The security layer between AI agents and clinical data.
PHI redaction, audit trails, step-up auth — one proxy for any FHIR server.
| Feature | This Project | AWS HealthLake MCP | Medplum MCP | Raw FHIR |
|---|---|---|---|---|
| Works with any FHIR server | ✓ | HealthLake only | Medplum only | — |
| PHI redaction on reads | ✓ | ✗ | ✗ | ✗ |
| Immutable audit trail | ✓ | CloudTrail | Partial | ✗ |
| Step-up auth for writes | ✓ | IAM | Medplum auth | ✗ |
| Human-in-the-loop | ✓ | ✗ | ✗ | ✗ |
| Setup time | 10 seconds | 30+ min | 15+ min | Varies |
What's real: Mandatory tenant isolation on every query, HMAC-SHA256 step-up tokens for writes, ETag/If-Match concurrency control, OAuth 2.1 with PKCE (S256). Append-only audit trail with database-level immutability enforcement.
Read tools add _mcp_summary with reasoning, clinical context, and limitations.
Write tools use a propose/commit pattern: propose_write validates first,
commit_write requires step-up auth.
permission_evaluate returns human-readable reasoning.
Human-in-the-loop enforcement: clinical writes return HTTP 428 without explicit confirmation. HIPAA Safe Harbor de-identification. Medical disclaimer injection. PHI redaction on all read paths — the agent never sees raw patient data.
| Flask App | R6 REST facade at /r6/fhir/* |
| MCP Server | Node.js + TypeScript — 10 tools with reasoning |
| Storage | JSON blobs in SQLite (demo) — not production |
| Validation | Structural only (required fields + value constraints) |
| FHIR Version | R6 v6.0.0-ballot3 |
| Resources | 16 types (7 base + 9 R6 ballot) |
| Permission | R6 access control with $evaluate + reasoning |
| SubscriptionTopic | Restructured pub/sub (storage + discovery) |
| DeviceAlert | ISO/IEEE 11073 device alarms (new in R6) |
| NutritionIntake | Dietary tracking (new in R6) |
| $stats/$lastn | Standard FHIR ops (since R4, not R6-specific) |