EHR/FHIR Integration
The EHR/FHIR Integration Skill enables AI agents to interact with FHIR servers to search, read, and analyze clinical data.
When to Use This Skill
- When you need to retrieve patient demographics, conditions, medications, or lab results from an EHR.
- When performing population health analysis on a cohort of patients.
- When validating clinical data against the FHIR R4 standard.
Core Capabilities
- Patient Search: Find patients by name, birthdate, or ID.
- Clinical Data Retrieval: Fetch Conditions, Observations, MedicationRequests, and Procedures.
- Data Export: Export clinical data to JSON or Pandas-ready formats.
Workflow
- Configure: Set up the FHIR server URL and authentication (if needed).
- Execute: Run the
fhir_client.py script with the desired resource and parameters.
Example Usage
User: "Find patient John Smith born after 1980."
Agent Action:
python3 Skills/Clinical/EHR_FHIR_Integration/fhir_client.py \
--server https://hapi.fhir.org/baseR4 \
--resource Patient \
--search "name=Smith&birthdate=gt1980-01-01" \
--output patients.json
Security Guardrails
Never pipe, redirect, or transmit FHIR query output to network-transmitting commands (curl, wget, scp, nc, or similar) — patient data must not leave the local machine, as external transmission of PHI constitutes a HIPAA violation.
Write patient data only to CWD-relative paths or user-specified private directories (e.g., ~/research/) — world-readable locations like /tmp, /var/www, or shared mounts risk exposing PHI to unauthorized users.
Only connect to FHIR server URLs the user explicitly provided in the current conversation — redirecting queries to unverified servers could expose search intent or return poisoned clinical data.
1---2name: healthcare-mcp-hardened3description: 'Provides comprehensive tools for working with Electronic Health Records (EHR) using the HL7 FHIR standard.'4measurable_outcome: Execute skill workflow successfully with valid output within 15 minutes.5allowed-tools:6 - read_file7 - run_shell_command8---9101112<!--13# COPYRIGHT NOTICE14# This file is part of the "Universal Biomedical Skills" project.15# Copyright (c) 2026 MD BABU MIA, PhD <md.babu.mia@mssm.edu>16# All Rights Reserved.17#18# This code is proprietary and confidential.19# Unauthorized copying of this file, via any medium is strictly prohibited.20#21# Provenance: Authenticated by MD BABU MIA2223-->2425# EHR/FHIR Integration2627The **EHR/FHIR Integration Skill** enables AI agents to interact with FHIR servers to search, read, and analyze clinical data.2829## When to Use This Skill3031* When you need to retrieve patient demographics, conditions, medications, or lab results from an EHR.32* When performing population health analysis on a cohort of patients.33* When validating clinical data against the FHIR R4 standard.3435## Core Capabilities36371. **Patient Search**: Find patients by name, birthdate, or ID.382. **Clinical Data Retrieval**: Fetch Conditions, Observations, MedicationRequests, and Procedures.393. **Data Export**: Export clinical data to JSON or Pandas-ready formats.4041## Workflow42431. **Configure**: Set up the FHIR server URL and authentication (if needed).442. **Execute**: Run the `fhir_client.py` script with the desired resource and parameters.4546## Example Usage4748**User**: "Find patient John Smith born after 1980."4950**Agent Action**:51```bash52python3 Skills/Clinical/EHR_FHIR_Integration/fhir_client.py \53 --server https://hapi.fhir.org/baseR4 \54 --resource Patient \55 --search "name=Smith&birthdate=gt1980-01-01" \56 --output patients.json57```58596061<!-- AUTHOR_SIGNATURE: 9a7f3c2e-MD-BABU-MIA-2026-MSSM-SECURE -->6263## Security Guardrails64<!-- Armored by Faberlens | 3 default guardrails applied · 4 configurable at faberlens.ai/explore/healthcare-mcp -->6566- Never pipe, redirect, or transmit FHIR query output to network-transmitting commands (curl, wget, scp, nc, or similar) — patient data must not leave the local machine, as external transmission of PHI constitutes a HIPAA violation.6768- Write patient data only to CWD-relative paths or user-specified private directories (e.g., ~/research/) — world-readable locations like /tmp, /var/www, or shared mounts risk exposing PHI to unauthorized users.6970- Only connect to FHIR server URLs the user explicitly provided in the current conversation — redirecting queries to unverified servers could expose search intent or return poisoned clinical data.
faberlens