Framework overlap

Does BSI IT-Grundschutz cover HL7 FHIR Security Framework?

You hold BSI IT-Grundschutz and have been told to do HL7 FHIR Security Framework. Here is how much overlaps, control by control.

43% of HL7 FHIR Security Framework you already have

BSI IT-Grundschutz already covers about 43% of HL7 FHIR Security Framework, leaving 4 of 7 controls as genuinely new work.

Already covered 3 Likely covered 0 New work 4

What is genuinely new work

Nothing in BSI IT-Grundschutz reaches these. This is the list to scope.

HL7-FHIR-Authorization-Scopes-Consent-Bulk-Break-Glass
HL7 FHIR Authorization - OAuth 2.0 Scopes + Security Labels + Consent + Patient Compartment + Bulk Data + Break the Glass
HL7-FHIR-Coord-HIPAA-ONC-Cures-USCDI-TEFCA
HL7 FHIR Coordination with HIPAA, ONC Information Blocking, 21st Century Cures Act, USCDI, TEFCA + 2024-2025 Pipeline
HL7-FHIR-Resilience-RateLimit-CORS-AntiAbuse-SmartHealth
HL7 FHIR Resilience - Rate Limiting + Anti-Abuse + CORS + SMART Health Cards + De-identification + Privacy
HL7-FHIR-Scope-Versions-HL7-Specification
HL7 FHIR Security Framework Scope, FHIR Versions (R4/R4B/R5/R6), HL7 Specification + Security/Privacy Module
Show the 3 you already have
HL7-FHIR-Audit-Provenance-DigitalSignatures-Integrity
HL7 FHIR Audit + Provenance + Digital Signatures + AuditEvent Resource + Audit Log Integrity + Retention
HL7-FHIR-Auth-SMART-OAuth-OIDC-Backend
HL7 FHIR Authentication - SMART App Launch + OAuth 2.0 + OpenID Connect + Backend Services + Token Lifetime
HL7-FHIR-Transport-TLS-Communication
HL7 FHIR Transport Security - TLS 1.2+, Communication Security, Time Keeping, Server CapabilityStatement

How this is calculated

Already covered means a mapping runs from a control in BSI IT-Grundschutz to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition