By definition, the FHIR is asking you to preserve the XSS vulnerability of the data (store as code, display as code). XSS requires that the data be displayed back to users, which could be prevented with output validation, instead. Accept the input, store as JSON, filter when displaying the HTML data as HTML code. Depending on the "output" systems, this could be much easier (it depends on the need of the system).
Filtering out specifically bad code (malicious javascript, links, etc.) is going to be very difficult. There are lots of ways to hide bad code through obfuscation.
What you could do, depending on the details of the FHIR specification, is to whitelist good/acceptable code. If the FHIR spec is tightly defined, whitelisting should be easy to perform. If the spec is not tightly defined, it might be impossible to block all attempts at stored XSS.