Real World Test Plan

Claimpower Real World Testing Plan - 2025 Results

Developer Name: Claimpower, Inc

Product Name: Claimpower Mobile EMR

Version Number: 6.1

Certified Health IT Product List (CHPL) ID(s): 15.04.04.1238.Clai.06.02.1.230109

Developer Real World Testing Page URL: https://claimpower.com/real-world-test-plan/

Test Server Endpoint
FHIR : https://fhirserver.claimpower.com
Authentication Server: https://oauth.claimpower.com

Note: these are non-deployed capabilities, tested with synthetic user data in an environment mirroring production. See sample responses below in each section.

Types of Smart-On-FHIR applications

• Standalone App : SMART on FHIR confidential client with a patient context, refresh token, and OpenID Connect (OIDC) identity
  token.
• EHR Embedded app: Demonstrate the ability to perform an EHR launch to a SMART on FHIR
• Smart Backend Services App (Multi-patient authorization and API) : These are server-to-server backend applications e.g. Export clinical data for multiple patients in a group. This app is system level app without any UI.

Types of Authentications supported

• Symmetric (“client secret”) authentication (HL7.FHIR.UV.SMART-APP-LAUNCH\Example App Launch for Symmetric Client Auth - FHIR
  v4.0.1)
• Asymmetric (“private key JWT”) authentication (HL7.FHIR.UV.SMART-APP-LAUNCH\Example App Launch for Asymmetric Client Auth
• FHIR v4.0.1)
• Public Clients (HL7.FHIR.UV.SMART-APP-LAUNCH\Example App Launch for Public Client - FHIR v4.0.1)

Steps for Smart App Launch
1. Client App Registration
2. Retrieve .well-known/smart-configuration
3. Obtain authorization code
4. Obtain access token
5. Access FHIR API
6. Refresh Token to obtain new access token

Client App Registration
Before a SMART app can run against an EHR, the app must be registered with that EHR’s authorization service. We are using OAuth 2.0 Client
Registration.

• Third-party application must sign the API Subscription Agreement with following details
• The app name
• The necessary APIs / Scopes
• Any redirect URIs
• Launch_URL (optional)
• URL to JWK Set (Only for apps supporting asymmetric client authentication).
• The application is created by the EHR admin after confirming the app’s registration parameters and communicates a client_id to the
  app.
• Only reads data from FHIR server

Retrieve .well-known/smart-configuration
In order to obtain launch context and request authorization to access FHIR resources, the app discovers the EHR FHIR server’s SMART
configuration metadata, including OAuth authorization_endpoint and token_endpoint URLs.
FHIR server makes SMART configuration available from well-known endpoint. You can get Authorization end point and token endpoint.

Request
GET 200 https://fhirserver.claimpower.com/r4/.well-known/smart-configuration

Response

{
"capabilities": [
"launch-ehr",
"launch-standalone",
"client-public",
"client-confidential-symmetric",
"sso-openid-connect",
"context-banner",
"context-style",
"context-ehr-patient",
"context-ehr-encounter",
"context-standalone-patient",
"context-standalone-encounter",
"permission-offline",
"permission-patient",
"permission-user"
],
"revocation_endpoint": "https://oauth.claimpower.com/outh/token/revoke-token",
"authorization_endpoint": "https://oauth.claimpower.com/outh/authorization",
"token_endpoint": "https://oauth.claimpower.com/outh/token"
}

Error codes
JSON response is returned from the FHIR Server along with the code
200: Ok
401: Unauthorized
400: Bad Request
500: Internal Server Error
Obtain authorization code
The app supplies the following parameters to the EHR’s “authorize” endpoint.

Here's an example of an authorization request using HTTP GET. You will replace the [redirect_uri], [client_id], [launch_token], [state], [code_challenge], and [audience] placeholders with your own values.

Request

https://ehr/authorize?
response_type=code&
client_id=app-client-id&
redirect_uri=https%3A%2F%2Fapp%2Fafter-auth&
launch=xyz123&
scope=launch+patient%2FObservation.rs+patient%2FPatient.rs+openid+fhirUser&
state=98wrghuwuogerg97&
aud=https://ehr/fhir

Response
The EHR's authorization server reviews the request from your application. If approved, the authorization server redirects the browser to the
redirect URL supplied in the initial request and appends the following querystring parameter.
• code: This parameter contains the authorization code generated by EHR, which will be exchanged for the access token in the next step.
• state: The exact value received from the client.

Example request URL:

https://oauth.claimpower.com/outh/authorization?response_type=code&client_id=SAMPLE_CONFIDENTIAL_CLIENT_ID&redirect_uri=https%3
A%2F%2Finferno.healthit.gov%2Finferno%2Foauth2%2Fstatic%2Fredirect&scope=launch%2Fpatient+openid+fhirUser+offline_access+patient%
2FMedication.read+patient%2FAllergyIntolerance.read+patient%2FCarePlan.read+patient%2FCareTeam.read+patient%2FCondition.read+patie
nt%2FDevice.read+patient%2FDiagnosticReport.read+patient%2FDocumentReference.read+patient%2FEncounter.read+patient%2FGoal.read+
patient%2FImmunization.read+patient%2FLocation.read+patient%2FMedicationRequest.read+patient%2FObservation.read+patient%2FOrgani
zation.read+patient%2FPatient.read+patient%2FPractitioner.read+patient%2FProcedure.read+patient%2FProvenance.read+patient%2FPractiti
onerRole.read&state=26a45e37-7445-4e4a-b8fb-24144eccbdc4&aud=https%3A%2F%2Finferno.healthit.gov%2Freference-server%2Fr4

Example response URL (Location: https://app/after-auth?code=123abc&state=98wrghuwuogerg97):

https://inferno.healthit.gov/inferno/oauth2/static/redirect?code=SAMPLE_CODE.bGF1bmNoL3BhdGllbnQgb3BlbmlkIGZoaXJVc2VyIG9mZmxpbmVfYWNjZXNzIHBhdGllbnQvTWVkaWNhdGlvbi5yZWFkIHBhdGllbnQvQWxsZXJneUludG9sZXJhbmNlLnJlYWQgcGF0aWVudC9DYXJlUGxhbi5yZWFkIHBhdGllbnQvQ2FyZVRlYW0ucmVhZCBwYXRpZW50L0NvbmRpdGlvbi5yZWFkIHBhdGllbnQvRGV2aWNlLnJlYWQgcGF0aWVudC9EaWFnbm9zdGljUmVwb3J0LnJlYWQgcGF0aWVudC9Eb2N1bWVudFJlZmVyZW5jZS5yZWFkIHBhdGllbnQvRW5jb3VudGVyLnJlYWQgcGF0aWVudC9Hb2FsLnJlYWQgcGF0aWVudC9JbW11bml6YXRpb24ucmVhZCBwYXRpZW50L0xvY2F0aW9uLnJlYWQgcGF0aWVudC9NZWRpY2F0aW9uUmVxdWVzdC5yZWFkIHBhdGllbnQvT2JzZXJ2YXRpb24ucmVhZCBwYXRpZW50L09yZ2FuaXphdGlvbi5yZWFkIHBhdGllbnQvUGF0aWVudC5yZWFkIHBhdGllbnQvUHJhY3RpdGlvbmVyLnJlYWQgcGF0aWVudC9Qcm9jZWR1cmUucmVhZCBwYXRpZW50L1Byb3ZlbmFuY2UucmVhZCBwYXRpZW50L1ByYWN0aXRpb25lclJvbGUucmVhZCA=.ODU=&state=26a45e37-7445-4e4a-b8fb-24144eccbdc4

After receiving the authorization code, your application trades the code for a JSON object containing an access token and contextual information by sending an HTTP POST to the token endpoint using a Content-Type header with value of "application/x-www-form-urlencoded".

Error codes

JSON response is returned from the FHIR Server along with the code
200: Ok
401: Unauthorized
400: Bad Request
500: Internal Server Error

Symmetric Authentication Request

https://oauth.claimpower.com/outh/token

Payload

grant_type=authorization_code&code=SAMPLE_CODE.bGF1bmNoL3BhdGllbnQgb3BlbmlkIGZoaXJVc2VyIG9mZmxpbmVfYWNjZXNzIHBhdGllbn
QvTWVkaWNhdGlvbi5yZWFkIHBhdGllbnQvQWxsZXJneUludG9sZXJhbmNlLnJlYWQgcGF0aWVudC9DYXJlUGxhbi5yZWFkIHBhdGllbnQvQ2FyZVRlY
W0ucmVhZCBwYXRpZW50L0NvbmRpdGlvbi5yZWFkIHBhdGllbnQvRGV2aWNlLnJlYWQgcGF0aWVudC9EaWFnbm9zdGljUmVwb3J0LnJlYWQgcGF
0aWVudC9Eb2N1bWVudFJlZmVyZW5jZS5yZWFkIHBhdGllbnQvRW5jb3VudGVyLnJlYWQgcGF0aWVudC9Hb2FsLnJlYWQgcGF0aWVudC9JbW11b
ml6YXRpb24ucmVhZCBwYXRpZW50L0xvY2F0aW9uLnJlYWQgcGF0aWVudC9NZWRpY2F0aW9uUmVxdWVzdC5yZWFkIHBhdGllbnQvT2JzZXJ2YXR
pb24ucmVhZCBwYXRpZW50L09yZ2FuaXphdGlvbi5yZWFkIHBhdGllbnQvUGF0aWVudC5yZWFkIHBhdGllbnQvUHJhY3RpdGlvbmVyLnJlYWQgcGF0
aWVudC9Qcm9jZWR1cmUucmVhZCBwYXRpZW50L1Byb3ZlbmFuY2UucmVhZCBwYXRpZW50L1ByYWN0aXRpb25lclJvbGUucmVhZCA%3D.ODU%
3D&redirect_uri=https%3A%2F%2Finferno.healthit.gov%2Finferno%2Foauth2%2Fstatic%2Fredirect

In case of Asymmetric authentication:

Request

client_assertion=eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzM4NCIsImtpZCI6IjRiNDlhNzM5ZDFlYjExNWIzMjI1ZjRjZjliZWI2ZDFiIn0.eyJpc3MiOiJleUpoYkdja
U9pSklVekkxTmlJc0luUjVjQ0k2SWtwWFZDSXNJbXRwWkNJNkluSmxaMmx6ZEhKaGRHbHZiaTEwYjJ0bGJpSjkuZXlKcWQydHpYM1Z5YkNJNkltaDBk
SEE2THk4eE1DNHhOUzR5TlRJdU56TXZhVzVtWlhKdWJ5OHVkMlZzYkMxcmJtOTNiaTlxZDJ0ekxtcHpiMjRpTENKaFkyTmxjM05VYjJ0bGJuTkZlSEJwY
21WSmJpSTZNVFVzSW1saGRDSTZNVFU1TnpReE16RTVOWDAucTR2NE1zYzc0a041MDZLVFowcV9taW55YXBKdzBnd2xUNk1fdWlMNzNTNCIsInN
1YiI6ImV5SmhiR2NpT2lKSVV6STFOaUlzSW5SNWNDSTZJa3BYVkNJc0ltdHBaQ0k2SW5KbFoybHpkSEpoZEdsdmJpMTBiMnRsYmlKOS5leUpxZDJ0el
gzVnliQ0k2SW1oMGRIQTZMeTh4TUM0eE5TNHlOVEl1TnpNdmFXNW1aWEp1Ynk4dWQyVnNiQzFyYm05M2JpOXFkMnR6TG1wemIyNGlMQ0po
WTJObGMzTlViMnRsYm5ORmVIQnBjbVZKYmlJNk1UVXNJbWxoZENJNk1UVTVOelF4TXpFNU5YMC5xNHY0TXNjNzRrTjUwNktUWjBxX21pbnlhcEp
3MGd3bFQ2TV91aUw3M1M0IiwiYXVkIjoiaHR0cHM6Ly9pbmZlcm5vLmhlYWx0aGl0Lmdvdi9yZWZlcmVuY2Utc2VydmVyL29hdXRoL2J1bGstdG9r
ZW4iLCJleHAiOjE2NTMxMDY4ODgsImp0aSI6ImZmZjA5YjIxMjhiOWRmNmU3MGU5MWQ2ZDUwMGQxMmFmYmU2YWE4N2FhMjJlZjVhMjc5YjZ
hNTI0YzA0NmM1ZWEifQ.tlx7jIu9wn7QdHHdWyUMf9otY0r7eX62LuVF3kZOsjjw-CP-glqdbDtOKiuBQ9doduW4zyk3fs6k48XpAEQLsSXajfEJeDy9ujWdSmpAHEC0xYHQSzajekdwlDSBRA&client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwtbearer&grant_type=client_credentials&scope=system%2F%2A.read

Response

The EHR authorization server SHALL return a JSON object that includes an access token or a message indicating that the authorization request
has been denied. The JSON structure includes the following parameters:

Sample response

{
"access_token": "3e934471-1dbf-4a69-8e1f-227f9fd65428",
"refresh_token": "31c4476d-6e9d-41a3-a272-065d05c3599d",
"patient": "85",
"scope": "launch/patient openid fhirUser offline_access patient/*.read ",
"need_patient_banner": false,
"id_token":
"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJkYjExNzk1Ny02MDU4LTRhODYtYTcxMi0yMDU2NDU5ZDUxMzgiLCJhdWQiOiJTQU1QTEVfQ
09ORklERU5USUFMX0NMSUVOVF9JRCIsImlzcyI6Imh0dHBzOi8vaW5mZXJuby5oZWFsdGhpdC5nb3YvcmVmZXJlbmNlLXNlcnZlci9yNCIsImV4cCI6
MTY4NDU3OTc5NywiaWF0IjoxNjUzMDQzNzk3LCJmaGlyVXNlciI6Imh0dHBzOi8vaW5mZXJuby5oZWFsdGhpdC5nb3YvcmVmZXJlbmNlLXNlcnZlci9
yNC9QYXRpZW50Lzg1In0.R1oMsXCTXMKiM1ohCxh3LkgXrgfBebNIaC_jam9sBOwYCCw7K4TLUBmVzKIGb3_-
5wZtqyTTqO6bRwsituXSefoS1QwI14wLGpk-fOsr6M4uSXW5An4WUy8858j3aa5Qkcf0pw4QP3-
rlmVJoHuN_In4ULn5bpRQJkllEQ2ySPj3pkoWWMwfij5p7nNfvwgkE2QOCM4Q-ounE6oLyYZJp_OGvVhkREu8jO77m3Tgsji_jbX7g4-
deuwB4F9EHUfpjfhM3TB1GIoQ7cgJFhHOs9mTCcpT0aYYQkmCJGRx1R5jI-I56p4_63IkU2BRau-INII3Zvcnsz5ajpvU46eIwg",
"smart_style_url": "https://oauth.claimpower.com/app/smart-style-url",
"token_type": "bearer",
"expires_in": 3600
}

Error codes

JSON response is returned from the FHIR Server along with the code
200: Ok
401: Unauthorized
400: Bad Request
500: Internal Server Error

At this point, the authorization flow is complete.

Request : Patient

Search Parameters

_id: GET [Base_URL]/Patient/_search?Patient=[id]
Identifier : GET [Base_URL]/Patient?identifier={system|}[code]
Name: GET [Base_URL]/Patient?name=[string]
birthdate + name :GET [Base_URL]/Patient?birthdate=[date]&name=[string]
gender + name : GET [Base_URL]/Patient?gender={system|}[code]&name=[string]

Response

US Core Patient Profile as specified in the US Core v3.1.1 Implementation Guide

Code: 200 (Success)

 {
"resourceType": "Bundle",
"id": "6f1d6f2d-c42b-453b-8f5a-8d74c24f6fb6",
"type": "searchset",
"total": 1,
"link": [
{
"relation": "self",
"url": "https://FHIR-Base-URL/api/v4/Patient?_count=10&_id=17e77411359-8837d878-ea1e-45b5-bb89-882fdfb2be4b&_page=1"
}
],
"entry": [
{
"id": "17e77411359-8837d878-ea1e-45b5-bb89-882fdfb2be4b",
"fullUrl": "https://FHIR-Base-URL/api/v4/Patient/17e77411359-8837d878-ea1e-45b5-bb89-882fdfb2be4b",
"resource": {
"resourceType": "Patient",
"id": "17e77411359-8837d878-ea1e-45b5-bb89-882fdfb2be4b",
"meta": {
"versionId": "3",
"lastUpdated": "2022-03-24T10:50:49.231Z",
"profile": [
"http://hl7.org/fhir/us/core/StructureDefinition/us-core-patient"
]
},
"text": {
"status": "generated",
"div": "
Generated by Synthea.Version identifier: v2.6.1-3-g50f4f58f\n . Person seed:
4286870567281389426 Population seed: 3
"
},
"extension": [
{
"extension": [
{
"url": "ombCategory",
"valueCoding": {
"system": "urn:oid:2.16.840.1.113883.6.238",
"code": "2106-3",
"display": "White"
}
},
{
"url": "text",
"valueString": "White"
}
],
"url": "http://hl7.org/fhir/us/core/StructureDefinition/us-core-race"
},
{
"extension": [
{
"url": "ombCategory",
"valueCoding": {
"system": "urn:oid:2.16.840.1.113883.6.238",
"code": "2186-5",
"display": "Non Hispanic or Latino"
}
},
{
"url": "text",
"valueString": "Non Hispanic or Latino"
}
],
"url": "http://hl7.org/fhir/us/core/StructureDefinition/us-core-ethnicity"
},
{
"url": "http://hl7.org/fhir/StructureDefinition/patient-mothersMaidenName",
"valueString": "Christen366 Murray856"
},
{
"url": "http://hl7.org/fhir/us/core/StructureDefinition/us-core-birthsex",
"valueCode": "M"
},
{
"url": "http://hl7.org/fhir/StructureDefinition/patient-birthPlace",
"valueAddress": {
"city": "Springfield",
"state": "Massachusetts",
"country": "US"
}
}
],
"identifier": [
{
"system": "https://github.com/synthetichealth/synthea",
"value": "e91975f5-9445-c11f-cabf-c3c6dae161f2"
},
{
"type": {
"coding": [
{
"system": "http://terminology.hl7.org/CodeSystem/v2-0203",
"code": "MR",
"display": "Medical Record Number"
}
],
"text": "Medical Record Number"
},
"system": "http://hospital.smarthealthit.org",
"value": "e91975f5-9445-c11f-cabf-c3c6dae161f2"
},
{
"type": {
"coding": [
{
"system": "http://terminology.hl7.org/CodeSystem/v2-0203",
"code": "SS",
"display": "Social Security Number"
}
],
"text": "Social Security Number"
},
"system": "http://hl7.org/fhir/sid/us-ssn",
"value": "999-61-9798"
},
{
"type": {
"coding": [
{
"system": "http://terminology.hl7.org/CodeSystem/v2-0203",
"code": "DL",
"display": "Driver's License"
}
],
"text": "Driver's License"
},
"system": "urn:oid:2.16.840.1.113883.4.3.25",
"value": "S99940282"
}
],
"name": [
{
"use": "official",
"family": "Harry",
"given": [
"Tom"
],
"prefix": [
"Mr."
],
"suffix": [
"Jr."
]
},
{
"use": "maiden",
"given": [
"Alex"
]
}
],
"telecom": [
{
"system": "phone",
"value": "555-770-2787",
"use": "home"
}
],
"gender": "male",
"birthDate": "1941-09-05",
"address": [
{
"extension": [
{
"extension": [
{
"url": "latitude",
"valueDecimal": 42.1343534042923
},
{
"url": "longitude",
"valueDecimal": -72.67217549422628
}
],
"url": "http://hl7.org/fhir/StructureDefinition/geolocation"
}
],
"line": [
"599 Schowalter Promenade"
],
"city": "West Springfield",
"state": "MA",
"postalCode": "01089",
"country": "US",
"period": {
"start": "1940-09-05"
}
}
],
"maritalStatus": {
"coding": [
{
"system": "http://terminology.hl7.org/CodeSystem/v3-MaritalStatus",
"code": "M",
"display": "M"
}
],
"text": "M"
},
"multipleBirthBoolean": false,
"communication": [
{
"language": {
"coding": [
{
"system": "urn:ietf:bcp:47",
"code": "en-US",
"display": "English"
}
],
"text": "English"
}
}
]
},
"search": {
"mode": "match",
"score": 1
}
}
]
}

Request : CarePlan

GET [Base_URL]/AllergyIntolerance?CarePlan=assess-plan&patient=[id]
e.g. https://[Base_URL]/CarePlan?category=assess-plan&patient=17e77411359-8837d878-ea1e-45b5-bb89-882fdfb2be4b

Response

Each resource returned from the first search is expected to conform to the US Core CarePlan Profile.
Code: 200 (Success)

{
"resourceType": "Bundle",
"id": "79d7a78e-de9b-4c5c-b51d-45b72963ae1f",
"type": "searchset",
"total": 1,
"link": [
{
"relation": "self",
"url": "https://fhirserver.claimpower.com:9443/fhir-server/api/v4/CarePlan?_count=10&category=assessplan&patient=Patient/17e77411359-8837d878-ea1e-45b5-bb89-882fdfb2be4b&_page=1"
}
],
"entry": [
{
"id": "17e776e13ff-1ea7505d-f475-4f49-adde-30e69df86734",
"fullUrl": "https://fhirserver.claimpower.com:9443/fhir-server/api/v4/CarePlan/17e776e13ff-1ea7505d-f475-4f49-adde-30e69df86734",
"resource": {
"resourceType": "CarePlan",
"id": "17e776e13ff-1ea7505d-f475-4f49-adde-30e69df86734",
"meta": {
"versionId": "2",
"lastUpdated": "2022-01-21T10:56:06.304Z",
"profile": [
"http://hl7.org/fhir/us/core/StructureDefinition/us-core-careplan"
]
},
"text": {
"status": "generated",
"div": "<div xmlns=\"http://www.w3.org/1999/xhtml\">Care Plan for Fracture care.<br/>Activities: <ul><li>Fracture care</li><li>Fracture
care</li></ul><br/>Care plan is meant to treat Fracture of clavicle.</div>"
},
"status": "active",
"intent": "order",
"category": [
{
"coding": [
{
"system": "http://hl7.org/fhir/us/core/CodeSystem/careplan-category",
"code": "assess-plan"
}
]
},
{
"coding": [
{
"system": "http://snomed.info/sct",
"code": "384758001",
"display": "Self-care interventions (procedure)"
}
],
"text": "Self-care interventions (procedure)"
}
],
"subject": {
"reference": "Patient/17e77411359-8837d878-ea1e-45b5-bb89-882fdfb2be4b"
},
"encounter": {
"reference": "Encounter/17e77566282-0c9c236b-f0bd-45e0-9c61-80991a376967"
},
"period": {
"start": "1941-10-02T18:33:18-05:00"
},
"careTeam": [
{
"reference": "CareTeam/17e775e7546-36e6a4cd-264e-4a94-92fa-cdf1b2fa30c1"
}
],
"activity": [
{
"detail": {
"code": {
"coding": [
{
"system": "http://snomed.info/sct",
"code": "409002",
"display": "Food allergy diet"
}
],
"text": "Food allergy diet"
},
"status": "in-progress",
"location": {
"reference": "Location/17e7750e68f-6266aec8-0cd3-443e-adb9-be37f3bf25f2",
"display": "HOLYOKE MEDICAL CENTER"
}
}
},
{
"detail": {
"code": {
"coding": [
{
"system": "http://snomed.info/sct",
"code": "58332002",
"display": "Allergy education"
}
],
"text": "Allergy education"
},
"status": "in-progress",
"location": {
"reference": "Location/17e7750e68f-6266aec8-0cd3-443e-adb9-be37f3bf25f2",
"display": "HOLYOKE MEDICAL CENTER"
}
}
},
{
"detail": {
"code": {
"coding": [
{
"system": "http://snomed.info/sct",
"code": "58332002",
"display": "Allergy education"
}
],
"text": "Allergy education"
},
"status": "in-progress",
"location": {
"reference": "Location/17e7750e68f-6266aec8-0cd3-443e-adb9-be37f3bf25f2",
"display": "HOLYOKE MEDICAL CENTER"
}
}
}
]
},
"search": {
"mode": "match",
"score": 1
}
}
]
}

Request: Problems / Health Concern

Search Parameters

GET [base]/Condition?patient=[id]&category={system|}[code]
GET [base]/Condition?patient=[id]&category=http://terminology.hl7.org/CodeSystem/condition-category|problem-list-item
GET [base]/Condition?patient=[id]&category=http://hl7.org/fhir/us/core/CodeSystem/condition-category|health-concern
GET [base]/Condition?patient=[id]&category=http://terminology.hl7.org/CodeSystem/condition-category|encounter-diagnosis
e.g [Base_URL]/Condition?patient=17e77411359-8837d878-ea1e-45b5-bb89-882fdfb2be4b&category=http://hl7.org/fhir/us/core/CodeSystem/condition-category|health-concern

Response
Each resource returned from the first search is expected to conform to the US Core Condition Profile
Code: 200 (Success)

{
"resourceType": "Bundle",
"id": "f537c30e-fab7-45f0-8167-4ab7a48386ec",
"type": "searchset",
"total": 2,
"link": [
{
"relation": "self",
"url": "https://fhirserver.claimpower.com:9443/fhir-server/api/v4/Condition?_count=10&patient=17e77411359-8837d878-ea1e-45b5-
bb89-882fdfb2be4b&_page=1"
}
],
"entry": [
{
"id": "17e7777ce8c-c66752fb-ee1b-40c2-ba5a-2e6ee89b3e1a",
"fullUrl": "https://fhirserver.claimpower.com:9443/fhir-server/api/v4/Condition/17e7777ce8c-c66752fb-ee1b-40c2-ba5a-2e6ee89b3e1a",
"resource": {
"resourceType": "Condition",
"id": "17e7777ce8c-c66752fb-ee1b-40c2-ba5a-2e6ee89b3e1a",
"meta": {
"versionId": "1",
"lastUpdated": "2022-01-20T12:30:47.436Z",
"profile": [
"http://hl7.org/fhir/us/core/StructureDefinition/us-core-condition"
]
},
"clinicalStatus": {
"coding": [
{
"system": "http://terminology.hl7.org/CodeSystem/condition-clinical",
"code": "resolved"
}
]
},
"verificationStatus": {
"coding": [
{
"system": "http://terminology.hl7.org/CodeSystem/condition-ver-status",
"code": "confirmed"
}
]
},
"category": [
{
"coding": [
{
"system": "http://terminology.hl7.org/CodeSystem/condition-category",
"code": "encounter-diagnosis",
"display": "Encounter Diagnosis"
}
]
}
],
"code": {
"coding": [
{
"system": "http://snomed.info/sct",
"code": "444814009",
"display": "Viral sinusitis (disorder)"
}
],
"text": "Viral sinusitis (disorder)"
},
"subject": {
"reference": "Patient/17e77411359-8837d878-ea1e-45b5-bb89-882fdfb2be4b"
},
"encounter": {
"reference": "Encounter/17e77566282-0c9c236b-f0bd-45e0-9c61-80991a376967"
},
"onsetDateTime": "1940-11-09T18:33:18-05:00",
"abatementDateTime": "1940-11-30T18:33:18-05:00",
"recordedDate": "1940-11-09T18:33:18-05:00"
},
"search": {
"mode": "match",
"score": 1
}
},
{
"id": "17eb029f925-40603327-0ac3-48dd-972b-6c882b8751f5",
"fullUrl": "https://fhirserver.claimpower.com:9443/fhir-server/api/v4/Condition/17eb029f925-40603327-0ac3-48dd-972b-6c882b8751f5",
"resource": {
"resourceType": "Condition",
"id": "17eb029f925-40603327-0ac3-48dd-972b-6c882b8751f5",
"meta": {
"versionId": "1",
"lastUpdated": "2022-01-31T12:44:07.847Z",
"profile": [
"http://hl7.org/fhir/us/core/StructureDefinition/us-core-condition"
]
},
"clinicalStatus": {
"coding": [
{
"system": "http://terminology.hl7.org/CodeSystem/condition-clinical",
"code": "resolved"
}
]
},
"verificationStatus": {
"coding": [
{
"system": "http://terminology.hl7.org/CodeSystem/condition-ver-status",
"code": "confirmed"
}
]
},
"category": [
{
"extension": [
{
"url": "http://hl7.org/fhir/StructureDefinition/data-absent-reason",
"valueCode": "unknown"
}
]
}
],
"code": {
"coding": [
{
"system": "http://snomed.info/sct",
"code": "195662009",
"display": "Acute viral pharyngitis (disorder)"
}
],
"text": "Acute viral pharyngitis (disorder)"
},
"subject": {
"reference": "Patient/17e77411359-8837d878-ea1e-45b5-bb89-882fdfb2be4b"
},
"encounter": {
"reference": "Encounter/17e77566282-0c9c236b-f0bd-45e0-9c61-80991a376967"
},
"onsetDateTime": "1961-06-25T01:11:45-04:00",
"abatementDateTime": "1961-07-07T01:11:45-04:00",
"recordedDate": "1961-06-25T01:11:45-04:00"
},
"search": {
"mode": "match",
"score": 1
}
}
]
}

Request: Implantable Device

Search Parameters
GET [Base_URL]/Device?patient=[id] e.g. [Base_URL]/Device?patient=17e77411359-8837d878-ea1e-45b5-bb89-882fdfb2be4b

Response
Each resource returned from the first search is expected to conform to the US Core ImplantableDevice Profile
Code: 200 (Success)

{
 "resourceType": "Bundle",
 "id": "5804551e-120d-4164-b05b-9705fad44fa5",
 "type": "searchset",
 "total": 1,
 "link": [
 {
 "relation": "self",
 "url": "https://fhirserver.claimpower.com:9443/fhir-server/api/v4/Device?_count=10&patient=17e77411359-8837d878-ea1e-45b5-bb89-
882fdfb2be4b&_page=1"
 }
 ],
 "entry": [
 {
 "id": "17e777b3f34-04bc3627-92d3-43bb-92e7-35533110f750",
 "fullUrl": "https://fhirserver.claimpower.com:9443/fhir-server/api/v4/Device/17e777b3f34-04bc3627-92d3-43bb-92e7-35533110f750",
 "resource": {
 "resourceType": "Device",
 "id": "17e777b3f34-04bc3627-92d3-43bb-92e7-35533110f750",
 "meta": {
 "versionId": "1",
 "lastUpdated": "2022-01-20T12:34:32.884Z",
 "profile": [
 "http://hl7.org/fhir/us/core/StructureDefinition/us-core-implantable-device"
 ]
 },
 "udiCarrier": [
 {
 "deviceIdentifier": "43069338026389",
 "carrierHRF": "(01)43069338026389(11)000302(17)250317(10)1134(21)842026117977"
 }
 ],
 "status": "active",
 "distinctIdentifier": "43069338026389",
 "manufactureDate": "2000-03-02T18:33:18-05:00",
 "expirationDate": "2025-03-17T19:33:18-04:00",
 "lotNumber": "1134",
 "serialNumber": "842026117977",
 "deviceName": [
 {
 "name": "Implantable defibrillator, device (physical object)",
 "type": "user-friendly-name"
 }
 ],
 "type": {
 "coding": [
 {
 "system": "http://snomed.info/sct",
 "code": "72506001",
 "display": "Implantable defibrillator, device (physical object)"
 }
 ],
 "text": "Implantable defibrillator, device (physical object)"
 },
 "patient": {
 "reference": "Patient/17e77411359-8837d878-ea1e-45b5-bb89-882fdfb2be4b"
 }
 },
 "search": {
 "mode": "match",
 "score": 1
 }
 }
 ]
} 

Request: Goal

GET https://[Base_URL]/Goal?patient=[id]
e.g. https://[Base_URL]/Goal?patient=17e77411359-8837d878-ea1e-45b5-bb89-882fdfb2be4b

Response
Each resource returned from the first search is expected to conform to the US Core Goal Profile
Code: 200 (Success)

{
"resourceType": "Bundle",
"id": "6f2db230-b4f4-4447-856b-3f398377a95f",
"type": "searchset",
"total": 1,
"link": [
{
"relation": "self",
"url": "https://fhirserver.claimpower.com:9443/fhir-server/api/v4/Goal?_count=10&patient=17e77411359-8837d878-ea1e-45b5-bb89-
882fdfb2be4b&_page=1"
}
],
"entry": [
{
"id": "17e7b8b62f8-a4f77df6-b97e-4ece-82ff-36480c9cc38c",
"fullUrl": "https://fhirserver.claimpower.com:9443/fhir-server/api/v4/Goal/17e7b8b62f8-a4f77df6-b97e-4ece-82ff-36480c9cc38c",
"resource": {
"resourceType": "Goal",
"id": "17e7b8b62f8-a4f77df6-b97e-4ece-82ff-36480c9cc38c",
"meta": {
"versionId": "1",
"lastUpdated": "2022-01-21T07:30:39.48Z",
"profile": [
"http://hl7.org/fhir/us/core/StructureDefinition/us-core-goal"
]
},
"lifecycleStatus": "active",
"description": {
"coding": [
{
"system": "http://snomed.info/sct",
"code": "281004",
"display": "Alcoholic dementia"
}
],
"text": "Alcoholic dementia"
},
"subject": {
"reference": "Patient/17e77411359-8837d878-ea1e-45b5-bb89-882fdfb2be4b"
},
"target": [
{
"dueDate": "2020-12-07"
}
]
},
"search": {
"mode": "match",
"score": 1
}
}
]
}

Error Handling

Error Description
200 - OK Everything worked as expected.
401 - Unauthorized No valid Bearer token provided.
404 - Not Found The requested resource doesn't exist.
5xx - Server Error Something went wrong on FHIR Server side.

OperationOutcome explains the error reported

Profile audience and scope
This profile is intended to be used by developers of apps that need to access user identity information or other FHIR resources by requesting authorization from OAuth 2.0 compliant authorization servers.
The profile defines a method through which an app requests authorization to access a FHIR resource, and then uses that authorization to retrieve the resource. Synchronization of patient context is not addressed; for use cases that require context synchronization (e.g., learning about when the in-context patient changes within an EHR session) In other words, if the patient chart is changed during the session, the application will not inherently be updated.

Security and Privacy Considerations

App Protection
The app is responsible for protecting itself from potential misbehaving or malicious values passed to its redirect URL (e.g., values injected with executable code, such as SQL) and for protecting authorization codes, access tokens, and refresh tokens from unauthorized access and use. The app developer must be aware of potential threats, such as malicious apps running on the same platform, counterfeit authorization servers, and counterfeit resource servers, and implement countermeasures to help protect both the app itself and any sensitive information it may hold. For background, see the OAuth 2.0 Threat Model and Security Considerations.

Specific requirements are:
• Apps shall ensure that sensitive information (authentication secrets, authorization codes, tokens) is transmitted ONLY to authenticated servers, over TLS-secured channels.
• Apps shall generate an unpredictable state parameter for each user session; shall include state with all authorization requests; and shall validate the state value for any request sent to its redirect URL.
• An app shall NOT execute untrusted user-supplied inputs as code.
• App shall NOT forward values passed back to its redirect URL to any other arbitrary or user-provided URL (a practice known as an “open redirector”).
• An app shall NOT store bearer tokens in cookies that are transmitted as clear text.
• Apps should persist tokens and other sensitive data in app-specific storage locations only, and should NOT persist them in system-wide-discoverable locations.