Existing Wording: Using HTTPS is optional, but all production exchange of healthcare data SHOULD use SSL and additional security as appropriate. See HTTP Security for further information.

Proposed Wording: Using HTTPS is required. All production exchange of healthcare data SHALL use SSL and additional security as appropriate. See HTTP Security for further information.

Comment:

HTTPS is not a significant burden for servers or clients to support, and mandating that HTTPS is used in all FHIR exchanges will promote the development of clients and servers toward using HTTPS, as well as make FHIR more secure