HL7 Electronic Health Record System Functional Model, Release 2.1.1
2.1.1 - Normative

HL7 Electronic Health Record System Functional Model, Release 2.1.1, published by HL7 International / Electronic Health Records. This guide is not an authorized publication; it is the continuous build for version 2.1.1 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/ehrsfm-ig/ and changes regularly. See the Directory of published versions

## : TI.1.7 Secure Data Routing (Function)

Page standards status: Normative

Raw ttl | Download

    @prefix fhir: <http://hl7.org/fhir/> .
    @prefix owl: <http://www.w3.org/2002/07/owl#> .
    @prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
    @prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
    @prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

    # - resource -------------------------------------------------------------------

     a fhir:Requirements ;
      fhir:nodeRole fhir:treeRoot ;
      fhir:id [ fhir:v "EHRSFMR2-TI.1.7"] ; #
      fhir:meta [
        ( fhir:profile [
    fhir:v "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/FMFunction"^^xsd:anyURI ;
    fhir:l <http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/FMFunction>     ] )
      ] ; #
      fhir:language [ fhir:v "en"] ; #
      fhir:text [
    fhir:status [ fhir:v "extensions" ] ;
    fhir:div [ fhir:v "<div xml:lang=\"en\" xmlns=\"http://www.w3.org/1999/xhtml\" lang=\"en\">\n    \n    \n    <div id=\"description\"><b>Description <a href=\"https://hl7.org/fhir/versions.html#std-process\" title=\"Informative Content\" class=\"informative-flag\">I</a>:</b> <div><p>An EHR-S needs to ensure that it is exchanging EHR information with the entities (applications, institutions, directories) it expects. This function depends on entity authorization and authentication to be available in the system. For example, a physician practice management application in an EHR-S might send claim attachment information to an external entity. To accomplish this, the application must use a secure routing method, which ensures that both the sender and receiving sides are authorized to engage in the information exchange. Known sources and destinations can be established in a static setup or they can be dynamically determined. Examples of a static setup are recordings of IP (Internet Protocol) addresses or recordings of DNS (Domain Name System) names. For dynamic determination of known sources and destinations, systems can use authentication mechanisms as described in TI.1. For example, the sending of a laboratory order from the EHR-S to a laboratory system within the same organization usually uses a simple static setup for routing. In contrast, sending a laboratory order to a reference laboratory outside of the organization will involve some kind of authentication process. Provision of a secure network infrastructure is beyond the scope of an EHR-S.</p>\n</div></div>\n    \n    \n    \n    <div id=\"requirements\"><b>Criteria <a href=\"https://hl7.org/fhir/versions.html#std-process\" title=\"Normative Content\" class=\"normative-flag\">N</a>:</b></div>\n    \n    <table id=\"statements\" class=\"grid dict\">\n        \n        <tr>\n            <td style=\"padding-left: 4px;\">\n            TI.1.7#01\n            </td>\n            <td style=\"padding-left: 4px;\">\n            SHALL\n            \n                \n            \n            \n            \n            </td>\n            <td style=\"padding-left: 4px;\" class=\"requirement\">\n                <div><p>The system SHALL conform to function <a href=\"Requirements-EHRSFMR2-TI.1.1.html\">TI.1.1</a> (Entity Authentication) to exchange EHR data only to and from known, authenticated sources and destinations.</p>\n</div>\n                \n            </td>\n        </tr>\n        \n        <tr>\n            <td style=\"padding-left: 4px;\">\n            TI.1.7#02\n            </td>\n            <td style=\"padding-left: 4px;\">\n            SHALL\n            \n                \n            \n            \n            \n            </td>\n            <td style=\"padding-left: 4px;\" class=\"requirement\">\n                <div><p>The system SHALL conform to function <a href=\"Requirements-EHRSFMR2-TI.2.html\">TI.2</a> (Audit) to capture audit information about changes to the status of sources and destinations.</p>\n</div>\n                \n            </td>\n        </tr>\n        \n    </table>\n</div>"^^rdf:XMLLiteral ]
      ] ; #
      fhir:extension ( [
    fhir:url [
    fhir:v "http://hl7.org/fhir/StructureDefinition/structuredefinition-standards-status"^^xsd:anyURI ;
    fhir:l <http://hl7.org/fhir/StructureDefinition/structuredefinition-standards-status>     ] ;
    fhir:value [
    a fhir:Code ;
    fhir:v "normative"     ]
      ] [
    fhir:url [
    fhir:v "http://hl7.org/fhir/StructureDefinition/structuredefinition-wg"^^xsd:anyURI ;
    fhir:l <http://hl7.org/fhir/StructureDefinition/structuredefinition-wg>     ] ;
    fhir:value [
    a fhir:Code ;
    fhir:v "ehr"     ]
      ] ) ; #
      fhir:url [
    fhir:v "http://hl7.org/ehrs/uv/ehrsfmr2/Requirements/EHRSFMR2-TI.1.7"^^xsd:anyURI ;
    fhir:l <http://hl7.org/ehrs/uv/ehrsfmr2/Requirements/EHRSFMR2-TI.1.7>
      ] ; #
      fhir:version [ fhir:v "2.1.1"] ; #
      fhir:name [ fhir:v "TI_1_7_Secure_Data_Routing"] ; #
      fhir:title [ fhir:v "TI.1.7 Secure Data Routing (Function)"] ; #
      fhir:status [ fhir:v "active"] ; #
      fhir:date [ fhir:v "2025-12-13T09:06:06+00:00"^^xsd:dateTime] ; #
      fhir:publisher [ fhir:v "HL7 International / Electronic Health Records"] ; #
      fhir:contact ( [
        ( fhir:telecom [
    fhir:system [ fhir:v "url" ] ;
    fhir:value [ fhir:v "http://www.hl7.org/Special/committees/ehr" ]     ] )
      ] ) ; #
      fhir:description [ fhir:v "Route electronically exchanged EHR data only to/from known and authenticated destinations/sources (according to applicable healthcare-specific rules and relevant standards)."] ; #
      fhir:jurisdiction ( [
        ( fhir:coding [
    fhir:system [
    fhir:v "http://unstats.un.org/unsd/methods/m49/m49.htm"^^xsd:anyURI ;
    fhir:l <http://unstats.un.org/unsd/methods/m49/m49.htm>       ] ;
    fhir:code [ fhir:v "001" ] ;
    fhir:display [ fhir:v "World" ]     ] )
      ] ) ; #
      fhir:purpose [ fhir:v "An EHR-S needs to ensure that it is exchanging EHR information with the entities (applications, institutions, directories) it expects. This function depends on entity authorization and authentication to be available in the system. For example, a physician practice management application in an EHR-S might send claim attachment information to an external entity. To accomplish this, the application must use a secure routing method, which ensures that both the sender and receiving sides are authorized to engage in the information exchange. Known sources and destinations can be established in a static setup or they can be dynamically determined. Examples of a static setup are recordings of IP (Internet Protocol) addresses or recordings of DNS (Domain Name System) names. For dynamic determination of known sources and destinations, systems can use authentication mechanisms as described in TI.1. For example, the sending of a laboratory order from the EHR-S to a laboratory system within the same organization usually uses a simple static setup for routing. In contrast, sending a laboratory order to a reference laboratory outside of the organization will involve some kind of authentication process. Provision of a secure network infrastructure is beyond the scope of an EHR-S."] ; #
      fhir:statement ( [
        ( fhir:extension [
    fhir:url [
    fhir:v "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent"^^xsd:anyURI ;
    fhir:l <http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent>       ] ;
    fhir:value [
    a fhir:Boolean ;
    fhir:v false       ]     ] ) ;
    fhir:key [ fhir:v "EHRSFMR2-TI.1.7-01" ] ;
    fhir:label [ fhir:v "TI.1.7#01" ] ;
        ( fhir:conformance [ fhir:v "SHALL" ] ) ;
    fhir:conditionality [ fhir:v false ] ;
    fhir:requirement [ fhir:v "The system SHALL conform to function [TI.1.1](Requirements-EHRSFMR2-TI.1.1.html) (Entity Authentication) to exchange EHR data only to and from known, authenticated sources and destinations." ] ;
    fhir:derivedFrom [ fhir:v "EHR-S_FM_R1.1 IN.1.7#2" ]
      ] [
        ( fhir:extension [
    fhir:url [
    fhir:v "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent"^^xsd:anyURI ;
    fhir:l <http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent>       ] ;
    fhir:value [
    a fhir:Boolean ;
    fhir:v false       ]     ] ) ;
    fhir:key [ fhir:v "EHRSFMR2-TI.1.7-02" ] ;
    fhir:label [ fhir:v "TI.1.7#02" ] ;
        ( fhir:conformance [ fhir:v "SHALL" ] ) ;
    fhir:conditionality [ fhir:v false ] ;
    fhir:requirement [ fhir:v "The system SHALL conform to function [TI.2](Requirements-EHRSFMR2-TI.2.html) (Audit) to capture audit information about changes to the status of sources and destinations." ] ;
    fhir:derivedFrom [ fhir:v "EHR-S_FM_R1.1 IN.1.7#3" ]
      ] ) . #