SMART on FHIR

SMART Defines Two Patterns For Client Authorization

Authorization via SMART App Launch

Authorizes a user-facing client application (“App”) to connect to a FHIR Server. This pattern allows for “launch context” such as currently selected patient to be shared with the app, based on a user’s session inside an EHR or other health data software, or based on a user’s selection at launch time. Authorization allows for delegation of a user’s permissions to the app itself.

Launch App: Standalone Launch

In SMART’s standalone launch flow, a user selects an app from outside the EHR,

Launch App: EHR Launch

In SMART’s EHR launch flow, a user has established an EHR session, and then decides to launch an app. This could be a single-patient app (which runs in the context of a patient record), or a user-level app (like an appointment manager or a population dashboard).

The top-level steps for Smart App Launch are:

1. Register App with EHR (_one-time step_, can be out-of-band)
2. 2. Launch App: Standalone Launch or EHR Launch
3. 3. Retrieve .well-known/smart-configuration
4. 4. Obtain authorization code
5. 5. Obtain access token
6. 6. Access FHIR API
7. 7. Refresh access token

Authorization via SMART Backend Services

Authorizes a headless or automated client application (“Backend Service”) to connect to a FHIR Server. This pattern allows for backend services to connect and interact with an EHR when there is no user directly involved in the launch process.