Healthcare infrastructure and security
How medical data is protected, regulated, exchanged and built on: a reference for hospitals and clinics, health-tech companies, developers, security and compliance teams.
Healthcare data infrastructure is the set of systems, standards and rules that let medical information be stored safely, exchanged between providers and reused under control. In the EU it is shaped by five layers at once: cybersecurity law (NIS2), data protection (GDPR), health data access and reuse (the European Health Data Space), exchange standards (HL7 FHIR R4, HL7 v2, LOINC, SNOMED CT) and the APIs that applications use to read and write records.
Six areas
Cybersecurity
What NIS2 requires from hospitals and health-tech suppliers, how ISO 27001 and ISO 27799 fit in, and the identity and access controls behind secure health apps.
4 guides →Regulations
The laws that govern health data and health software: GDPR Article 9, the European Health Data Space, MDR and IVDR for medical device software, the EU AI Act, and in the US HIPAA, TEFCA and USCDI.
10 guides →Interoperability
How health systems exchange data and understand it the same way: HL7 FHIR R4 and its resources, HL7 v2 messages, CDA, code systems such as LOINC, SNOMED CT and ICD, and the national record systems of Europe.
51 guides →Healthcare APIs
How applications read and write medical data: healthcare and FHIR APIs, free FHIR servers and sandboxes, patient consent, remote monitoring, lab connectors and giving AI assistants controlled access to records.
12 guides →Data governance
Running health data responsibly: data protection impact assessments, de-identification and pseudonymisation, matching records to the right patient, and reusing data for research with OMOP and the EHDS rules on secondary use.
5 guides →Health records and AI
The kinds of health records and who controls them, why patient-held records matter, and what AI needs from medical data: structure, coding, consent and safety.
5 guides →Start with a map
Each map explains a whole area on one page and links to the detailed guides.
RegulationHealth data regulation map: EHDS, GDPR Article 9, MDR and IVDR, IEC 62304, ISO 13485, 27001 and 27799, NIS2, HIPAA, TEFCA and eIDAS
One map of the rules for software handling health data: data protection (GDPR Article 9, HIPAA, US state laws), the EHDS, medical device law (MDR, IVDR, FDA), IEC 62304 and ISO 13485, security (ISO 27001, 27799, NIS2), exchange mandates (TEFCA, USCDI) and eIDAS. Which apply to whom, and in what order.
StandardsHealthcare interoperability standards: the complete map (FHIR, HL7 v2, CDA, DICOM, IHE, openEHR, OMOP)
One map of the standards behind health data: HL7 v2 messages, CDA documents, FHIR resources, DICOM and DICOMweb for images, IHE profiles, openEHR for storage, OMOP for research, and the code systems they all share. What each one does, where it is used in 2026, and which one you need.
SecuritySecurity and identity in health apps: SMART on FHIR, OAuth 2.1, granular consent, access logs and audit, the map
How a health app proves who the user is, what it may access and what it did: OAuth 2.0 and 2.1 with PKCE, OpenID Connect, SMART on FHIR scopes, patient consent as the source of authorisation, break-the-glass, access logs the patient can read, AuditEvent, identity assurance, encryption, and the baseline regulators expect.
ResearchSecondary use of health data: OMOP, real-world data, registries, research consent and the EHDS, the map
Secondary use means using health data collected for care for research, public health or planning. The legal routes (GDPR Articles 9 and 89, national laws, the EHDS permit system, opt-outs, prohibited purposes), the building blocks (de-identification, secure environments, federated analysis, OMOP) and the consent models.
AIAI on medical data: LLMs, MCP, de-identification, synthetic data, provenance and evaluation, the map
What it takes to use large language models and other AI on health records responsibly: where the data comes from, how models reach it (context APIs, MCP, RAG), how patients stay in control, how privacy is protected, how outputs stay traceable, how systems are evaluated, and which rules apply.
Build on interoperable health data
Anpheros Platform is a FHIR R4 API for medical records, with patient consent, a free sandbox and SDKs for Dart, Flutter and TypeScript.
How these pages are written
- Regulatory pages cite the official text first: EUR-Lex for EU law, the European Commission and ENISA for guidance, national laws where they apply.
- Technical pages name the version they describe, for example HL7 FHIR R4 (4.0.1).
- Every page shows when it was published and last reviewed, and separates what the law requires from what we recommend.
- These guides are technical explanations, not legal advice. They do not state that Anpheros or any product is certified or compliant with a law or standard.
- Written and reviewed by the Anpheros team. Found an error? Tell us through the contact page and we correct it.