OAUTH-SMART
SMART on FHIR OAuth healthcare apps EHR launch authorization.
Definition
SMART on FHIR key concepts: (1) EHR launch: EHR opens SMART app passing launch context (current patient + encounter + user identity) via launch parameter, app exchanges launch for OAuth access token. (2) Standalone launch: user launches app independently (not from EHR), app initiates OAuth flow against EHR's FHIR authorization server, user authenticates via EHR credentials, EHR optionally lets user select patient context. (3) OAuth scopes: SMART defines FHIR-specific scopes (e.g., patient/Observation.read + user/Patient.read + system/MedicationRequest.write + offline_access + launch + openid + fhirUser etc.). (4) Public + confidential clients: public clients (browser-based JavaScript apps using PKCE), confidential clients (server-side apps storing client_secret). (5) Backend Services: SMART Backend Services authorization (system-to-system, no user context, using JWT client assertion). (6) Bulk Data: SMART Bulk Data uses Backend Services to authorize bulk FHIR exports for population health analytics. (7) Patient Access: SMART Patient Access scope enables patient-mediated access to own records via consumer apps (ONC + CMS Patient Access API mandates 2021+). SMART on FHIR v1 published ~2014, v2 published 2022 (current ANSI standard, integrated FHIR R4 conformance + tightened security). SMART App Gallery (Harvard Medical School) lists ~150+ certified apps 2024 across categories patient engagement + clinical decision support + research + analytics.
Origin
SMART project initiated 2013 Harvard Medical School + Boston Children's Hospital (Joshua Mandel + Ken Mandl) ; SMART v1 ~2014 ; SMART v2 published 2022 ; ~150+ apps SMART App Gallery 2024.
Example in context
Clinician opens patient chart in Epic, clicks SMART app launch button 'Diabetes Risk Calculator' ; Epic launches app passing launch=eyJ... + iss=https://fhir.epic.com/ ; app exchanges launch via OAuth code flow + receives access_token + patient context, app queries Epic FHIR API GET /Patient/123/Observation?code=glucose to get patient glucose values, calculates 5-year diabetes risk score + displays in app UI, returns clinician to Epic chart.