Skip to content
HealthTAG Hospital Module

System architecture

Runtime flow

Section titled “Runtime flow”
flowchart LR
  Lambda["HealthTAG Lambda on AWS"] -->|Patient query :9000| API["Hospital API"]
  External["Approved FHIR clients"] -->|HTTPS :443| Kong["Kong proxy :8443"]
  Kong -->|/fhir-api or /fhir-api-key-auth| HAPI["HAPI FHIR :8080"]
  API -->|FHIR_URL + hospital FHIR_API_KEY| Kong
  API -->|validate-access| Cloud["Upstream HealthTAG API"]
  API -->|authorization query| Chain["Harmony RPC"]
  Transformer["FHIR Transformer"] -->|FHIR_SERVER_URL| HAPI
  HAPI --> HAPIDB[("HAPI PostgreSQL")]
  Kong --> KongDB[("Kong PostgreSQL")]

The HealthTAG Lambda calls the Hospital API from AWS. The Hospital API then calls the hospital’s FHIR server through Kong with the hospital-managed FHIR_API_KEY. Compose publishes both the Hospital API and HAPI ports, so firewall rules must limit the API to approved HealthTAG callers and prevent direct public access to HAPI.

Active services

Section titled “Active services”
Service Role Host exposure Persistence
api Consent-aware patient API 9000:9000 Source bind mount
fhir-transformer Converts hospital data to FHIR None workingdir, healthtag
hapi-fhir-jpaserver-start FHIR repository 8080:8080 hapi-data
hapi-fhir-postgres HAPI database None hapi-postgres-data
kong TLS gateway and authentication 443:8443, 8444:8444 TLS bind mount
kong-postgres Kong configuration database None kong-postgres-data
kong-migration Kong schema migration task None None

file-uploader and web are disabled in Compose. The user-portal is legacy and should not be enabled without a separate review.

Trust boundaries

Section titled “Trust boundaries”
  • HealthTAG access: Hospital API port 9000, restricted to approved HealthTAG Lambda traffic.
  • FHIR access: normally Kong HTTPS on host port 443; the hospital decides which clients may connect.
  • Administrative: Kong Admin API/GUI and database access; never expose these broadly.
  • Internal: Docker network hapi-fhir-network for service-to-service traffic.
  • External dependencies: upstream HealthTAG API and Harmony RPC.

Operators can continue with production deployment. Developers may want to read the FHIR data flow first.