Confirm permission to use a specific FHIR service

What this means for your practice

Separate the technical standard from permission to use a named service. Confirm that service's own onboarding, permitted uses and continuing responsibilities with its provider.

Questions to take to your supplier

Ask for the actual access route and who completes each prerequisite before agreeing a delivery commitment. The FHIR security guidance linked below explains that the exchange standard is not itself a security protocol. Your supplier should explain the approved design and permitted use for the specific connection being proposed.

Agree the working process

Identify the exact service or vendor interface the project intends to use. Then ask its responsible provider for the current onboarding route, permitted uses and ongoing responsibilities. Keep each prerequisite assigned to a person who can resolve it, including any organisational approvals or account arrangements. Public technical documentation can help the implementation team understand the format, but it does not settle whether this organisation is authorised to use that service for this purpose. Make that distinction visible in the project plan before dates are committed.

Ask the supplier to explain which work can proceed while access is unresolved and which depends on confirmation. Use authorised test arrangements rather than assume production access will be available for discovery. Record the approved access scope and the owner responsible after launch. The practice should be able to distinguish an implementation question from an access question and understand the next action for each, without being asked to interpret the standard as if it were a permission letter.

How to check the result

Count access prerequisites unresolved before delivery commitments.