Vashlabs: from the dental report to Italy’s Electronic Health Record.
Generation, signature and delivery of CDA2 reports to Italy’s Electronic Health Record, plus private e-prescriptions, for software used by dental practices.
The software produces validated, signed CDA2 reports and delivers them to the Electronic Health Record through two channels: the national middleware and Sicily Region’s INI.
- Client
- Vashlabs
- Industry
- Healthcare software for dental practices
- Year
- 2025–2026
- Services
- Custom software and web apps
Context
Vashlabs develops software for dental practices in Sicily. The product had to connect to Italy’s Electronic Health Record (FSE) and handle private e-prescriptions: two obligations with national and regional specifications, little room for interpretation and many systems involved.
I worked on the product’s Java backend between March 2025 and August 2026, coordinating with the software company’s team on their existing codebase. My role was development only: hosting and operations are handled by Vashlabs.
Problem
A report for the FSE is not a plain XML file. It must follow the HL7 CDA2 standard with the outpatient specialist report profile, pass XSD and Schematron checks, be embedded in a PDF and be digitally signed before delivery.
Delivery takes two different routes: a national REST middleware and the SOAP services of the National Interoperability Infrastructure (INI) acting on behalf of Sicily Region, with authentication through the CNS health card. Each system replies with its own identifiers, codes and states, which the software has to understand.
Solution
I built the module that takes a report from the software all the way to the delivery outcome. Each step is exposed as a separate operation, so it can be run and verified on its own during support.
- CDA2 generator for the outpatient specialist report (RSA 1.1): data mapping, semantic checks, document model and XML serialisation, with document versioning.
- Local validation with XSD and Schematron (ART-DECOR, XSLT/SVRL), keeping errors and warnings apart.
- CDA embedding into the PDF and PAdES signature with a smart card (PKCS#11, Windows) or a remote signing service.
- REST middleware channel: server validation, publication, transaction status and deletion, with HMAC authentication.
- INI Sicily SOAP channel: metadata submission, upload outcome, search and deletion, with a CNS session and a proxy gateway.
- A single response model for the software: success, or an error with category, code, details and whether a retry makes sense.
- Private e-prescriptions, built on both backend and frontend: prescription submission, lookup and cancellation, two-factor authentication, drug and diagnosis search, PDF reminders and a React interface launched from the software.
Result
The software can produce, sign and deliver compliant reports without the practice dealing with formats, signatures and system-to-system communication. Errors reach the software with a clear meaning instead of a raw provider response.
The APIs are documented with OpenAPI and every step of the flow can be isolated, which helps diagnose a failed delivery without starting over.
Technical details
Java 8 backend with Spring Boot and MySQL. SOAP clients generated from WSDL with JAX-WS, EU DSS for PAdES signatures, PDFBox for the PDF, Saxon for Schematron transformations. E-prescription frontend in React, served by the same backend.
- Java
- Spring Boot
- HL7 CDA2
- Schematron
- PAdES / EU DSS
- SOAP / JAX-WS
- REST
- MySQL
- React
Do you need to bring a complex integration into your product?
I can support your team with analysis and development.