FHIR is not a security protocol. The HL7 security page says it relies on other mechanisms and gives you the data structures to apply them. If you stand up a FHIR server and do nothing else, you have an API that returns patient data to whoever asks, so you must add transport, authentication, authorization and audit.
What the guidance covers
HL7 organizes FHIR security around a few themes. Each one is your job to build or buy.
- Communications: use TLS for production exchanges, follow current IETF best practice, and avoid revealing web software details in headers or errors.
- Authentication: users and clients must be authenticated, or the server must otherwise trust the client. OpenID Connect is pointed to for web end user identity.
- Authorization and access control: security labels can feed role based and attribute based decisions.
- Consent: patient consent can apply when tokens are issued and scopes granted.
- Audit: AuditEvent and Provenance record security events and origins.
- Data sensitivity: resources fall into categories, from anonymous to patient sensitive, to guide protection.
The mistake of assuming the standard handled it
Teams often read "FHIR compliant" as "secure." Compliance with the data model says nothing about who may read which record. Two servers can both be FHIR conformant, one carefully locked down and one wide open.
A starter checklist
- TLS everywhere, with certificate renewal tracked.
- OAuth based authorization, such as SMART App Launch, which HL7 recommends for authorizing interactions with protected FHIR servers.
- Per resource and per record access checks, not just per endpoint.
- Rate limits and monitoring on search endpoints.
- AuditEvent records written for reads, not only writes.
- Logs treated as sensitive. HL7 notes HTTP logs, including URLs, are as sensitive as the clinical data they reference.
- Safe handling of attachments, which can carry executable content.
Where to go next
Authorization is where most real problems hide. See SMART scopes explained and access paths that leak data.
Safeguard's dependency scanning can check the libraries behind your FHIR server, and its policies and gates can block risky changes in pull requests.
Quick check
Does a FHIR server include authentication by default?
FHIR does not define the security protocol. You provide authentication and authorization through standards such as OpenID Connect and OAuth.
Sources
Last reviewed: 19 October 2026.
