Managing billions of FHIR resources at scale requires a disciplined approach to identity and access management to prevent unauthorized disclosure of protected health information (PHI). In 2026, demand for high-quality clinical data has outgrown the fragmented storage that many enterprise healthcare organizations still use. Regulators are raising the bar on access controls at the same time.
In January 2025, the HHS Office for Civil Rights proposed updating the HIPAA Security Rule to require multi-factor authentication and encryption of electronic PHI, with limited exceptions. The proposal would also require covered entities to verify that business associates comply with technical safeguards. Managed FHIR data stores, offered by the major cloud providers and by specialized health-data vendors, are one response to the combined challenges of interoperability and regulatory rigor.
Whether any of these platforms is compliant is not a yes-or-no question. The real question is how a managed service supports the requirements of the Health Insurance Portability and Accountability Act (HIPAA).
Healthcare leaders must distinguish between a cloud service being eligible for HIPAA workloads and the final implementation actually operating in compliance. This article offers a framework for evaluating clinical data lakes in a modern, security-conscious digital health ecosystem, regardless of the platform an organization chooses.
Access the article to learn more about:
- The controls healthcare organizations need when managing large-scale FHIR data;
- The role of HIPAA safeguards, access management, and auditability in protecting PHI;
- How FHIR-native infrastructure supports clinical data exchange and real-world evidence;
- The architectural choices that help organizations keep clinical data secure as its use expands.
Establishing a Foundation: The Business Associate Agreement
A compliant data architecture begins with a Business Associate Agreement (BAA) between the healthcare entity and the cloud or platform provider. The BAA carries real weight because it defines the shared responsibility model for PHI. Most major cloud providers designate specific services as HIPAA-eligible, meaning those services can process PHI once a BAA is in place. Google Cloud, for example, states that its BAA covers only a listed set of products and that the list is updated as new products join its HIPAA program. It also states that HIPAA compliance is a shared responsibility between the customer and Google.
Eligibility lists differ between providers and change over time, so decision-makers should check the current list for every service in the data pipeline. They should also confirm that every account or subscription used to ingest or transform patient records is covered by the agreement. Without a properly executed BAA, no technical configuration, however robust, will hold up in a federal or third-party audit.
HIPAA Security Rule Safeguards
Alongside the legal framework, the Security Rule’s technical safeguards call for a thorough encryption strategy for data at rest and in transit. Managed FHIR services typically integrate with the provider’s key management service, so organizations can use customer-managed keys for finer control over data access. Key control matters more as clinical repositories expand to include sensitive genomic data or longitudinal patient histories.
Requiring Transport Layer Security (TLS) on all requests keeps data encrypted during high-volume transfers from electronic health record systems to the cloud store. Identity and access management should follow the principle of least privilege so only authenticated applications and authorized staff can access the underlying resources. Automated credential rotation and short-lived tokens and sessions further reduce the risk of credential theft. NIST’s 2025 digital identity guidelines set the benchmark. They require authentication to run over authenticated, protected channels and, at the highest assurance level, they require reauthentication at least every 12 hours.
The Role of Native FHIR Support
The main value of a managed clinical data store is native support for Fast Healthcare Interoperability Resources (FHIR), the standard that now anchors federal interoperability policy. CMS is building a FHIR-based API that lets apps find provider networks, and it plans to offer FHIR-based digital insurance cards. In July 2025, more than 60 companies pledged to work with CMS on a patient-centric health data ecosystem.
A FHIR-native store indexes records from different sources into a consistent format, which makes exchange across the care continuum easier. That consistency also supports data integrity and quality assurance. When providers use common search parameters and resources, analytics can rely on a unified view of each patient’s care.
This reduces the ambiguity common in legacy formats, where mismatched fields can lead to clinical errors or reporting inaccuracies. Organizations should evaluate each platform’s support for FHIR versions, implementation guides, and bulk import and export, because these capabilities will shape how quickly they can respond to regulatory demands for transparency and patient access.
Auditing and Risk Mitigation Strategies
Staying compliant over time requires a monitoring and audit framework with full visibility into every interaction with the clinical data store. Cloud-native audit logging, together with threat detection and security monitoring tools from the platform provider or a third party, can capture a full record of API calls, resource changes, and authentication attempts. The HIPAA Security Rule requires audit controls, and regulators enforce them. In May 2025, BayCare paid $800,000 to settle an HHS Office for Civil Rights investigation. The investigation began after credentials belonging to a former staff member at an affiliated physician’s practice were used to access a patient’s records, and OCR found a potential failure to regularly review information system activity records.
Tamper-resistant logs help security teams quickly detect and respond to anomalous behavior. In clinical research, tracing the provenance of each data point also underpins scientific validity. Automated alerts should notify administrators of any attempt to change access policies or bypass security controls, so that vulnerabilities are found and fixed before they can be exploited. Regular architecture reviews help keep the environment from drifting away from its approved configuration.
Private Connectivity and Network Safety
Network security is another pillar of a secure clinical data lake. The design should minimize exposure to the public internet. With private endpoints or private networking options, which all major cloud providers offer, traffic between an organization’s infrastructure and the FHIR store can stay off the public internet. This isolation reduces exposure to a large class of external threats, including distributed denial-of-service attacks and unauthorized scanning. Firewall rules, security groups, and network access control lists should limit inbound and outbound traffic to the ports and address ranges that are actually needed. CISA’s 2025 zero trust guidance supports this approach. It describes microsegmentation as a critical component of zero trust architecture that reduces the attack surface, limits lateral movement, and improves visibility into smaller, isolated groups of resources.
This kind of segmentation limits the impact on stored PHI if another part of the network is compromised. Organizations operating across regions must also manage cross-region data transfers under strict encryption and data-residency rules as part of their broader governance strategy.
Real-World Evidence Applications
As clinical data lakes mature, generating real-world evidence has become a central goal for providers and payers alike. Linking de-identified longitudinal records across sources gives a fuller picture of drug performance and health outcomes outside controlled trials. Regulators increasingly accept such data in submissions on the safety and effectiveness of medical products. In December 2025, the FDA issued final guidance on how it judges whether real-world data are of sufficient quality to support regulatory decisions on medical devices.
Bulk export capabilities, whether native to the platform or built on standard FHIR bulk data operations, let teams move curated datasets into dedicated analytics environments for advanced statistical modeling. This workflow must be handled carefully so that any secondary use of data complies with patient consent and privacy rules. Keeping primary clinical care workflows clearly separate from secondary research environments lets organizations get value from their data while protecting patient privacy.
Looking Toward Future Health Outcomes
A managed FHIR data store can give healthcare organizations a more consistent foundation for clinical data, but its value depends on the controls surrounding it. Organizations need clear responsibility between providers and customers, tightly managed access, reliable audit trails, and secure routes for moving data into research environments.
As clinical data supports more uses across care, analytics, and real-world evidence, these controls become part of the data architecture itself. A sound approach keeps PHI protected while giving authorized teams reliable access to the information they need.
