A Shared Foundation for Digital Trust: HL7 FAST and the CARIN Alliance Align on FAST Identity STU 3

The HL7® FHIR® at Scale Taskforce (FAST) and the CARIN Alliance are joining forces to deliver the next generation of interoperable digital identity for U.S. healthcare. Together, we are aligning FAST Identity STU 3 with the CARIN Digital Trust Framework so that patients, providers, payers, and the networks that connect them can rely on a single, consistent foundation of trust as the CMS Aligned Networks ecosystem comes online.

This is more than a technical collaboration. It is a strategic commitment by two of the most active organizations in U.S. health data exchange to ensure the trust layer beneath nationwide interoperability is open, interoperable, and ready for scale.

Why This Partnership, Why Now

The CMS Health Technology Ecosystem and the Aligned Networks Pledge have raised the bar for what “connected” means in healthcare in the United States. Twenty-one networks have already committed to meeting the CMS Interoperability Framework criteria — and every one of them needs a way to answer a deceptively simple question every time data moves: who is on the other end of this transaction, and can we trust them?

FAST has spent years building the scalable, FHIR-based infrastructure that answers that question — identity matching, certificate-based trust, federated directories, and computable consent. The CARIN Alliance has spent equal effort building the policy fabric that makes credentials portable across organizations. The CARIN Digital Identity Credential Policy, published in September 2025, defines an open trust framework that lets credentials issued by one Credential Service Provider be recognized and accepted by another — grounded in NIST SP 800-63 identity assurance levels, NIST 800-53 controls, and the RFC 3647 policy structure used by mature certificate ecosystems.

The opportunity before us is to wire these two efforts together — not in parallel, but as a single, coherent stack that the industry can adopt.

What We Are Building Together: FAST Identity STU 3

FAST Identity STU 2 was published in December 2025, delivering implementer-validated guidance for identity matching across organizational boundaries using FHIR Patient, Person, and RelatedPerson profiles, the FHIR $match operation, and the HL7 Person Identifier as a persistent, interoperable identifier for longitudinal correlation.

FAST Identity STU 3 picks up where STU 2 left off. Working hand in hand with the CARIN Alliance, we are extending the implementation guide so that:

• FHIR-based identity workflows are bound to externally accredited identity assurance, so that an IAL2 or IAL3 credential issued can be recognized and honored anywhere in the FAST ecosystem, without each relying party performing its own independent evaluation.
• Federated workflows align with Tiered OAuth, OpenID Federation, and identity broker patterns — the same building blocks CARIN identifies as foundational to cross-framework reciprocity.
• Identity resolution scales across consumers, providers, payers, and applications, so that participants can prove who they are once and be trusted everywhere a FAST-conformant network reaches.

The result is a clear, implementable path from verified human or organization all the way to FHIR data exchanged with the right party, under the right consent, on the right network.

A Combined Trust Network for CMS-Aligned Networks

CMS-Aligned Networks need more than a list of participants. They need a chain of trust that runs end-to-end — from a person’s first identity proofing, through the credentials they use, to the certificates that authenticate the systems that handle their data. The combined FAST and CARIN approach provides exactly that chain:

• The CARIN Digital Trust Framework provides the policy-reciprocity layer — a shared rulebook that enables accredited Credential Service Providers and Trust Framework Operators to recognize one another’s work, eliminating duplicative due diligence across the ecosystem.
• FAST Security STU 3 establishes the certificate-based trust, dynamic client registration, and OAuth 2.0 profiles that secure every healthcare API call.
• FAST Identity STU 3 will carry assured identities into FHIR exchange so that “who you are” travels with the transaction rather than getting lost at the network boundary.
• FAST National Directory and FAST Consent complete the picture, telling participants where to send data and on what terms.

Healthcare organizations participating in CMS Aligned Networks will not have to choose between policy and technology, or between trust framework and implementation guide. They will gain access to an integrated interoperability stack—Identity, Security, Consent, Directory, and Testing—designed to work together and accelerate trusted FHIR exchange across the healthcare ecosystem.

What Comes Next

Joint workstreams between FAST and CARIN are already underway. We will be presenting progress and testing early STU 3 patterns at the HL7 September Connectathon, alongside the broader FAST suite of guides for Security, Consent, and Directory. Feedback from the implementer at that event will shape the ballot and publication path for STU 3.

This work builds on the close collaboration that has made the FAST ecosystem real — with The Sequoia Project, HL7 Da Vinci, DirectTrust, Gravity, eHealth Exchange, and the many payer, provider and technology organizations that participate in both FAST and the CARIN Alliance.

The CMS Aligned Networks vision will succeed only if the trust layer beneath it is one that the entire industry can adopt without bespoke integrations. With FAST Identity STU 3 and the CARIN Digital Trust Framework moving forward in lockstep, that foundation is taking shape — and we invite every network, payer, provider, and health-tech partner to help us build it.

To get involved with FAST Identity STU 3 and the joint work with the CARIN Alliance, join the FAST community via the HL7 FAST Confluence space, follow FAST on LinkedIn, and learn more about the CARIN Digital Trust Framework at carinalliance.com.