HL7 FHIR Transport Security. TRANSPORT LAYER SECURITY (TLS) - all FHIR APIs MUST use TLS 1.2+ for production + TLS 1.3 recommended; certificate validation + trust chain + certificate pinning where appropriate + HSTS + secure session establishment + cipher suite enforcement (no NULL + no anonymous + no RC4 + no DES/3DES + forward secrecy); FHIR Security Module guidance + sectoral healthcare cybersecurity best practices. COMMUNICATION SECURITY: (a) HTTP/2 + HTTP/3 + QUIC support; (b) WebSocket + Server-Sent Events + REST + GraphQL + FHIRPath for subscriptions + queries; (c) JSON + XML + Turtle serialization; (d) End-to-end encryption + integrity verification; (e) mTLS (mutual TLS) for high-security scenarios + Backend Services + Server-to-Server; (f) Replay attack prevention via nonces + timestamps + Time Keeping. TIME KEEPING - secure time synchronization via NTP + Stratum 1-2 + monotonic counters + Time-of-Day verification + drift detection + replay prevention + audit log time stamps + token expiration + JWT signing time; FHIR resource lastUpdated + createdAt + modifiedAt + audit trails + Provenance recordedAt. SERVER CAPABILITYSTATEMENT SECURITY (FHIR-SEC-19) - FHIR servers MUST publish CapabilityStatement (R4) / Conformance (DSTU2/STU3) Resource declaring (a) security mechanisms supported (cors + service + certificate + description + token endpoint); (b) authorization scheme (OAuth 2.0 + SMART + OpenID Connect + Backend Services); (c) authorization scopes supported + claims; (d) profile + IG compliance; (e) version + supported resources; (f) Operations + Subscriptions supported. CapabilityStatement enables client discovery + auto-configuration + interoperability + trust establishment. KEY EVIDENCE: TLS configuration + certificate management + cipher suite enforcement + CapabilityStatement + time synchronization + audit logs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.