Cross-organization FHIR data sharing is enabled by specific patterns. Four cover essentially all production use cases in 2026.

**Pattern 1: SMART Backend Services.** Server-to-server integration via JWT assertion + client credentials. Best for automated system-to-system exchange.

**Pattern 2: Bulk Data IG $export.** Payer-to-payer, provider-to-analytics. Best for bulk data movement.

Pattern 3: FHIR Messaging with signed Documents. Legal/regulatory documents via FHIR Document exchange. Best for referrals, transfer of care.

Pattern 4: Direct message + FHIR. Direct message envelope with FHIR payload. Best for provider-to-provider exchange.

Cross-org auth

1. Trust framework (Direct, CommonWell). 2. OAuth 2.0 via SMART Backend Services. 3. Certificate-based auth for high-security. 4. Federation with identity providers.

Data governance

1. Consent tracking via Consent resource. 2. Audit trail via AuditEvent resource. 3. Access limits per organization role. 4. Data retention per regulatory requirements.

Common cross-org challenges

1. Trust framework mismatches. 2. Terminology binding differences. 3. MPI federation complexity. 4. Consent state inconsistency. 5. Audit trail gaps.

Regulatory context

1. HIPAA covers most exchanges. 2. CMS-0057 mandates specific exchanges. 3. State laws vary (e.g., 42 CFR Part 2 for behavioral health). 4. TEFCA governs multi-party exchange.

Vendor state (mid-2026)

Common exchange mistakes

1. No trust framework → integration fails. 2. Missing consent tracking → compliance risk. 3. Terminology drift across orgs → analytics wrong. 4. Weak MPI federation → duplicate patients. 5. No audit trail → HIPAA violation risk.

FHIR data sharing across organizations works when the right pattern is chosen. Match pattern to the use case (system-to-system, bulk, document, or provider-to-provider).