US health systems rarely reject FHIR because the specification is unclear. They reject implementations that cannot explain identity, audit, and PHI flow in the same language as their security and compliance teams.
A production FHIR R4 surface for a US hospital usually needs SMART on FHIR or an equivalent OAuth pattern, scoped access to US Core resources, and logs that survive an incident review. A public sandbox that returns synthetic patients is not that surface.
The patterns that pass review are boring on purpose: no PHI in query strings, encryption in transit, least-privilege scopes, break-glass that is itself audited, and an explicit map of which systems are system of record versus exchange layer.
Terminology is part of security. If LOINC, SNOMED CT, ICD-10, and RxNorm are treated as optional labels, downstream quality and claims workflows in the United States will invent their own codes — and the interface will be blamed later.
If you are selling or building FHIR for US care delivery, write the data-flow diagram before the first public endpoint. Security teams approve architecture they can defend, not demos they cannot.