Skip to content

Commit 88e22ff

Browse files
ktoliverktoliver
authored
Merge pull request #266874 from ShawnJackson/import-fhir-data
[AQ] edit pass: Two articles about importing FHIR data
2 parents d1986ff + 338abc0 commit 88e22ff

File tree

3 files changed

+193
-172
lines changed

3 files changed

+193
-172
lines changed

‎articles/healthcare-apis/fhir/configure-import-data.md

Lines changed: 93 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -9,140 +9,152 @@ ms.date: 06/06/2022
99
ms.author: kesheth
1010
---
1111

12-
# Configure bulk-import settings
13-
In this document we go over the steps to configure settings on the FHIR service for $import operation. To learn about import capabilties FHIR service offers, see [$import operation](import-data.md).
12+
# Configure FHIR import settings
1413

15-
To configure settings you will need to -
16-
1. Enable managed identity on the FHIR service.
17-
1. Create an Azure storage account or use an existing storage account, and then grant permissions to the FHIR service to access it.
18-
1. Set the import configuration in the FHIR service.
14+
This article walks you through the steps to configure settings on the FHIR service for `import` operations. To configure settings, you need to:
1915

20-
## Step 1: Enable managed identity on the FHIR service
16+
1. Enable a managed identity on the FHIR service.
17+
1. Create an Azure storage account or use an existing storage account, and then grant permissions to the FHIR service to access it.
18+
1. Set the import configuration of the FHIR service.
19+
1. Use one of the options to securely import FHIR data into the FHIR service from an Azure Data Lake Storage Gen2 account.
2120

22-
The first step is to enable system wide managed identity on the service. This will be used to grant FHIR service access to the storage account.
23-
For more information about managed identities in Azure, see [About managed identities for Azure resources](../../active-directory/managed-identities-azure-resources/overview.md).
21+
## Step 1: Enable a managed identity on the FHIR service
2422

25-
Follow the steps to enable managed identity on FHIR service
26-
1. Browse to your FHIR service in the Azure portal.
27-
2. Select the **Identity** blade.
28-
3. Select the **Status** option to **On** , and then select **Save**.
29-
4. Select **Yes** to enable the managed identity for FHIR service.
23+
The first step is to enable a system-wide managed identity on the service. This identity is used to grant FHIR service access to the storage account. For more information about managed identities in Azure, see [About managed identities for Azure resources](../../active-directory/managed-identities-azure-resources/overview.md).
3024

31-
After the system identity has been enabled, you'll see a system assigned GUID value.
25+
To enable a managed identity on the FHIR service:
3226

33-
[![Enable Managed Identity](media/export-data/fhir-mi-enabled.png)](media/export-data/fhir-mi-enabled.png#lightbox)
27+
1. In the Azure portal, browse to your FHIR service.
28+
2. On the left menu, select **Identity**.
29+
3. Set the **Status** option to **On**, and then select **Save**.
30+
4. Select **Yes**.
3431

32+
After you enable the managed identity, a system-assigned GUID value appears.
3533

36-
## Step 2: Assign permissions to the FHIR service to access the storage account
34+
[![Screenshot that shows selections for enabling a managed identity for the FHIR service.](media/export-data/fhir-mi-enabled.png)](media/export-data/fhir-mi-enabled.png#lightbox)
3735

38-
Follow the steps below to assign permissions to access the storage account
39-
1. Browse to the **Access Control (IAM)** in the storage account.
40-
2. Select **Add role assignment**. During this step, if the add role assignment option is grayed out, you need to ask your Azure Administrator to assign you permission to perform this step.
41-
For more information about assigning roles in the Azure portal, see [Azure built-in roles](../../role-based-access-control/role-assignments-portal.md).
42-
3. Add the role [Storage Blob Data Contributor](../../role-based-access-control/built-in-roles.md#storage-blob-data-contributor) to the FHIR service.
36+
## Step 2: Assign permissions to the FHIR service
37+
38+
Use the following steps to assign permissions to access the storage account:
39+
40+
1. In the storage account, browse to **Access Control (IAM)**.
41+
2. Select **Add role assignment**. If the option for adding a role assignment is unavailable, ask your Azure administrator to assign you permission to perform this step.
42+
43+
For more information about assigning roles in the Azure portal, see [Azure built-in roles](../../role-based-access-control/role-assignments-portal.md).
44+
3. Add the [Storage Blob Data Contributor](../../role-based-access-control/built-in-roles.md#storage-blob-data-contributor) role to the FHIR service.
4345
4. Select **Save**.
4446

45-
[![Screen shot of the Add role assignment page.](media/bulk-import/add-role-assignment-page.png)](media/bulk-import/add-role-assignment-page.png#lightbox)
47+
[![Screenshot of the page for adding a role assignment.](media/bulk-import/add-role-assignment-page.png)](media/bulk-import/add-role-assignment-page.png#lightbox)
4648

4749
Now you're ready to select the storage account for import.
4850

49-
## Step 3: Set import configuration of the FHIR service
51+
## Step 3: Set the import configuration of the FHIR service
5052

5153
> [!NOTE]
52-
> If you haven't assigned storage access permissions to the FHIR service, the import operations ($import) will fail.
54+
> If you haven't assigned storage access permissions to the FHIR service, the `import` operation will fail.
5355
54-
For this step you need to get request URL and JSON body. Follow the directions below
55-
1. Browse to the Azure portal of your FHIR service.
56+
For this step, you need to get the request URL and JSON body:
57+
58+
1. In the Azure portal, browse to your FHIR service.
5659
2. Select **Overview**.
5760
3. Select **JSON View**.
58-
4. Select the API version to **2022-06-01** or later version.
61+
4. Select the API version as **2022-06-01** or later.
62+
63+
To specify the Azure storage account in JSON view, you need to use the [REST API](/rest/api/healthcareapis/services/create-or-update) to update the FHIR service.
64+
65+
[![Screenshot of selections for opening the JSON view.](media/bulk-import/fhir-json-view.png)](media/bulk-import/fhir-json-view.png#lightbox)
5966

60-
To specify the Azure Storage account in JSON view, you need to use [REST API](/rest/api/healthcareapis/services/create-or-update) to update the FHIR service.
61-
[![Screenshot of Get JSON View](media/bulk-import/fhir-json-view.png)](media/bulk-import/fhir-json-view.png#lightbox)
67+
The following steps walk you through setting configurations for initial and incremental import modes. Choose the right import mode for your use case.
6268

63-
Below steps walk through setting configurations for initial and incremental import mode. Choose the right import mode for your use case.
69+
### Set the import configuration for initial import mode
6470

65-
### Step 3a: Set import configuration for Initial import mode.
66-
Do following changes to JSON:
67-
1. Set enabled in importConfiguration to **true**.
68-
2. Update the integrationDataStore with target storage account name.
69-
3. Set initialImportMode in importConfiguration to **true**.
70-
4. Drop off provisioningState.
71+
Make the following changes to JSON:
7172

72-
[![Screenshot of the importer configuration code example](media/bulk-import/import-url-and-body.png)](media/bulk-import/import-url-and-body.png#lightbox)
73+
1. In `importConfiguration`, set `enabled` to `true`.
74+
2. Update `integrationDataStore` with the target storage account name.
75+
3. In `importConfiguration`, set `initialImportMode` to `true`.
76+
4. Delete the `provisioningState` line.
7377

74-
After you've completed this final step, you're ready to perform **Initial mode** import using $import.
78+
[![Screenshot of a code example for import configuration.](media/bulk-import/import-url-and-body.png)](media/bulk-import/import-url-and-body.png#lightbox)
7579

76-
### Step 3b: Set import configuration for Incremental import mode.
80+
You're now ready to perform initial-mode import by using `import`.
7781

78-
Do following changes to JSON:
79-
1. Set enabled in importConfiguration to **true**.
80-
2. Update the integrationDataStore with target storage account name.
81-
3. Set initialImportMode in importConfiguration to **false**.
82-
4. Drop off provisioningState.
82+
### Set the import configuration for incremental import mode
8383

84-
After you've completed this final step, you're ready to perform **Incremental mode** import using $import.
84+
Make the following changes to JSON:
8585

86+
1. In `importConfiguration`, set `enabled` to `true`.
87+
2. Update `integrationDataStore` with the target storage account name.
88+
3. In `importConfiguration`, set `initialImportMode` to `false`.
89+
4. Delete the `provisioningState` line.
8690

87-
Note that you can also use the **Deploy to Azure** button to open custom Resource Manager template that updates the configuration for $import.
91+
You're now ready to perform incremental-mode import by using `import`.
8892

89-
[![Deploy to Azure Button.](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Fazure-quickstart-templates%2Fmaster%2Fquickstarts%2Fmicrosoft.healthcareapis%2Ffhir-import%2Fazuredeploy.json)
93+
You can also use the **Deploy to Azure** button to open a custom Azure Resource Manager template that updates the configuration for `import`.
9094

91-
## Securing the FHIR service $import operation
92-
For you to securely import FHIR data into the FHIR service from an ADLS Gen2 account, there are two options:
95+
[![Screenshot that shows the Deploy to Azure button.](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Fazure-quickstart-templates%2Fmaster%2Fquickstarts%2Fmicrosoft.healthcareapis%2Ffhir-import%2Fazuredeploy.json)
9396

94-
* Option 1: Enabling FHIR service as a Microsoft Trusted Service.
95-
* Option 2: Allowing specific IP addresses associated with the FHIR service to access the storage account.
96-
This option permits two different configurations depending on whether or not the storage account is in the same Azure region as the FHIR service.
97+
## Step 4: Secure the FHIR service's import operation
9798

98-
### Option 1: Enabling FHIR service as a Microsoft Trusted Service.
99+
To securely import FHIR data into the FHIR service from an Azure Data Lake Storage Gen2 account, you have three options:
99100

100-
Go to your ADLS Gen2 account in the Azure portal and select the **Networking** blade. Select **Enabled from selected virtual networks and IP addresses** under the **Firewalls and virtual networks** tab.
101+
* Enable the FHIR service as a trusted Microsoft service.
102+
* Allow specific IP addresses associated with the FHIR service to access the storage account from other Azure regions.
103+
* Allow specific IP addresses associated with the FHIR service to access the storage account in the same region as the FHIR service.
101104

102-
[![Screenshot of Azure Storage Networking Settings.](media/export-data/storage-networking-1.png)](media/export-data/storage-networking-1.png#lightbox)
105+
### Enable the FHIR service as a trusted Microsoft service
106+
107+
1. In the Azure portal, go to your Data Lake Storage Gen2 account in the Azure portal.
108+
109+
1. On the left menu, select **Networking**.
110+
111+
1. On the **Firewalls and virtual networks** tab, select **Enabled from selected virtual networks and IP addresses**.
112+
113+
[![Screenshot of Azure Storage networking settings.](media/export-data/storage-networking-1.png)](media/export-data/storage-networking-1.png#lightbox)
103114

104-
Select **Microsoft.HealthcareApis/workspaces** from the **Resource type** dropdown list and then select your workspace from the **Instance name** dropdown list.
115+
1. In the **Resource type** dropdown list, select **Microsoft.HealthcareApis/workspaces**. In the **Instance name** dropdown list, select your workspace.
105116

106-
Under the **Exceptions** section, select the box **Allow Azure services on the trusted services list to access this storage account**. Make sure to click **Save** to retain the settings.
117+
1. In the **Exceptions** section, select the **Allow trusted Microsoft services to access this storage account** checkbox.
107118

108-
[![Screenshot showing Allow trusted Microsoft services to access this storage account.](media/export-data/exceptions.png)](media/export-data/exceptions.png#lightbox)
119+
[![Screenshot that shows the option to allow trusted Microsoft services to access this storage account.](media/export-data/exceptions.png)](media/export-data/exceptions.png#lightbox)
109120

110-
Next, run the following PowerShell command to install the `Az.Storage` PowerShell module in your local environment. This will allow you to configure your Azure storage account(s) using PowerShell.
121+
1. Select **Save** to retain the settings.
122+
123+
1. Run the following PowerShell command to install the `Az.Storage` PowerShell module in your local environment. You can use this module to configure your Azure storage accounts by using PowerShell.
111124

112-
```PowerShell
113-
Install-Module Az.Storage -Repository PsGallery -AllowClobber -Force
114-
```
125+
```PowerShell
126+
Install-Module Az.Storage -Repository PsGallery -AllowClobber -Force
127+
```
115128

116-
Now, use the PowerShell command below to set the selected FHIR service instance as a trusted resource for the storage account. Make sure that all listed parameters are defined in your PowerShell environment.
129+
1. Use the following PowerShell command to set the selected FHIR service instance as a trusted resource for the storage account. Make sure that all listed parameters are defined in your PowerShell environment.
117130

118-
Note that you need to run the `Add-AzStorageAccountNetworkRule` command as an administrator in your local environment. For more information, see [Configure Azure Storage firewalls and virtual networks](../../storage/common/storage-network-security.md).
131+
You need to run the `Add-AzStorageAccountNetworkRule` command as an administrator in your local environment. For more information, see [Configure Azure Storage firewalls and virtual networks](../../storage/common/storage-network-security.md).
119132

120-
```PowerShell
121-
$subscription="xxx"
122-
$tenantId = "xxx"
123-
$resourceGroupName = "xxx"
124-
$storageaccountName = "xxx"
125-
$workspacename="xxx"
126-
$fhirname="xxx"
127-
$resourceId = "/subscriptions/$subscription/resourceGroups/$resourceGroupName/providers/Microsoft.HealthcareApis/workspaces/$workspacename/fhirservices/$fhirname"
133+
```PowerShell
134+
$subscription="xxx"
135+
$tenantId = "xxx"
136+
$resourceGroupName = "xxx"
137+
$storageaccountName = "xxx"
138+
$workspacename="xxx"
139+
$fhirname="xxx"
140+
$resourceId = "/subscriptions/$subscription/resourceGroups/$resourceGroupName/providers/Microsoft.HealthcareApis/workspaces/$workspacename/fhirservices/$fhirname"
128141
129-
Add-AzStorageAccountNetworkRule -ResourceGroupName $resourceGroupName -Name $storageaccountName -TenantId $tenantId -ResourceId $resourceId
130-
```
142+
Add-AzStorageAccountNetworkRule -ResourceGroupName $resourceGroupName -Name $storageaccountName -TenantId $tenantId -ResourceId $resourceId
143+
```
131144

132-
After you've executed above command, in the **Firewall** section under **Resource instances** you'll see **2 selected** in the **Instance name** dropdown list. These are the names of the workspace instance and FHIR service instance that you registered as Microsoft Trusted Resources.
145+
1. Confirm that under **Resource instances**, **2 selected** appears in the **Instance name** dropdown list. The two selected instances are the name of the workspace instance and the name of the FHIR service instance that you registered as trusted Microsoft resources.
133146

134-
[![Screenshot of Azure Storage Networking Settings with resource type and instance names.](media/export-data/storage-networking-2.png)](media/export-data/storage-networking-2.png#lightbox)
147+
[![Screenshot of Azure Storage networking settings with resource type and instance names.](media/export-data/storage-networking-2.png)](media/export-data/storage-networking-2.png#lightbox)
135148

136-
You're now ready to securely import FHIR data from the storage account. The storage account is on selected networks and isn't publicly accessible. To securely access the files, you can enable [private endpoints](../../storage/common/storage-private-endpoints.md) for the storage account.
149+
You're now ready to securely import FHIR data from the storage account. The storage account is on selected networks and isn't publicly accessible. To securely access the files, you can use [private endpoints](../../storage/common/storage-private-endpoints.md) for the storage account.
137150

138-
### Option 2:
139151
[!INCLUDE [Specific IP ranges for storage account](../includes/common-ip-address-storage-account.md)]
140152

141153
## Next steps
142154

143-
In this article, you've learned how the FHIR service supports $import operation and it allows you to import data into FHIR service from a storage account. You also learned about the three steps used in configuring import settings in the FHIR service. For more information about converting data to FHIR, exporting settings to set up a storage account, and moving data to Azure Synapse, see
155+
In this article, you learned how the FHIR service supports the `import` operation and how you can import data into the FHIR service from a storage account. You also learned about the steps for configuring import settings in the FHIR service. For more information about converting data to FHIR, exporting settings to set up a storage account, and moving data to Azure Synapse Analytics, see:
144156

145157
>[!div class="nextstepaction"]
146-
>[Use $import](import-data.md)
158+
>[Import FHIR data](import-data.md)
147159
148160
FHIR® is a registered trademark of [HL7](https://hl7.org/fhir/) and is used with the permission of HL7.

0 commit comments

Comments
 (0)