Topic starter
16/01/2026 5:28 pm
TL;DR: SMART on FHIR interoperability depends on IAM that can authorize access across apps, organizations, and data-sharing boundaries, according to Ping Identity. Connectivity alone is not enough; healthcare programmes need tightly governed permissions, privacy enforcement, and service availability to keep access decisions secure as digital care expands.
Editorial analysis by NHI Mgmt Group, based on content published by Ping Identity: “What Is SMART on FHIR and Why Is IAM Required?”.
Key questions
Q: How should healthcare organisations govern SMART on FHIR access?
A: They should govern SMART on FHIR access by treating each app, token, and service account as a controlled identity with an owner, a purpose, a minimum scope, and a revocation path.
Q: Why do weak authorization controls create risk in interoperable healthcare systems?
A: Because interoperability multiplies trust boundaries.
Q: What are the warning signs that SMART on FHIR access governance is failing?
A: Look for apps with more data reach than their use case justifies, inconsistent permissions between organisations, and entitlement reviews that no longer match how the integration is actually used.
Practitioner guidance
- Define SMART on FHIR authorization boundaries Map which users, apps, and data classes are allowed for each interoperability use case, then enforce those scopes in IAM rather than in application logic.
- Review app entitlements across organisations Validate that federated and delegated access still matches the current clinical or business purpose, especially where payer, provider, and app vendor relationships have changed.
- Align privacy policy with access policy Ensure privacy requirements are translated into enforceable authorization rules for SMART on FHIR apps, so data sharing follows the same policy logic everywhere.
Bottom line: SMART on FHIR only works securely when IAM governs who can access which data, from which app, and under what conditions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/10/2026 5:43 pm
SMART on FHIR is an identity governance problem, not just an interoperability one. The article is right to place IAM at the centre of healthcare data sharing because connectivity without authorization discipline only moves risk faster. In healthcare, the business goal is to share data safely across apps and organisations while preserving privacy and service continuity. The practitioner conclusion is simple: interoperability programmes should be designed around governed access, not network reachability.
A question worth separating out:
Q: What should teams do when interoperable access must also preserve clinical availability?
A: Design authorization so it can support both security and uptime. That means testing identity flows for failure modes, confirming approved users can still reach required data under normal operating conditions, and avoiding controls so rigid that they block legitimate care delivery.
👉 Read our full editorial: SMART on FHIR interoperability depends on stronger IAM controls