Challenge
Users grant only partial data permissions
Agnotic approach
We design flows that degrade gracefully per type and re-prompt with clear purpose strings rather than assuming a full grant.
Apple HealthKit
Apple HealthKit and Health Connect integration
We turn HealthKit into a compliant clinical data source, reading HKQuantityType and HKCategoryType samples, normalizing patient-generated health data into FHIR Observations, and keeping raw data on-device where Apple requires it. Real integrations, not just familiarity.
HealthKitFHIR R4On-Device PrivacyHIPAA-Ready
Trusted by global innovators
What is HealthKit integration?
HealthKit integration is the work of reading, and where needed writing, health data in Apple HealthKit from your iPhone app, then syncing what the user permits to your backend. Agnotic Technologies builds the per-type permission flows, background sync and mapping to FHIR Observations, and adds Health Connect on Android when your users are on both platforms.
Apple HealthKit is the on-device store for steps, heart rate, HRV, ECG, blood oxygen, sleep and more from iPhone, Apple Watch and paired apps. With no cloud API, your app requests per-type read authorization through HKHealthStore and syncs permitted samples to your HIPAA-ready backend.
The hard parts are consent granularity, background delivery and mapping. Users can grant a partial set of types, so the pipeline must handle missing permissions. HKObserverQuery and HKAnchoredObjectQuery drive incremental sync, and each sample's units are normalized into FHIR Observations with correct LOINC codes.
HealthKit to FHIR architecture
A privacy-first pipeline from HealthKit on-device samples to a FHIR-native clinical record your platform can trust.
Common failure modes
Where do HealthKit integrations fail?
Challenge
Duplicate samples from multiple source apps
Agnotic approach
Source-priority resolution and de-duplication before data ever reaches the FHIR store.
Challenge
Background sync silently stops
Agnotic approach
Persisted anchors, observer-query health checks, and sync-gap alerting so missed windows are caught fast.
Challenge
App Store rejection over health-data privacy
Agnotic approach
Defensible privacy nutrition label, on-device processing, and consent aligned with Apple's HealthKit rules.
Which HealthKit APIs do we work with?
We name the exact technical surface: the HealthKit types, queries, and FHIR resources your integration actually rides on.
HKHealthStore & Sample Types
Read HKQuantityType (heart rate, HRV, steps, VO2 max, blood oxygen) and HKCategoryType (sleep analysis, mindful minutes) with explicit per-type authorization.
ECG & Clinical Records
Access HKElectrocardiogram voltage samples and HKClinicalRecord FHIR documents synced from connected providers via Health Records on iPhone.
Observer & Anchored Queries
HKObserverQuery with background delivery and HKAnchoredObjectQuery for incremental, deduplicated sync so no sample is missed or double-counted.
FHIR Observation Mapping
Normalize each sample to a FHIR R4 Observation with the right LOINC code, UCUM unit, and effectiveDateTime for a clean longitudinal record.
On-Device Privacy & Consent
Honor Apple's on-device processing rules, purpose strings, and per-type consent, syncing only what the patient authorized to your BAA-covered backend.
Signal Cleaning & Trends
De-noise raw PGHD, resolve source priority across paired apps, and compute derived trends before data reaches clinicians or ML pipelines.
Where it runs
Which programs use HealthKit data?
Remote patient monitoring
Continuous vitals from Apple Watch feeding an RPM dashboard with billing-ready data.
Cardiac & AFib programs
ECG and irregular-rhythm notifications routed to clinicians for review.
Chronic care management
Activity, sleep, and weight trends tied to care-plan goals.
Clinical research
Consented PGHD collection with export for study analysis.
Women's & metabolic health
Cycle, sleep, and HRV signals informing personalized plans.
Post-op recovery
Step and mobility tracking to flag recovery deviations early.
HealthKit data that clinicians can actually use
The gap between a HealthKit sample and a clinical FHIR Observation is where most consumer-health builds stall. We close it.
Per type
HealthKit read and share permission requested for each data type
On-device
Samples read on the iPhone, then synced to your backend
FHIR R4
Samples mapped to Observations with LOINC codes and UCUM units
Compliance-First Healthcare App Development Services Backed by Global Standards
15-Minute Scoping Call01
HIPAA
Health Insurance Portability and Accountability Act
Protect PHI with privacy-first architecture, encrypted storage and transmission, strict access controls, and traceable audit logs.
02
GDPR
General Data Protection Regulation
Implement lawful consent flows, data minimization, retention controls, and secure processing for sensitive health data.
03
FHIR
Fast Healthcare Interoperability Resources
Enable standardized health data exchange across apps, care teams, and systems through standards-based FHIR APIs.
04
HL7
Health Level Seven International
Support enterprise-grade interoperability with HL7-based integrations for records, events, and clinical messaging workflows.
05
HITRUST
Health Information Trust Alliance
Align security programs to healthcare-specific control and risk management practices trusted by providers and ecosystem partners.
06
HITECH
Health Information Technology for Economic and Clinical Health Act
Design with breach notification readiness, digital record safeguards, and operational controls that support regulated care programs.
07
SaMD
FDA Software as a Medical Device
Plan software quality, traceability, and documentation pathways for products that may require SaMD review and submission.
08
MDR (EU)
Medical Device Regulation (European Union)
Prepare EU market-ready processes for risk classification, evidence tracking, and lifecycle governance under MDR expectations.
09
SAMHSA
Substance Abuse and Mental Health Services Administration
Apply confidentiality controls and consent-aware sharing models for behavioral and mental health data experiences.
Standards we build against
Which data standards does HealthKit data map to?
FHIRLOINCUCUMHIPAAOAuth2
Our Process
How do we build a HealthKit integration?
A phased approach that treats entitlements, consent, and FHIR mapping as parallel tracks so your build reaches the App Store review with the privacy story already sound.
1.
Discovery & Data Scope
We map the exact HealthKit sample types your clinical use case needs, the consent copy, and the FHIR profile they map to.
Privacy-first design
2.
Entitlements & Authorization
HealthKit capability, background delivery entitlement, purpose strings, and the per-type HKHealthStore authorization flow.
Consent-aware
3.
Build & Test
Anchored and observer queries, FHIR Observation mapping, and validation against simulator and real-device sample data.
Always audit-ready
4.
Go-Live & Monitoring
App Store submission with a defensible privacy nutrition label, plus sync-health dashboards and alerting once live.
Smooth data exchange
Access methods
Which HealthKit query fits each data type?
HealthKit is on-device only. Here is how each read path behaves and where it fits.
| Surface | Method | Typical use | Notes |
|---|---|---|---|
| Quantity samples | HKAnchoredObjectQuery | Heart rate, steps, HRV | Anchor persistence gives gap-free incremental sync. |
| Category samples | HKAnchoredObjectQuery | Sleep, mindfulness | Enumerated values; map to FHIR coded Observations. |
| ECG | HKElectrocardiogram query | AFib / rhythm review | Voltage series plus classification; large payloads. |
| Background updates | HKObserverQuery + delivery | Near-real-time RPM | Requires background delivery entitlement. |
| Clinical records | HKClinicalRecord | Provider FHIR docs | Read-only FHIR resources from linked health systems. |
There is no server-to-server HealthKit API, all reads happen on-device and sync to your BAA-covered backend.
Facts and sources
Which rules shape a HealthKit integration?
Short facts we design around, each linked to its primary source.
HealthKit requires fine-grained authorization: an app must request permission to read and share each data type before it uses that data.
Source: Apple Developer Documentation, Authorizing access to health dataTo protect privacy, a HealthKit app cannot tell whether a person granted or denied read permission; after a denial, reads return only the samples the app itself saved.
Source: Apple Developer Documentation, Authorizing access to health dataApple's App Review Guideline 5.1.3 bars apps from using or disclosing HealthKit and other health data for advertising, marketing or data mining, other than improving health management or health research with permission.
Source: Apple App Review Guidelines, 5.1.3The FTC Health Breach Notification Rule requires vendors of personal health records and related entities, including many health apps outside HIPAA, to notify consumers after a breach of unsecured health information.
Source: 16 CFR Part 318 (eCFR)
Featured case study
Read Case StudyLera Health: compliant women's health platform
Related proof of compliant, integration-heavy delivery: for Lera Health we built the privacy-first data layer and testing-to-insights workflow, the same discipline we bring to normalizing HealthKit patient-generated data into a trustworthy clinical record.
Why Partner With Us
15-Minute Scoping CallWhy teams trust us with HealthKit
We ship real HealthKit integrations that survive App Store review and clinical scrutiny.
Compliance-First by Default
HIPAA, on-device privacy rules, and consent granularity designed into the pipeline from sprint one.
PGHD Domain Depth
We've normalized wearable and femtech signals into FHIR before: your team won't be educating ours on sample types or LOINC coding.
Faster Go-To-Market
Entitlements, consent copy, and FHIR mapping run in parallel toward a build that is ready for App Store review.
Dedicated Product Teams
One accountable team across iOS engineering, backend FHIR, and compliance, not a hand-off chain.
Frequently Asked Questions
The timeline depends on how many sample types you need, whether you need background delivery, ECG or Health Records data, how much multi-source de-duplication the data needs and how deep the FHIR mapping goes. App Store review is part of the plan. We scope against your exact sample types in discovery.
Cost scales with the number of sample types, whether you need background delivery and ECG, and the depth of FHIR mapping and RPM logic. A single-purpose integration is far cheaper than a full multi-metric clinical pipeline. We share ranges after a scoping conversation.
Yes. HealthKit apps go through App Store review with specific privacy requirements: purpose strings, a privacy nutrition label, and no using health data for advertising. We prepare that story before submission so review is not a surprise.
Absolutely. HealthKit is a common front-end for remote patient monitoring and telehealth. We stream consented vitals into RPM dashboards and clinician workflows, mapped to FHIR so the data is billable and clinically usable.
It depends on who holds it. Data a person keeps in HealthKit on their own iPhone is not covered by HIPAA, but once a covered entity, or a business associate working for one, receives it, it is protected health information. Consumer apps outside HIPAA can still fall under the FTC Health Breach Notification Rule, so we build encrypted pipelines with access logging and consent tracking either way.
Ready to turn HealthKit data into a clinical record?
Tell us the sample types and use case. We'll return a realistic plan with entitlements, consent design, and a FHIR mapping approach.
contact@agnotic.com
Partnerships
contact@agnotic.com