A privacy-centric microservice framework for secure FHIR-based integration of heterogeneous medical data

• Zero-Trust FHIR microservices; mTLS + device-bound certificates; EHDS-aligned. • p95 NIC-to-store <100 ms; ingestion ∼132 ms (4G); end-to-dashboard 167 ms. • 8800 msg/s sustained without loss (bursts >9000); CPU ∼54%, RAM ∼33%. • PostgreSQL RLS enforces patient-level isolation; event-level audit via OTel. • Structured security- and privacy-by-design process with an explicit threat model targeting four adversary classes. Fragmentation across consumer wearables, hospital messaging systems, telehealth platforms, and cloud services impedes timely data reuse and increases privacy risks, for example through proprietary telemetry, legacy HL7v2 messages, intermittent home connectivity, and inconsistent consent enforcement. To design and evaluate a privacy-centric microservice framework that integrates heterogeneous medical data into Fast Healthcare Interoperability Resources (FHIR) while sustaining sub-second end-to-dashboard latency under realistic network conditions. We followed a security- and privacy-by-design process inspired by secure software development lifecycles, consolidating requirements from the GDPR, EHDS Regulation, and Zero Trust guidance into an explicit threat model. We built container-native services orchestrated with Kubernetes and enforced a Zero Trust posture using device-bound X.509 certificates and mutual TLS. A hot-swappable adapter layer normalized HL7v2/IEEE 11073/proprietary telemetry to FHIR resources and persisted them in PostgreSQL with a row-level security. Performance tests replayed wearable sessions through 50 concurrent Android emulators over Wi-Fi and 4G and a 5% random loss model. The outcomes were processing, ingestion, end-to-dashboard latencies, throughput, and resource utilization. Security probes assessed credential replay/clone, injection attempts, horizontal privilege escalation, and volumetric DoS. The processing interval from NIC reception to storage remained below 100 ms (95th percentile). On 4G (RTT ≈ 75 ms), the ingestion latency was 132 ms; with 5% random loss, the end-to-dashboard The security controls blocked credential replay/clone attempts, neutralized injected SQL, enforced row-level isolation, and reduced the observed request rate in an illustrative 50,000 SYN/s availability probe. These results represent an initial validation rather than a full penetration test; large-scale clinical deployments will require independent security assessments. The outcome is a Zero Trust FHIR reference implementation with an explicit threat model, device-bound enrollment, adapter-based normalization, row-level isolation, observability, and targeted validation. A zero-trust microservice architecture can deliver EHDS-aligned privacy controls and real-time analytics without compromising performance. Beyond the reference implementation, the work contributes a structured security- and privacy-by-design methodology and explicit threat model that can guide similar digital-health platforms.