Fast Healthcare Interoperability Resources (FHIR)

Key facts

Developed by

HL7 International

Data formats

JSON and XML (plus RDF), exchanged mainly over RESTful APIs

Version most used in U.S. rules

FHIR Release 4 (R4)

U.S. base implementation guide

US Core, aligned with USCDI

Authorization pattern

SMART on FHIR, built on OAuth 2.0

What is FHIR?

FHIR, pronounced "fire," is a standard from HL7 International that brings the way web applications share data to health care. Instead of whole messages or documents, FHIR breaks information into small, reusable resources, such as Patient, Encounter, Observation, MedicationRequest, Coverage and ExplanationOfBenefit, each with a defined structure and its own web address.

An application can read, search, create or update resources with standard HTTP requests. Because resources reference each other, a client can start from a patient and retrieve that patient's conditions, lab results and medications.

FHIR Release 4 (R4) was the first version with normative, backward-compatible content, and it is the version most current U.S. regulations reference. Later releases exist, but U.S. adoption largely follows regulatory requirements.

How FHIR is used in practice

Real deployments combine the core standard with several companion specifications:

• Implementation guides: profiles such as US Core constrain resources for a country or use case, specifying required elements and vocabularies like RxNorm, LOINC and SNOMED CT.
• SMART on FHIR: an authorization framework built on OAuth 2.0 that lets third-party apps launch from an EHR or connect on behalf of a patient.
• Bulk FHIR: an export operation that returns data on many patients at once as newline-delimited JSON files, used for population analytics.
• Payer APIs: CMS rules require certain payers, including Medicare Advantage organizations, Medicaid and CHIP programs and qualified health plans on the federal exchanges, to offer FHIR-based patient access and provider directory APIs.

Why FHIR matters

FHIR is now the default route to U.S. clinical and payer data:

• Under rules implementing the 21st Century Cures Act, federal health IT certification requires a standardized FHIR API for patient and population data, so certified EHRs expose FHIR endpoints.
• The CMS Interoperability and Prior Authorization final rule, issued in January 2024, adds FHIR APIs for provider access, payer-to-payer exchange and prior authorization, with most API requirements starting in 2027.
• Health IT and AI companies can integrate with many EHRs through one standard instead of custom interfaces, although vendors differ in which resources and extensions they support.
• Provider directory APIs published by payers expose network data in FHIR format.