Chapter 03: WIA-MED-021 Standard Overview

Sleep data is collected by very different instruments. A hospital laboratory records a full night of EEG, eye movement, muscle tone, airflow and oxygen saturation. A home test may capture only airflow and blood oxygen. A wristband infers "sleep" from pulse and motion. Each of these produces something called a sleep study, and until now each has lived in its own vendor silo. WIA-MED-021 is a data and interface standard that lets those records move between devices, dashboards, electronic health records and research platforms without losing the information needed to judge how far each one can be trusted.

3.1 Standard at a glance

The standard covers four device families: fitness wearables that track sleep stages, clinical polysomnography (PSG) units in sleep labs, home sleep apnoea testing devices, and continuous wrist-worn trackers. Its stated goal is that data from any conformant device reaches any conformant clinical dashboard, EHR system or research platform. Three practical problems motivate it.

• Fragmentation. Lab PSG hardware speaks proprietary protocols, consumer wearables sit behind vendor-locked clouds, and home apnoea tests form a third silo. A patient who has both a lab study and a wearable history cannot easily reconcile them.
• Reproducible scoring. The scoring rules of the American Academy of Sleep Medicine (AASM) are well defined, but vendor implementations differ. The standard's data envelope therefore carries the scoring algorithm version and an AASM compliance level, so consumers can compare like with like.
• Clinical grade versus consumer grade. A wearable estimating REM minutes from heart rate and movement is not equivalent to a PSG that identifies REM from EEG. A clinical_grade flag and per-channel signal-quality metrics make that difference explicit before anyone makes a clinical decision.

The work is split into four phases, each of which has its own chapter later in this guide.

The reference host can be started and exercised in three commands. They show the shape of the interface: a session goes in as JSON, and its scoring comes back from a sub-resource.

docker run -p 8080:8080 wia/sleep-monitoring-host:1.0.0

curl -X POST "http://localhost:8080/sm/session" \
     -H "Content-Type: application/json" \
     -d @session.json

curl "http://localhost:8080/sm/session/{session_id}/scoring"

A reference command-line tool, cli/sleep-monitoring.sh, offers the subcommands validate, session, event, score, consent and info. In practice validate is the one device makers reach for first, because every later exchange depends on the Phase 1 shapes being right.

3.2 Object families

Phase 1 fixes the JSON shapes that every device, sleep lab system, EHR bridge and research aggregator must read and emit. There are five object families.

The encoding rules are deliberately plain. Documents are UTF-8 JSON with snake_case keys. Timestamps are RFC 3339 in UTC with a Z suffix, and sub-second precision is required for events tied to specific waveform samples. Identifiers are URI-shaped, and patient identifiers should use did:wia:patient:… so that direct biometric identifiers stay off the wire. Stage tokens follow the AASM Manual: wake, n1, n2, n3, rem, plus an optional unscored for epochs the algorithm could not classify. Every object carries wia_sleep_monitoring_version, and a receiver must refuse a major version it does not implement.

The session record

{
  "wia_sleep_monitoring_version": "1.0.0",
  "type": "session",
  "session_id": "ses_01HXY",
  "patient_id": "did:wia:patient:01HXY",
  "session_kind": "polysomnography",
  "started_at": "2026-04-26T22:30:00Z",
  "ended_at":   "2026-04-27T07:00:00Z",
  "device_ids": ["did:wia:device:psg-vendor-A"],
  "clinical_grade": true,
  "edf_url": "https://recordings.example/sessions/ses_01HXY.edf",
  "edf_sha256": "7d8f2c…",
  "scoring_metadata_id": "scm_01HXY",
  "signature": { "alg": "Ed25519", "value": "AY3o…" }
}

The session_kind field encodes what instrument produced the data. polysomnography means full clinical PSG with EEG, EOG, EMG, airflow, pulse oximetry and chest and abdomen belts. home_sleep_apnoea_test is typically airflow plus SpO2 only. consumer_wearable is typically heart rate plus accelerometer, from which stages are derived. nap covers short sessions. Further kinds can be registered through the WIA extension process, and a receiver must treat any unknown kind as unrecognised instead of guessing.

The clinical_grade flag is gated. It may be true only when the recording device has regulatory clearance for the relevant signals (the material names FDA 510(k), EU CE-MDR and KFDA approval). When it is true, the device record must carry the clearance reference. A Phase 2 host refuses a session that claims clinical grade without proof.

The raw waveform stays out of the envelope. A full-night recording is typically hundreds of megabytes, so a clinical-grade session points to an EDF or EDF+ file through edf_url and pins it with an edf_sha256 hash. Anyone who later fetches the file can verify that it is the recording that was scored.

Stages, events and arousals

A sleep stage record classifies one epoch:

{
  "type": "sleep_stage",
  "session_id": "ses_01HXY",
  "epoch_index": 142,
  "epoch_start": "2026-04-26T23:41:00Z",
  "epoch_duration_seconds": 30,
  "stage": "n2",
  "confidence": 0.92,
  "scoring_algorithm": "AASM-2024-default",
  "signature": null
}

Clinical scoring uses 30-second epochs. Consumer wearables may use 5-minute epochs at lower confidence, and epoch_duration_seconds states the true granularity so that nobody mistakes one for the other. Stage records inside a signed session inherit its provenance, which is why signature may be null there. A stage record published on its own, for example by a community research aggregator, must be signed.

A respiratory event record describes one breathing disturbance. Its kinds are obstructive_apnoea, central_apnoea, mixed_apnoea, hypopnoea, rera (respiratory effort related arousal) and oxygen_desaturation. The record carries a start time with millisecond precision, duration_seconds, associated_oxygen_desaturation_pct, an associated_arousal flag, the scoring algorithm and a scorer_id. Keeping this per-event metadata is what allows the Apnoea-Hypopnoea Index (AHI), the apnoeas plus hypopnoeas divided by sleep time, to be recomputed downstream without ambiguity. Hosts must preserve events in started_at order for the same reason.

Arousals have a hard floor taken from AASM practice: a host must refuse any arousal whose duration_seconds is below 3. The refusal is a problem-details response with status 422 and the error type arousal-too-short. The rule is enforced at the API instead of being left to downstream cleanup.

The session lifecycle

A session is not a static file. It moves through states that mirror a sleep lab workflow:

DRAFT → IN_PROGRESS → SCORING → SCORED → ARCHIVED
                              ↓
                          → CORRECTED (new scoring_metadata appended)

Transitions are signed PATCH operations performed by a delegate holding the right scope: technician_scoring, physician_review or archive_manager. A technician scores, a physician reviews, and an archive manager closes the record. The standard builds that separation of duties into the permissions. A deleted session leaves a tombstone, and the audit record is retained for 25 years.

The API follows the same object families, with routes under /sm/session, /sm/stage, /sm/event, /sm/arousal and /sm/scoring. A discovery document at /.well-known/wia-sleep-monitoring advertises which session kinds and scoring algorithms a host supports. Bulk submission is the normal pattern: a full night of 960 epochs (8 hours of 30-second epochs) travels in one envelope, and hosts must honour Idempotency-Key so a retried upload cannot duplicate it. Re-scoring has its own endpoint, /sm/scoring/{scoring_metadata_id}/recompute, which is covered in the next section.

3.3 Roles in the federation

Sleep data rarely stays where it was recorded. It moves from a sensor to a vendor cloud, a scoring service, a clinic and sometimes a research cohort. Phase 3 names five roles so that each hop has a clear responsibility.

One legal entity may play several roles. A hospital, for example, can be recording host, scoring service and clinical host at once. Trust is established through a federation handshake and recorded in signed receipts that persist for at least 25 years, in line with clinical sleep record retention norms.

Consent as the gate

The patient consent envelope is the control that decides whether data may cross from one host to another. It names the patient and custodian, lists scopes (clinical_dashboard, ehr_export, research_de_identified), binds each audience to one scope, sets a validity window and states whether consent is revocable. A patient might therefore authorise a named hospital clinic for dashboard access and a named university cohort for de-identified research use, with each grant expiring on its own date.

For paediatric patients the custodian is the legal guardian, and the guardian relationship must be cleared through the WIA-OMNI-API guardian-link flow. The material notes that sleep apnoea is increasingly recognised in children, so this is a mainstream case.

What each audience may see

The matrix is built around how sleep data is actually used. A family caregiver sees a histogram of stages, not the minute-by-minute event log. An EHR receives a summary, and the raw events behind it require a separate, stronger grant. Hosts must refuse any cross-class enrichment that would defeat these boundaries, for instance by joining a de-identified research extract back to named records.

Replay defence, moves and re-scoring

Signed envelopes carry a 96-bit nonce and an RFC 3339 timestamp. A receiver rejects an envelope whose clock skew exceeds 300 seconds, and rejects one whose signer and nonce pair was seen in the last 600 seconds. For very large bulk stage submissions the seen-nonce cache may be a Bloom filter. A false positive must trigger a re-fetch through the pull endpoints, never a silent drop, because a silently dropped batch would leave a hole in a night of data.

Two further procedures reflect how sleep medicine works over years. When a patient changes sleep clinics, a signed session_move envelope lets the new clinic fetch the history by federated read, and the old clinic answers 301 Moved Permanently for the session URL for at least 12 months.

When AASM publishes a Manual update, which happens every few years, existing studies may need re-scoring. The standard avoids bulk data transfer. A scoring service, possibly a different organisation, federates with the recording host, fetches the EDF recording, scores it under the new algorithm and posts a new scoring metadata record that points to the old one through supersedes. The recording host keeps both. A research consortium can then pin its cohort to one algorithm version, while a clinic can adopt the newest.

3.4 Conformance levels

Implementations declare one of three levels, which grow in clinical depth rather than in cosmetic features.

The levels describe what a product can honestly claim. A consumer wearable vendor can reach Minimal by emitting valid sessions and answering queries. A hospital platform that must exchange records with other institutions needs Core. Only Full promises that scoring itself follows AASM rules and that the raw recording can be re-fetched and re-scored. The level is separate from the per-session aasm_compliance_level (full, partial or consumer_estimate), which describes the data in each record. A Full host can still ingest a consumer-estimate night, and downstream filters rely on the label to tell the two apart.

3.5 Where it sits in the WIA family

WIA-MED-021 composes with existing clinical and consumer systems rather than replacing them, and Phase 4 describes three groups of integration.

Clinical sleep standards

The standard does not republish the AASM rules. It provides the data shape that AASM-compliant scorers consume and emit. The scoring_algorithm field holds an identifier from a registry; the initial entries are AASM-2024-default, AASM-2018-default (kept for cohort comparability), AASM-2024-paediatric and Vendor-A-v3. The EDF bridge reads the recording, translates channel metadata (sampling rates, channel names, units, calibration) into the session envelope, and writes results into a parallel scoring record. It never modifies or transcodes the EDF file.

For records that go into the chart, each session maps to an HL7 FHIR R5 Procedure for the sleep study plus Observation resources for the summary metrics. The default LOINC mappings are:

The raw EDF is not pushed into FHIR; FHIR references the EDF URL.

Vendor platforms

Bridges exist for Apple HealthKit, Google Fit, Samsung Health, Fitbit, Oura and Withings. The HealthKit bridge runs inside an iOS companion app and reads sleep analysis data with the user's per-type consent. It emits each sleep period as a consumer_wearable session at consumer_estimate compliance, and writes the scoring summary back so that Apple Health shows "WIA Sleep Monitoring" as the data source. The other vendors have profiles that document OAuth scopes, field mapping, polling cadence and credential handling.

Sister standards

• WIA-MED-020 (Wearable Health) is the closest relative. Wearable sleep data usually arrives as a WIA-MED-020 measurement stream of heart rate, step count and accelerometer values. The host derives a WIA-MED-021 session by aggregating that stream into sleep periods and scoring stages at consumer-estimate level. The device clearance reference required for clinical_grade also comes from WIA-MED-020.
• WIA Vital Sign Streaming supplies high-rate continuous waveforms.
• WIA-OMNI-API holds patient identity, vendor credentials, clinician licence records and signed guardian links.
• WIA-AIR-SHIELD hardens transport, and WIA-ACCESSIBILITY covers patient and clinician interfaces.

Trust machinery such as Ed25519 signatures, HTTP Message Signatures for writes and RFC 9457 problem details is shared with other WIA standards, so vendors can reuse one federation library across them. Sleep-specific rules sit on top of that shared base.

Cross-Chapter Anchors

The same ideas reappear at several layers of the standard. This table shows where each one is first defined and where it is enforced.

Where to Look Next

Where to go after this overview depends on who you are.

• Device and firmware teams should start with the Phase 1 shapes, especially session kinds, epoch granularity and the EDF reference. Getting epoch_duration_seconds and clinical_grade right matters more than any other field.
• Sleep lab and hospital platform teams should read the Phase 2 lifecycle and scope model, then the Phase 3 consent and session-move procedures.
• Scoring vendors and researchers should focus on scoring metadata, the algorithm registry and the re-computation flow, since cohort comparability depends on them.
• EHR and app integrators should go to the Phase 4 FHIR mapping and the vendor bridge profiles, keeping the audience matrix beside them.

Patient and Clinician Considerations

The standard changes what a person looking at a sleep result can safely conclude. A clinician reviewing a night in a dashboard should check three things before acting on a number: the session_kind, the clinical_grade flag and the compliance level. An AHI from a polysomnography session scored at full compliance is evidence for diagnosis. A REM total from a consumer_estimate wearable night is an indication that supports conversation. Because the scoring algorithm version travels with the data, a clinician comparing a patient's 2018-era study with a recent one can see whether a change reflects the patient or the rule set.

Patients keep control through consent. They can limit which clinic sees their dashboard, decline research use, or revoke a grant, and caregivers see summaries rather than raw event logs. For children, a guardian signs and is responsible for the consent record. A patient who moves to a new clinic does not have to repeat the study, because the history follows through the move procedure. When AASM revises its rules, a re-score adds a new record next to the old one, so a patient's earlier results remain visible and nothing is overwritten.

In summary, WIA-MED-021 keeps sleep data portable by recording where each number came from. Sessions state their instrument and clearance, stages state their epoch length, events keep the detail that AHI needs, and scoring metadata names its algorithm and can be superseded without being erased. Consent and audience rules decide who may see a record, and the FHIR, EDF and vendor bridges connect it to existing systems. The next chapter looks at the data format in field-level detail, beginning with the session record and its encoding rules.