Integrating custom healthcare applications with major electronic health record (EHR) systems like Epic or Oracle Cerner is a critical milestones for clinical software. Historically, this meant parsing complex, legacy HL7 v2 pipe-delimited feeds over VPN tunnels.
Today, the landscape has evolved. The **SMART on FHIR** framework allows apps to run directly within the EHR iframe or query data using standardized RESTful APIs. This guide describes the core OAuth2 handshake and patient query lifecycle.
1. SMART on FHIR App Launch Handshake
When a doctor launches your app from inside Epic, the EHR redirects the doctor's browser to your application with specific URL launch parameters.
GET https://app.turnstilesoftware.com/launch?
iss=https%3A%2F%2Fehr.hospital.org%2Ffhir
&launch=epic_session_id_456
&client_id=my_registered_client_123Your app then redirects back to the EHR's OAuth endpoint to obtain an access token authorizing queries for the current patient context.
2. Fetching Patient Demographics via FHIR API
Once authorized, you query resources using JSON structures defined by the **HL7 FHIR** standard (typically R4 version).
// Example FHIR Patient Query
GET https://ehr.hospital.org/fhir/Patient/102934
Authorization: Bearer token_xyz
Accept: application/fhir+jsonThe response returns a standardized JSON object mapping clinical details.
3. EHR App Store Certifications
Deploying into production requires submitting your software to Epic's App Orchard or Cerner's code program. The certification audits review authentication timeouts, clinical clinical-safety fallbacks, and data leakage risks.