Onyx and healthKERI demo HL7 FAST Security with UDAP and vLEI

Onyx and healthKERI say they have shown the first implementation of HL7 FAST Security using UDAP and verifiable Legal Entity Identifier credentials. The demonstration aims to help healthcare organizations verify who is requesting data and why before allowing secure API exchange.

Why it matters: - Healthcare interoperability depends on trust between organizations that often have no prior relationship. - The demonstration points to a more scalable way to confirm organizational identity and authority before data exchange. - The approach could reduce manual onboarding and separate agreements while strengthening security for API-based exchange.

What happened: - Onyx and healthKERI announced a demonstration of HL7® FAST Security using Unified Data Access Profiles, or UDAP, together with verifiable Legal Entity Identifier, or vLEI, credentials. - The demonstration was led by Onyx and healthKERI with participation from DirectTrust, the CARIN Alliance and the Global Legal Entity Identifier Foundation, or GLEIF. - The companies said the work shows how healthcare organizations can verify who is requesting data, under whose authority and for what purpose before enabling secure API exchange. - Onyx said the effort advances trusted healthcare API exchange.

The details: - The implementation combines UDAP, as profiled in the HL7 FAST Security Implementation Guide, with vLEI credentials that provide cryptographically verifiable evidence of organizational identity and delegated authority. - In the demonstration, a requesting organization presents verifiable credentials. - Onyx validates those credentials alongside the request’s role and stated purpose of use. - After the data holder approves access, the requesting system completes UDAP dynamic client registration. - The result is a standards-based method for establishing trust while keeping the data holder in control of access decisions. - Mark Scrimshire, chief interoperability and innovation officer at Onyx, said UDAP has given healthcare a common way to secure connections between organizations, but it has lacked a verifiable way to know which organization stands behind a request, who authorized it and why. - Scrimshire said pairing FAST Security with the vLEI provides a foundation for trusted exchange at scale. - Jared Jeffery, CEO of healthKERI, said trusted healthcare exchange requires more than securing an API connection and needs verifiable evidence of who is making a request and under whose authority. - Jeffery said the work with Onyx shows how that evidence can be incorporated into established interoperability standards.

Between the lines: - The demonstration addresses a growing interoperability problem: proving organizational identity and authority across organizational boundaries, not just encrypting traffic. - The timing matters because health plans are expanding API-based exchange under the CMS Interoperability and Prior Authorization Final Rule, also known as CMS-0057-F. - Payer-to-payer exchange, provider access and prior authorization workflows increase the need for machine-verifiable trust. - The approach could reduce reliance on manual processes that slow down onboarding and partner setup. - The demonstration follows the October 19 announcement by DirectTrust and GLEIF that they plan to develop a Qualification Agent model to support wider vLEI adoption in U.S. healthcare. - The Onyx and healthKERI work shows how vLEI credentials can be used within FHIR API security workflows now, while broader framework development continues.

What's next: - Onyx is offering more information, a preview of the approach and a technical walkthrough at the demonstration site. - Wider adoption would depend on how quickly healthcare organizations adopt vLEI-backed trust workflows alongside existing interoperability standards. - The broader market will be watching whether the model can scale across health plans, providers and delegated partners.

The bottom line: - Onyx and healthKERI are trying to make healthcare API trust machine-verifiable, not manual, by pairing UDAP with vLEI credentials.