Regulatory Workflows and Interactions - pharma
0.1.0 - ci-build International flag

Regulatory Workflows and Interactions - pharma, published by HL7 International / Biomedical Research and Regulation. This guide is not an authorized publication; it is the continuous build for version 0.1.0 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/APIX---API-Exchange-for-Medicinal-Products/ and changes regularly. See the Directory of published versions

Getting Started

Page standards status: Informative

Five simple steps to connect any two parties in a regulatory exchange — industry to regulator, regulator to industry, regulator to regulator, or industry to industry. Each step builds on the previous one, so start at the top and work down.

Step 1: Connect via API

1

Register your Organization and Endpoint on the receiving party's FHIR server, whether that is a regulator or a company. This tells the other party who you are and where to send notifications back to you.

💡 Think of it like…
Registering a shipping address before you can send or receive packages. You only do this once.
✅ Business benefit: One-time setup — connects your organization to any party, regulator or company, that supports RWI-pharma.

Step 2: Stream Files as Binary

2

Upload any file type — PDF, DOCX, XML, JSON, data sets — to the receiving party's FHIR server as a Binary resource. Files are stored securely and accessed on-demand by the recipient.

💡 Think of it like…
Netflix for documents. Instead of mailing a box of DVDs (a giant ZIP file), each document is streamed individually — the recipient only downloads what they need, when they need it.
✅ Business benefit: No more massive portal uploads. Sub-second processing instead of hours of waiting.

Step 3: Describe with DocumentReference

3

For each Binary you uploaded, create a DocumentReference resource that captures metadata — the file's category, version, type, and CTD section. This lets the recipient search, filter, and discover your documents without downloading them. In Step 4, these DocumentReferences are attached to a Task as inputs (if you created the Task) or outputs (if you are doing the work it asks for).

💡 Think of it like…
A library catalog card. The card describes the book (title, author, subject) so you can find it without reading every book on the shelf.
✅ Business benefit: Recipients instantly find the exact document they need. No more searching through ZIP files.

Step 4: Orchestrate with Task

4

Create a FHIR Task resource to initiate and track a regulatory activity — any type of regulatory activity for human biopharmaceutical products. The Task carries the DocumentReferences in both directions and progresses through status changes as the procedure advances.

💡 Think of it like…
A FedEx tracking number. You create the shipment (Task), attach the packages (documents), and then both sender and receiver can track exactly where it is in the process at every step.
Inputs come from the requester, outputs from the owner
Requester → Task.input
The party that creates the Task supplies what the work needs.
Owner → Task.output
The party that does the work returns the result.
Example: on a Payment Task created by the regulator, the invoice is an input and the proof of payment returned by the applicant is an output. On a submission Task created by the applicant, the dossier documents are inputs and the regulator's decision letter is an output. See Terminology for example input and output types.
✅ Business benefit: Every date and time is recorded. After the procedure, analyze and visualize cycle times across one or many regulatory activities.
What can you track?
Clinical Trial Application NDA/MAA Shelf-life Update Label Negotiation Invoice Payment Q&A Exchange Decision Letter Adverse Event Report Pre-submission Meeting
Task lifecycle

As a regulatory activity progresses, the Task's status moves through these stages. Each transition is timestamped, creating a complete audit trail.

draft
requested
received
accepted
in-progress
completed
📈
Cycle-Time Analytics

Because every status change is timestamped, you can analyze the duration of each phase across one or many regulatory procedures. Visualize bottlenecks, benchmark SLA performance, and identify opportunities to accelerate time-to-market for your products.

Step 5: Subscribe for Real-Time Updates

5

Set up a Subscription to receive instant notifications whenever Tasks are updated as the regulatory activity progresses. Both parties subscribe — so both sides know immediately when something changes.

💡 Think of it like…
Package delivery notifications. You don't need to keep checking the website — you get a push notification the moment your package moves to the next step.
✅ Business benefit: No more logging into portals to check status. Your system is notified automatically in real-time.

Prerequisites

Required
FHIR R5 Server

An R5-compliant FHIR server with support for Subscriptions, conditional create/update, and SMART Backend Services (e.g., HAPI FHIR, Smile CDR, Azure, AWS HealthLake, GCP Healthcare API).

Required
OAuth2 / SMART

SMART Backend Services for system-level authentication using JWT bearer tokens. Mandatory for production use to ensure secure, audited access.

Recommended
REST API Client

A REST client (e.g., Postman, cURL, or your RIM system) capable of sending FHIR JSON payloads over HTTPS. Essential for prototyping and testing.

Validate & Build

Once you have reviewed the architecture and workflow:

  1. Validate your FHIR resources — Use the Official FHIR Validator with the RWI-pharma IG package to check compliance with the profiles defined in this guide.
  2. Test end-to-end — Post a Task to a test FHIR server, subscribe to status changes, and verify that notifications arrive at your webhook endpoint.
  3. Connect your RIM — Use the provided examples as templates. Start with a simple shelf-life variation submission to establish connectivity.