations.
• For additional security guidance, refer to the core FHIR Security guidance page.

The HL7 / UDAP Security for Scalable Registration, Authentication, and Authorization FHIR Implementation Guide referenced above is currently in ballot reconciliation and has not yet been published by HL7. This reference will be updated to the published version of the referenced security guide prior to this guide's publication