SMART Health IT launcher without a patient?

[Paul Lynch]

I am working on an app that does not have a particular patient in view.  However, the SMART Health IT launcher (at https://launch.smarthealthit.org) always seems to make me pick a patient.  Is there a setting I'm missing, or is picking a patient really necessary?

Thanks,

--Paul

[Vladimir Ignatov]

Hi Paul,

 

That should depend on the requested scopes. If you request a "launch" scope (or "launch/patient" in standalone launch), then you will have to select a patient. The launcher is trying to emulate an EHR environment, so if a "launch" scope is requested it needs to provide the launch context, which contains the current patient and encounter. Note that the encounter is not supported by every EHR.

 

Furthermore, some client libraries (like the fhirclient) will detect if the app is being launched in EHR mode. If your launch_uri is being called with code and state URL parameters, it means your app is starting an EHR launch sequence. In that case, the fhirclient library will add "launch" to the requested scopes if you have not done it yourself. In other words, if you are making an EHR launch you have to select a patient.

 

Thanks,

Vlad

[Vladimir Ignatov]

Correction: I meant to say that If your launch_uri is being called
with "launch" and "iss" URL parameters, it means your app is starting an EHR
launch sequence and a "launch" scope can be automatically appended to your
authorization request parameters.

On Sunday, July 28, 2019 10:13:32 AM EDT Vladimir Ignatov wrote:
> Hi Paul,
>
> That should depend on the requested scopes. If you request a "launch" scope

> (or "launch/ patient" in standalone launch), then you will have to select a

> patient. The launcher is trying to emulate an EHR environment, so if a
> "launch" scope is requested it needs to provide the launch context, which
> contains the current patient and encounter. Note that the encounter is not
> supported by every EHR.
>

> Furthermore, some client libraries (like the fhirclient[1]) will detect if

> the app is being launched in EHR mode. If your launch_uri is being called
> with code and state URL parameters, it means your app is starting an EHR
> launch sequence. In that case, the fhirclient library will add "launch" to
> the requested scopes if you have not done it yourself. In other words, if
> you are making an EHR launch you have to select a patient.
>
> Thanks,
> Vlad
>
> On Wednesday, July 24, 2019 6:04:21 PM EDT 'Paul Lynch' via SMART on FHIR
wrote:
> > I am working on an app that does not have a particular patient in view.
> > However, the SMART Health IT launcher (at
> > https://launch.smarthealthit.org)
> > always seems to make me pick a patient. Is there a setting I'm missing,
> > or
> > is picking a patient really necessary?
> >
> > Thanks,
> > --Paul
>

> --------
> [1] http://docs.smarthealthit.org/client-js/

[Paul Lynch]

Vlad-- Thanks for the reply.  I'm not clear if you mean that SMART doesn't support launching from an EHR without a patient, or if you mean that the SMART Health IT launcher requires it.  I would think that there are times in an EHR when no patient is selected.  Also, the SMART on FHIR spec (http://hl7.org/fhir/smart-app-launch/scopes-and-launch-context/index.html) talks about other possible scopes like user/Observation.read, for which there wouldn't be a particular patient.  I am not sure why such a scope couldn't be requested by the app even in launched from an EHR.

[Josh Mandel]

Technically SMART allows a launching app to specify the context it requires (e.g. by requesting "launch/patient" if it needs a patient, or "launch/encounter" if it needs an encounter). Currently I think the Launcher utility doesn't support user level scopes without patient context, but this is a feature that we could consider for the Launcher. Vlad, I'm curious whether you've thought about this already.

--
You received this message because you are subscribed to the Google Groups "SMART on FHIR" group.
To unsubscribe from this group and stop receiving emails from it, send an email to smart-on-fhi...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/smart-on-fhir/69366d40-2586-46cd-984e-04e2918dba74%40googlegroups.com.

[Vladimir Ignatov]

I think the question was how to avoid having to pick a patient if you don't need it, and the answer could be:

1. Do not request "launch" or "launch/patient" scopes.

2. In addition, if you are using the JS client, do not perform an EHR launch because it will append a "launch" scope for you.

 

As for the launcher, it does not "really" support scopes. They are used at launch time to decide whether to show a patient picker, or to render an authorization page... However, at run time, while the requests to the FHIR server are being made, the launcher acts as simple proxy that verifies the access token but ignores the scopes.

 

Here is a standalone example - http://launch.smarthealthit.org/sample-app/index.html?aud=http%3A%2F%2Flaunch.smarthealthit.org%2Fv%2Fr4%2Fsim%2FeyJoIjoiMSJ9%2Ffhir

- If you don't select the "launch/patient" scope no patient picker will be displayed.

- If you do request "launch/patient" but do not include "patient/*.read" or "patient/*.*", then the selected patient will fail to render. That looks nice but it is in fact done by the client-side app for demonstration purposes. A "real" server should do that on the back-end but the launcher does not. It would give you the patient even if you don't possess the proper scopes.

 

Thanks,

Vlad

> > <https://groups.google.com/d/msgid/smart-on-fhir/69366d40-2586-46cd-984e-

> > 04e2918dba74%40googlegroups.com?utm_medium=email&utm_source=footer> .

 

 

[Josh Mandel]

In general a SMART app should be able to perform an EHR launch without requesting patient context -- and the way to do this would be to request the launch scope but not the launch/patient scope. So the scope string might look like "launch openid fhirUser user/*.read" or "launch user/*.read". I think the feature request for our launcher would be to make sure it can handle a request like this without popping up a patient picker.