EU Health Data API
1.0.0-ballot - ballot 150

EU Health Data API, published by HL7 Europe. This guide is not an authorized publication; it is the continuous build for version 1.0.0-ballot built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/euridice-org/eu-health-data-api/ and changes regularly. See the Directory of published versions

CapabilityStatement: EEHRxF Document Consumer CapabilityStatement

Official URL: http://hl7.eu/fhir/health-data-api/CapabilityStatement/document-consumer-eu-api Version: 1.0.0-ballot
Active as of 2026-01-26 Computable Name: DocumentConsumerEuApi

Copyright/Legal: Copyright HL7 Europe. Licensed under Creative Commons public domain (CC0 1.0).

Requirements for an EEHRxF Document Consumer that queries and retrieves FHIR Documents.

This CapabilityStatement defines the requirements for the EEHRxF Document Consumer actor. The actor consumes EEHRxF FHIR Documents by querying a Document Access Provider.

Actor Grouping

This composite actor groups the following roles:

Transactions

Transaction Description Optionality
ITI-67 Find Document References Query for document metadata from Document Access Provider R
ITI-68 Retrieve Document Retrieve document content from Document Access Provider R
ITI-78 Patient Demographics Query Query for patient demographics to establish patient context R
Get Access Token Obtain authorization token for API access R

Security

Systems SHALL support the IUA or SMART authorization profile selected for their environment and use case.

Raw OpenAPI-Swagger Definition file | Download

Language: en

EEHRxF Document Consumer CapabilityStatement

  • Implementation Guide Version: 1.0.0-ballot
  • FHIR Version: 4.0.1
  • Supported Formats: json, xml
  • Published on: 2026-01-26
  • Published by: HL7 Europe

Note to Implementers: FHIR Capabilities

Any FHIR capability may be 'allowed' by the system unless explicitly marked as 'SHALL NOT'. A few items are marked as MAY in the Implementation Guide to highlight their potential relevance to the use case.

FHIR RESTful Capabilities

Mode: client

The Document Consumer actor queries for document metadata and retrieves documents from a Document Access Provider. It also queries for patient context using PDQm. It groups with the IUA Authorization Client, SMART App, or SMART Backend Service selected by the environment and use case. The Authorization Server is a separate participant; see Authorization.

Security

This abstract requirements statement does not advertise a fixed security service. A concrete deployment SHALL declare exactly one security-service coding from the EU Health Data API Authorization Security Service ValueSet, selected for its environment. It SHALL NOT advertise both services unless a future profile defines dual conformance.

IHE IUA

The consumer groups with the IUA Authorization Client and requests the applicable IUA MHD transaction scopes for its supported transactions:

  • ITI-67
  • ITI-68

PDQm ITI-78 has no IUA MHD transaction scope.

SMART Backend Services

For a pre-authorized system-to-system use case, the consumer groups with the SMART Backend Service, uses client_credentials and private_key_jwt, and requests:

  • system/DocumentReference.rs (read + search DocumentReference - ITI-67)
  • system/Binary.r (read Binary for document retrieval - ITI-68)
  • system/Bundle.r (read Bundle for FHIR Document retrieval - ITI-68)
  • system/Patient.rs (read + search Patient for context - ITI-78)

Interactive SMART

Where an interactive use case applies, the consumer groups with the SMART App, uses authorization code with PKCE, and replaces the system/ prefix above with the applicable patient/ or user/ scope prefix.

All modes use TLS 1.2 or higher. See Authorization for the selected capability set, discovery, token, and scope rules.

Capabilities by Resource/Profile

Summary

The summary table lists the resources that are part of this configuration, and for each resource it lists:

  • The relevant profiles (if any)
  • The interactions supported by each resource (Read, Search, Update, and Create, are always shown, while VRead, Patch, Delete, History on Instance, or History on Type are only present if at least one of the resources has support for them.
  • The required, recommended, and some optional search parameters (if any).
  • The linked resources enabled for _include
  • The other resources enabled for _revinclude
  • The operations on the resource (if any)
Resource TypeProfileRSUCSearches_include_revincludeOperations
DocumentReference YY_id, _lastUpdated, author.given, author.family, category, creation, date, event, facility, format, identifier, patient, patient.identifier, period, related, security-label, setting, status, type
Binary Y
PatientSupported Profiles
  Patient (EU core)		YYidentifier, _id, active, family, given, telecom, birthdate, address, address-city, address-country, address-postalcode, address-state, gender
Core FHIR Resource
DocumentReference
Reference Policy
Interaction summary
  • SHALL support
    read

    Read DocumentReference by logical ID

    search-type

    Search DocumentReference (ITI-67)

Documentation

DocumentReference resources are queried using ITI-67 and returned as base FHIR resources. No EU or MHD return profile is required.

Search Parameters
ConformanceParameterTypeDocumentation
SHALL_idtoken

Logical id

SHALLpatientreference

Patient reference

SHALLpatient.identifiertoken

Chained patient identifier

MAY_lastUpdateddate

Resource version last updated

MAYauthor.givenstring

Author given name

MAYauthor.familystring

Author family name

MAYcategorytoken

Document category

MAYcreationdate

Document creation time

MAYdatedate

Reference creation time

MAYeventtoken

Main clinical acts documented

MAYfacilitytoken

Facility kind

MAYformattoken

Document format

MAYidentifiertoken

Document identifier

MAYperioddate

Documented service period

MAYrelatedreference

Related identifier or resource

MAYsecurity-labeltoken

Document security label

MAYsettingtoken

Clinical setting

MAYstatustoken

Document reference status

MAYtypetoken

Document type

 
Core FHIR Resource
Binary
Reference Policy
Interaction summary
  • SHALL support
    read

    Retrieve document content (ITI-68)

Documentation

Binary resources contain the actual document content and are retrieved using the ITI-68 Retrieve Document transaction.

Core FHIR Resource
Patient
Reference Policy
Interaction summary
  • SHALL support
    read

    Read Patient by logical ID

    search-type

    Search for patients (PDQm ITI-78)

Supported Profiles

Patient (EU core)

Documentation

Patient resources are searched to establish patient context before querying for documents. This uses PDQm [ITI-78] with identifier as a required search parameter.

Search Parameters
ConformanceParameterTypeDocumentation
SHALLidentifiertoken

Patient identifier (e.g., national ID, MRN) - required for patient lookup

SHOULD_idtoken

Patient logical ID

SHOULDactivetoken

Whether the patient record is active

SHOULDfamilystring

Patient family name

SHOULDgivenstring

Patient given name

SHOULDtelecomtoken

Telecom details of the patient

SHOULDbirthdatedate

Patient date of birth

SHOULDaddressstring

A server defined search that may match any of the string fields in the Address, including line, city, district, state, country, postalCode, and/or text

SHOULDaddress-citystring

A city specified in an address

SHOULDaddress-countrystring

A country specified in an address

SHOULDaddress-postalcodestring

A postal code specified in an address

SHOULDaddress-statestring

A state specified in an address

SHOULDgendertoken

Administrative gender of the patient