Skip to main content

FHIR Servers

A FHIR server stores FHIR resources and exposes them over the standard REST API. That much is common to all of them. What differs — and what decides your choice — is validation, terminology, search performance, security model and operational cost.


What a server is expected to do​

CapabilityMeaning
CRUDCreate, read, update, delete resources by type and id
SearchStandard and custom search parameters, chaining, _include
VersioningResource history and vread
ValidationCheck resources against base spec and profiles
Terminology$expand, $validate-code, $lookup against value sets
TransactionsAtomic Bundle processing
Capability statementMachine-readable declaration of what is supported
SecurityAuthentication, authorisation, audit logging
SubscriptionsNotify clients when matching data changes

A server that does CRUD but not validation or terminology will hand you those problems in application code instead.


Open-source options​

HAPI FHIR JPA Server — the Java reference implementation. The most widely deployed open-source option; complete resource coverage, embeddable, backed by a relational database.

Microsoft FHIR Server for Azure — open-source .NET implementation, runnable self-hosted or as the basis of the managed Azure service.

IBM FHIR Server / LinuxForHealth — Java, strong on conformance and extensibility.

Aidbox (community edition) — Clojure/PostgreSQL, notable for flexible storage and terminology handling.

Blaze — designed for large-scale analytical queries via CQL.

Medplum — TypeScript, developer-oriented, with a batteries-included application layer.


Managed services​

Managed services remove operational work and add per-request cost, data residency questions and less control over version timing. In jurisdictions with health data localisation requirements, that last point often decides it.


Choosing one​

Ask, in this order:

  1. Data residency and legal constraints. These eliminate options fastest.
  2. FHIR release support, and how the vendor handles version migration — including whether two releases can run in parallel during an upgrade.
  3. Profile validation. Will it enforce your implementation guide?
  4. Terminology. Built-in service, or another system to run?
  5. Search performance at your expected volume and query shape.
  6. Security model. SMART on FHIR, OAuth2, consent enforcement, audit.
  7. Operational fit. Your team's languages, databases and deployment tooling.

Operating a FHIR server​

  • Never expose it unauthenticated. A default HAPI deployment left open is a recurring incident pattern.
  • Log access to the resource level — see ISO 27799.
  • Index for your real queries; default indexes rarely match production search patterns.
  • Keep a test server with synthetic data so integrators are never testing against real patients.
  • Publish your capability statement and profiles — integrators should not have to guess.


References​