Data model
FHIR resources internally.
Why. Standard and future-proof.
Trade-off. Mapping effort from legacy HL7 v2.
Industry patterns · Health
Health referral and intake workflow
Structured digital referrals into a clinical service, with consent, secure messaging and clinical system integration, hosted in Australia with strong audit.
A reference architecture from EITSAA, not a named client system. Service limits, prices and product features change, so confirm current details before you commit to a design.
- Privacy Act 1988 and health information obligations
- My Health Records Act (where relevant)
- ACSC Essential Eight
- HL7 FHIR for interoperability
Architecture
- People and clients
- Messaging, events and workflow
- SaaS and business systems
- Object and file storage
- Monitoring, audit and analytics
- Security and identity
- Request or data flow
- Asynchronous or optional
- Boundary: region, account, network or trust zone
Request and data flow
A referrer signs in with SSO. Access is limited to their own referrals.
The patient's consent and contact details are captured and recorded with a timestamp and version of the notice.
A structured referral is submitted. Validation checks mandatory clinical fields and flags urgent categories.
Referral data is stored as FHIR resources so that other systems can consume it.
Attachments are uploaded, scanned and stored encrypted, linked to the referral.
Every view and change is written to an immutable audit trail.
The referral is delivered to the clinical system over a private link, with acknowledgement and retry. Triage stays with clinicians.
Components and why they were chosen
| Component | What it does | Why this choice |
|---|---|---|
| Amazon Cognito federated to the referrer IdP | Authentication. | Reuse organisational identities and MFA. |
| Step Functions workflow and rules | Validation and routing. | Visible state for each referral. |
| AWS HealthLake or a managed FHIR server | FHIR R4 store. | Interoperability by design. |
| S3 with SSE-KMS and malware scan | Attachments. | Encrypted and scanned. |
| Audit store with Object Lock | Access and change history. | Evidence for privacy investigations. |
| Integration engine (Mirth, Rhapsody or Lambda) | HL7 v2 and FHIR messaging. | Clinical systems still speak HL7 v2. |
| Secure messaging | Notifications without clinical detail. | Do not email health information. |
| Private connectivity | VPN or Direct Connect. | Clinical networks are not public. |
Design decisions and trade-offs
Decisions
Clinicians triage, software never prioritises alone.
Why. Clinical safety.
Trade-off. Flags rather than decisions.
Notifications
Minimal content with a link back to the portal.
Why. Limits exposure.
Trade-off. Extra click for users.
Audit
Log reads as well as writes.
Why. Privacy breaches are often inappropriate access.
Trade-off. Higher log volume.
Well-architected pillars
Security
Private networking, IAM Identity Center and Cognito with MFA, encryption with customer-managed keys, least-privilege roles and WAF on the public edge.
Reliability
Multi-AZ services, backups with tested restores and queue-based retries for integrations.
Performance
Edge caching for public content, asynchronous processing for anything slow and indexes tuned to the main queries.
Cost optimisation
Scale with demand, use reservations or savings plans for the steady baseline and set budgets and alerts per environment.
Operational excellence
Infrastructure as code, pipeline deployments with rollback, dashboards on service-level objectives and runbooks for the top failure modes.
Sustainability
Right-size, schedule down non-production and archive data to colder tiers on a retention schedule.
Network, identity and data
Networking
VPC with public, private and isolated data subnets and VPC endpoints. Public ingress only through the edge service with WAF. Private connectivity to on-premises or partner systems by VPN or dedicated link.
Identity and least privilege
Referrers federated with MFA. Patients use verified contact methods. Staff access by role with break-glass logging.
Data and encryption
Health information is sensitive information. Encrypt everywhere with CMKs, restrict region to Australia, minimise data in notifications and retain per the health records schedule.
Security and compliance mapping
| Control | How this design addresses it |
|---|---|
| Multi-factor authentication | Required for staff and administrators. Essential Eight. |
| Restrict administrative privileges | Just-in-time elevation and separate admin accounts. Essential Eight. |
| Regular backups | Automated backups with a copy held outside the workload account or subscription. Essential Eight. |
| Privacy and security of personal information | Encryption, access logging and retention support APP 11. |
| Logging | Central, tamper-resistant logs support ISM event logging guidance and ISMF expectations. |
Mappings show how the design supports each control. They are not certifications, and EITSAA does not claim IRAP assessment or compliance for any reference architecture.
Failure modes, targets and scaling
- Target RTOUnder 4 hours, with referrers able to fall back to existing channels
- Target RPOSeconds to minutes with point-in-time recovery
- Scaling and limitsSized from measured peak demand with a load test before go-live. Check service quotas early.
| Failure mode | Mitigation |
|---|---|
| Clinical system offline | Queue and acknowledge receipt to the referrer, deliver when restored. |
| Lost or duplicated referral | Idempotent delivery with referral IDs and reconciliation. |
| Inappropriate access | Read audit and anomaly alerts. |
| Incorrect data entry | Validation and a correction path (APP 13). |
Observability and runbooks
- Service-level objectives for availability and latency with burn-rate alerts.
- Audit log review for sensitive actions.
- Queue depth and integration error dashboards with a named owner.
Cost drivers and levers
Compute, database, data transfer and licences for any SaaS components.
- Reserve the baseline.
- Schedule non-production down.
- Cache and compress at the edge.
- Archive old data.
Implementation and fit
Phased approach
- Discovery: process, data and obligations mapped with the business owner.
- Foundation: landing zone, network, identity and pipeline.
- Thin slice: one journey end to end in production for a small group.
- Expand and harden: remaining journeys, load and penetration testing.
Anti-patterns to avoid
- Building before the decision rights and audit needs are agreed.
- A single shared admin role.
- Personal data in logs and test data.
- Integrations without retries or a dead-letter path.
When to use it
- Referral, intake and triage support.
- Services replacing fax or PDF forms.
When not to
- Clinical decision support without clinical governance.
- Replacing the clinical record system.
More in industry patterns
Education
Student and learner services platform
One front door for enrolment, support requests and communications, integrated with the student information system and learning platform, with safeguarding built in.
Not-for-profit
Not-for-profit case management and reporting
Case notes, referrals and outcomes tracked securely by small teams, with funder reporting generated from the same data and strict access to sensitive client information.
Professional services
Professional services document intake and extraction
Clients upload documents, the platform classifies and extracts the key data, and a professional reviews the result before it reaches the practice system.
Related insights
Discuss this architecture
Tell us your systems, constraints and timeline. We reply within one business day, and the initial conversation is free.