Integrating with the Healthcare Identifiers Service
Separate developer access, Notice of Connection, conformance testing and customer certificate setup when planning an HI Service integration.
An integration with Australia's Healthcare Identifiers Service needs more than a working connection. The product must identify the right person or provider, handle the service's responses correctly and complete the required testing before production access.
Services Australia manages connection testing, while the Australian Digital Health Agency manages conformance testing. Treat those as separate pieces of work, with their own evidence and dependencies.
Know which identifier the workflow needs
The service distinguishes individuals receiving healthcare, individual healthcare providers and provider organisations. These use an Individual Healthcare Identifier (IHI), Healthcare Provider Identifier–Individual (HPI-I) and Healthcare Provider Identifier–Organisation (HPI-O), respectively.
A patient identifier is not interchangeable with a provider identifier. Map each identifier to the record it belongs to and the decisions it supports. Ask what the application should do when a search returns an unexpected result or the available details do not support a confident match.
The design also needs to distinguish a successful lookup from a completed clinical or administrative task. Receiving an identifier does not establish that every other requirement for that task has been met.
Separate the access and testing stages
Services Australia's developer guidance describes organisation registration through the Health Systems Developer Portal, access to licensed material and the development environment, followed by product testing.
Notice of Connection checks the connection to the service. Conformance testing addresses safe implementation and use of identifiers. Both are mandatory for products developed or updated to connect; Services Australia recommends completing connection testing first. It also recommends conformance testing for products that use identifiers without a direct connection.
| Workstream | What the project needs to establish |
|---|---|
| Developer access | An authorised organisation contact, portal registration and access to the required resources |
| Implementation | Applicable use cases, identifier handling and defined responses to service outcomes |
| Connection testing | A completed NOC process and records of vendor ID, product name and version |
| Conformance | The applicable requirements, evidence and assessment arrangements |
| Customer onboarding | Organisation credentials, permissions and a repeatable setup process |
Design identity handling for ordinary mistakes
Test missing details, changed details and results that require a person to investigate. Make it clear when users should correct a record, repeat a search or seek help. A system that accepts any returned value without showing its context can create a misleading sense of certainty.
Preserve enough history to explain how a record was matched. Limit the personal information in technical logs, and make access to investigation tools appropriate to the support role. Confirm the legal basis for collecting, using and disclosing identifiers for the particular workflow.
Do not turn a short assessment estimate into a delivery commitment. The overall schedule also depends on development readiness, access, test data, issue correction and assessor availability.
Make certificate setup part of onboarding
Production credentials and certificates need an owner at the healthcare organisation. Confirm the applicable authentication arrangements with the service and the customer's authorised administrator. The developer's test access is not a substitute for a customer's production setup.
Record how credentials are installed, protected, renewed and replaced. Include a test for an unavailable or expired credential, so the user sees a useful next step and support staff can identify the cause.
Keep the integration within the whole product plan
The ScriptStream customer story records completed HI Notice of Connection and conformance work within a broader prescribing programme. BOP Plus owns the platform; Twin Global developed it.
For another product, start with a dependency map showing identifiers, prescribing, authentication and any other national services. Give each dependency its own acceptance evidence. This makes it easier to see which integration is ready and which still blocks a complete user journey.