FAZ Australia × CIHE: MedTalk Connect Test Harness
Testing EMR Integrations Without Touching Real Patient Data
How a cybersecurity student team from the Crown Institute of Higher Education (CIHE), mentored by FAZ Australia, designed a fully synthetic test environment for MedTalk Connect, the FHIR interoperability layer behind MedTalk AI.
The Problem
MedTalk AI turns consultations into structured clinical notes, and MedTalk Connect delivers those notes into practice EMR systems including Oracle Health Millennium, Best Practice via Halo Connect, and Epic. Every new connector and every terminology mapping change has to be validated before it reaches a clinic.
Until now that validation relied on ad hoc scripts, manual review of FHIR payloads, and third party sandboxes that are costly and restricted. There was no single, repeatable environment to test FHIR exchange, SNOMED CT-AU to ICD-10-AM and MBS mapping, and connector failure handling together, with zero risk of real patient data being involved.
What the Team Designed
Through a work integrated learning partnership, a four person CIHE cybersecurity team worked with FAZ Australia to design the Healthcare Integration & Clinical Terminology Test Harness: a reusable, standards based environment that is fully isolated from production EMRs and live patient data.
- Synthetic test data layer with automated rules that reject realistic looking identifiers
- Terminology module validating SNOMED CT-AU to ICD-10-AM and MBS mappings, including edge cases
- Simulated connectors for Oracle Health Millennium, Best Practice/Halo Connect, and Epic
- Fault injection for slow responses, malformed payloads, and dropped connections
- React dashboard, harness API, isolated HAPI FHIR runtime with AU Core validation, and PostgreSQL
- STRIDE threat model with three trust boundaries, including a hard block on any path to production systems
Proof of Concept
Stage 1 closed with a proof of concept run against a synthetic patient record on the sandbox FHIR endpoint. The request returned HTTP 200 and the expected synthetic Patient, but the third check failed: the FHIR specific application/fhir+json Content-Type header was missing.
That failure was the point. It showed the harness approach catches real configuration issues, not just successful requests, which is exactly what MedTalk Connect needs before a connector or mapping change goes live.
What Comes Next
Stage 2 moves from design to build across two agile sprints: first the PostgreSQL, HAPI FHIR, and core patient operations, then fault injection, tenant scoped authentication, terminology comparison, and reporting. Security, interoperability, and terminology controls will be verified before the harness is used in any near production setting.
What This Demonstrates
For FAZ Australia, the harness means faster connector onboarding, less reliance on expensive vendor sandboxes, and documented evidence that FHIR exchange and clinical coding behave correctly under Australian privacy and health data law. For the students, it was hands on experience securing a real clinical AI product.