FHIR Signature Datatype:⁣ Ready for Normative Status in R6?

⁣ Updated June 01, 2025

The ⁤FHIR community⁢ is considering⁢ making the FHIR Signature Datatype normative in ⁤the upcoming FHIR R6 release. Ballots will gauge community interest in elevating ⁢this datatype, which has not ⁣yet garnered significant attention.

The FHIR ⁣Signature‍ Datatype focuses on the FHIR structure, ⁣while the actual digital signature is governed by standards like XML-Signature and JSON signature. This reduces the risk associated with making the datatype normative.

The datatype exposes key signature elements⁤ in an easily processed FHIR structure. These elements are copies for convenience, requiring processing of ⁣the digital signature blob ‍for verification.‍ The signature Datatype itself isn’t cryptographically protected,‍ but the digital signature blob is.

Electronic vs. Digital Signatures

If cryptographic protection ⁤isn’t needed, the FHIR Signature Datatype suffices for electronic signatures. In this case, the infrastructure⁤ is trusted, and the datatype carries details about⁣ the signature’s meaning, timestamp, ⁣signer, and signing delegation.

Electronic signatures, ⁤legally recognized in many jurisdictions, provide standardized tracking of signing events. An image of a handwritten signature can ⁢be included as a rendering, though not cryptographically proven.

Digital signatures offer standards-based cryptographic proof, eliminating the need ⁤to trust⁤ the technology. These signatures⁢ rely ⁤on standards like XML-Signature or ⁢JSON-Signature to create a mathematical proof of content integrity.

Success with digital signatures hinges on agreed key management, signature standards, timestamp usage, FHIR ⁣content encoding, and ⁢elements that⁣ must remain unchanged.

Digital Signature Standards and Canonicalization

Profiles of XML-Signature⁣ and JSON Signature ⁤exist directly below the FHIR Signature Datatype. These⁣ standards emphasize⁤ the long-term need ⁤for digital ⁢signatures, acknowledging potential delays ⁢between signing and validation.

Canonicalization, a critical aspect of ⁣digital signatures, ensures that‍ validation uses the same elements, order, and encoding as the signer. While more mature in⁢ XML,‍ the⁢ concept is also understood in⁣ JSON.

Selecting a canonicalization algorithm depends on the use-case, specifically what changes are‍ permissible while preserving the ⁢signer’s ⁣intent. As‍ a notable example,in medication prescriptions,the MedicationRequest.status might change over time without affecting the prescription’s validity.

The signature blob indicates the canonicalization algorithm used, requiring validator agreement on its use, ⁣signature purpose, signing time, and signer.

Signers and validators ‍must‍ agree on the format (JSON/XML) and canonicalization.The ‍Signature datatype can accommodate multiple signatures for ⁤environments requiring signers to sign in‍ various ways.

Signature ⁢Chaining with Provenance

Signing the entire resource is ideal, achievable through server-side versioning. When a medication status changes, a new version is created with updated Provenance, documenting who, ‍what, where, when, and why⁤ the change occurred.

This ⁣Provenance can state that the signature was validated before the change and ⁣provide the new signature after⁤ the change. The Provenance.signature blob on an update covers both the original and updated versions.

A policy is needed for signature derivation during ⁢updates versus creations, ensuring cryptographic proof. This ⁤method, ⁤using ⁢resource versioning and provenance signature transition proofs, applies to any change, including maintenance updates.

Validators must check‍ all Provenance.signature entries back to the original, one by one.

What’s next

While the FHIR ⁣Signature⁣ Datatype is likely ready for normative status in FHIR R6, further work is needed on digital signature standards, encoding, canonicalization, and timestamping. High-value,‍ use-case-specific⁢ Implementation Guides ⁤are crucial next steps, as a generic solution may not be feasible.