Interoperability's Hard Truth: FHIR Won't Save You Without Semantics

Imagine you are a health IT director at a mid-sized hospital. You've just spent millions on a new EHR, and your physicians are grumbling because the lab results from the reference lab down the street still arrive as faxes. You're about to sign off on a FHIR-based patient portal, but you're haunted by the same question: why is it so hard to move a simple lab value from Point A to Point B?

The answer is not what you think. It's not about APIs or standards—it's about semantics. You can have all the FHIR in the world, but if the lab sends you a code that your system doesn't understand, you've got nothing.

The False Promise of FHIR

Let's be blunt: FHIR is not a silver bullet. It's a modern, developer-friendly standard that uses RESTful APIs and JSON, but it doesn't magically make data interoperable. FHIR R5 defines 157 resources, but a resource is just a container. The real work is in the codes inside those resources.

If you're building a new app, FHIR is the right choice. It's designed for mobile and cloud-native applications. But don't throw out your HL7 v2 interfaces just yet. HL7 v2 has been the workhorse of healthcare data exchange since 1987, and it's still used by more than 95% of U.S. healthcare organizations (HL7 International). That's not a typo. 95%. Your legacy lab system, your ADT feed, your billing claims—they all run on v2.

Why HL7 v2 Still Rules the Backbone

Here's the concrete scenario: your hospital sends an admission, discharge, and transfer (ADT) message to a downstream system. That's HL7 v2. It's fast, it's reliable, and it's deeply embedded. Replacing it with FHIR would be like rewiring your entire electrical grid because you bought a new toaster.

But v2 has a dirty secret: it's flexible to a fault. The same message type can be interpreted differently by different systems. That's why your lab results might show up as “NA” in one system and “Sodium” in another. The structure is there, but the meaning isn't.

The Semantic Layer: Where Interoperability Actually Happens

This is where terminologies come in. You cannot have interoperability without shared codes. LOINC is the international standard for lab observations—it's how you know that “NA” means sodium. SNOMED CT is the standard for clinical terms—it's how you know that “MI” means myocardial infarction, not mitral insufficiency. And ICD-10 is the diagnostic classification that drives billing and public health reporting.

In the U.S., ONC has recognized this by requiring certified health IT to support USCDI, the United States Core Data for Interoperability. USCDI v3, released in July 2022, expanded the data set from 52 to 94 data elements (ONC Standards Bulletin 2022-2). And as of January 1, 2026, USCDI v3 is the baseline for certification (ONC / HHS (HTI-1 Final Rule)). But USCDI is just a list of data classes and elements—it doesn't dictate which codes to use for each element. That's left to implementation guides like US Core.

The US Core Solution (and Its Limits)

US Core is the HL7 implementation guide that translates USCDI into FHIR profiles. It defines the minimum constraints on FHIR resources, including which terminologies to use for specific elements. For example, it mandates LOINC for lab codes and SNOMED CT for problem lists. That's a huge step forward. But US Core is based on FHIR R4, not R5. And it only covers a subset of clinical data—not everything you need for a truly interoperable health system.

So what does this mean for you? If you're a developer or a health IT leader, you need to think in terms of layers. You need FHIR for the interface, but you also need a semantic layer that maps your data to standard terminologies. And you need to understand that even with FHIR and US Core, there will be gaps.

The Security and Compliance Reality

Now let's talk about the elephant in the room: HIPAA. You can't just slap a FHIR API on your system and call it interoperable. You have to protect the data. The HIPAA Security Rule requires administrative, physical, and technical safeguards (eCFR 45 CFR Part 164 Subpart C). That means encryption, access controls, audit logs—the works. NIST SP 800-66 Rev. 2, published in February 2024, is your practical guide to implementing these safeguards (NIST SP 800-66 Rev. 2). Ignore it at your peril.

And the penalties are real. In 2026, the maximum HIPAA penalty for willful neglect not corrected within 30 days is $2,190,294 per violation (Federal Register 2026 CMP Adjustment). That's not a typo. One bad breach can sink a small organization.

The Information Blocking Trap

But here's the flip side: you can't hoard data either. The 21st Century Cures Act made information sharing the expected norm, and the information blocking rule can penalize you for interfering with access, exchange, or use of electronic health information (ONC / HHS (Information Blocking)). The enforcement is real—OIG has authority over health IT developers and HIEs, and HHS has proposed disincentives for providers.

So you're damned if you don't share, and damned if you share insecurely. The answer is to build interoperability on a solid foundation: use FHIR for APIs, but use HL7 v2 for high-throughput legacy workflows. Use LOINC, SNOMED CT, and ICD-10 for semantics. And use NIST guidance to secure it all.

The Bottom Line

Here's my recommendation, and it's not glamorous: don't rip out your HL7 v2 interfaces. Build a hybrid architecture. Use FHIR for new, patient-facing apps, but keep v2 for the core. Invest in terminology mapping. And don't forget the security—it's not optional. If you do that, you'll be ahead of the curve.

Interoperability is not about picking the coolest standard. It's about making data mean the same thing everywhere, and doing it securely. That's the hard truth.

Sources

• ONC / HHS (Health IT) - https://www.healthit.gov/topic/health-it-basics
• HL7 International - https://www.hl7.org/fhir/
• ONC Standards Bulletin 2022-2 - https://healthit.gov/standards-onc-technology/onc-standards-bulletin/onc-standards-bulletin-2022-2/
• NIST SP 800-66 Rev. 2 - https://csrc.nist.gov/pubs/sp/800/66/r2/final
• Federal Register (2026 HIPAA CMP Adjustment) - https://www.federalregister.gov/documents/2026/01/28/2026-01688/annual-civil-monetary-penalties-inflation-adjustment
• ONC / HHS (Information Blocking) - https://www.healthit.gov/topic/information-blocking