Kapstone Hardened FHIR Server

Function

HAPI FHIR on PostgreSQL behind nginx with mutual TLS required. FHIR R4 by default. Offered to the health sector only.

• Runs HAPI FHIR, the open-source reference implementation, on PostgreSQL, behind nginx.
• Requires mutual TLS: every client presents a certificate before any resource can be read or written.
• Defaults to FHIR R4, the version in general use for public health exchange and EHR integration.
• Provides a health department or HIE with a FHIR repository it owns, on infrastructure it controls, with no per-transaction fees.

This image is offered to the health sector only.

Intended use

Public health informatics programs implementing electronic case reporting, immunization or registry pipelines, and HIEs requiring a repository under their own control.

Components

FHIR server

HAPI FHIR (open source)

Database

PostgreSQL

Front end

nginx; mutual TLS required

FHIR version

R4 default

Intended customers

Health departments, HIEs, health systems

Hardening

Baseline shared by every image

• AlmaLinux 9 with the DISA STIG profile applied; all exceptions documented
• FIPS mode enabled at installation; the operating system crypto policy restricts the system to FIPS 140-3 validated cryptographic modules
• SELinux in enforcing mode
• fapolicyd application allow-listing
• auditd configured with the STIG audit rule set
• Authentication by customer-supplied SSH keys only (RSA; ed25519 keys are rejected under FIPS mode)
• Monthly rebuilds with current security updates

Each control is explained on the Compliance page.

Evidence

Documentation issued with every release

• Built on the hardened AlmaLinux 9 base; inherits its evidence pack
• Mutual TLS required at the edge; no anonymous endpoint
• Open-source stack with no proprietary extensions

OpenSCAP scan results

Automated STIG scan output from the exact build deployed.

DISA-format .ckl checklist

Opens in DISA STIG Viewer and can be provided directly to an assessor or ISSO.

SBOM (CycloneDX)

A software bill of materials listing every package and version on the image.

Documented exceptions list

Each open STIG item, the reason it remains open, and the mitigating control. Suitable as POA&M input.

Acquisition

Marketplace listing, free trial and private offers

Free trial: one month on Azure, 30 days on AWS. The software fee is waived; the customer pays the cloud provider for the virtual machine. See Pricing.

Specifications