Medplum Project Access Controls Define Security Boundary for FHIR Endpoints

Medplum pairs its FHIR API with authentication, project membership, and access policies, so a publicly reachable endpoint may still guard clinical data through project-level decisions. The article argues that security reviews should separate the application host, the FHIR project, and the identity that reaches it. It notes that a small count of Medplum title matches in ZoomEye does not show whether those systems are test environments or hold real patient records. Guidance covers verifying identity-provider matching, testing read, write, search, and batch operations against access policies, and monitoring audit events and policy changes. The author recommends confirming that reverse proxies and gateways cannot be bypassed and that outdated client base URLs do not keep sending data to retired projects.