Regional Health Information Exchange

Problem

A regional health authority runs 40 hospitals and 600 clinics for 4 million patients. Eight different electronic health record (EHR) systems emit HL7 v2 messages, FHIR, or only CSV and PDF files. A clinician in one hospital cannot see history from another. A new law requires a shared patient summary and citizen-controlled consent. About 15% of patients have no national identifier. The volume is about 20 million messages per day, and no message may be lost.

Approach

Two constraints shape the design: eight heterogeneous sources, and consent that must hold on every read, including bulk reads. The design keeps the raw message unchanged and converts it to one canonical FHIR R4 model. Identities are linked reversibly, and consent is enforced as a policy at read time. One Apache Camel adapter per EHR writes raw messages to Kafka. The adapter acknowledges the sender only after Kafka confirms the write.

Architecture

• Ingestion: Camel adapters for HL7 v2, FHIR and files. Kafka keys are source plus record number, so order is kept per patient.
• Canonical store: a transformation service maps to FHIR profiles and writes to HAPI FHIR on PostgreSQL with idempotent transactions. Raw bytes stay in Ceph with Object Lock.
• Identity: Splink probabilistic matching feeds a link table, so a merge is a row that can be undone.
• Access: Keycloak for SMART on FHIR, APISIX as the only door, Open Policy Agent for consent.
• Audit and research: every read becomes an audit event in immudb. A Flink job de-identifies data for the university.

Decisions and trade-offs

• Consent in OPA, not inside the FHIR server. One policy bundle must run in the gateway, the FHIR search interceptor and the Flink research job. Authorisation embedded in HAPI would have to be rewritten for research. OPA returns a filter, not allow or deny, so bulk export is filtered per record. The cost is another component to operate. If consent applied only at the API, HAPI’s own interceptor would do.
• Matching favours false negatives. Scores of 0.99 and above link automatically. Between 0.85 and 0.99 the records wait for a human. A false merge puts another patient’s allergies into the summary. A false negative means missing history, which is today’s state anyway. The cost is a human review queue. A real-time national ID lookup would shrink the probabilistic share.
• Patient summary precomputed at write time. One read keeps p95 under 500 ms; the cold path needs eight FHIR searches. The cost is recomputation on every change, plus cache invalidation. A consent change clears the cached summary within seconds, and the cache key carries the consent version, so an old version never hits.
• Emergency access is not blocked. Break-the-glass needs a justification, a privacy officer review within 48 hours and a weekly check, and the patient sees it in the app. Blocking would harm patient safety. Not logging would harm trust. The cost is that control happens after the fact.
• Keep raw bytes and replay, never ask the hospital again. The adapter sends its acknowledgement only after the Kafka commit. Raw messages stay 30 days in Kafka and ten years in Ceph. When a transformation bug appears, I fix the adapter and replay. Writes are conditional updates by source identifier, so replay is safe. The cost is storage.
• Warm standby, not active-active. Active-active PostgreSQL would need multi-master writes and would strain FHIR versioning. A warm standby with streaming replication meets the two-hour recovery target and is far simpler. The cost is a small window: acknowledged messages not yet copied are re-requested from vendors by message ID range.

What I would revisit

• Vendor delivery behaviour. Do the five HL7 v2 vendors really wait for the acknowledgement and retry, or fire and forget? The no-loss guarantee and the re-request by message ID depend on it.
• National ID registry. Is there a real-time lookup, and with what service level? Without it, matching stays fully probabilistic.
• Sensitive data categories. Which categories does the law define beyond mental health, sexual health and genetics? Mapping them to FHIR security labels needs clinical sign-off.
• Consent default. Opt-out or opt-in does not change the architecture, but it sets day-one behaviour and communication.

Outcome notes (design assumptions, not measurements)

This is a design exercise, not a running system. The output is a four-page diagram set, a one-page whiteboard version and a 15-page Turkish PDF. Capacity figures, such as about 230 messages per second on average, are arithmetic from the kata brief, not measurements.

Sources

• Architecture PDF (Turkish, 15 pages).
• draw.io diagrams (English labels): four-page set and a one-page 30-minute version.