Getting Started with SMART Health IT Sandbox for SMART EHR Integration

In today’s digital age, healthcare is undergoing a major transformation. At the heart of this shift is the Electronic Health Record (EHR), a digital version of a patient’s paper chart. For developers, building applications that can interact with these systems is a crucial yet often complex task. This guide will walk you through a step-by-step approach to implementing EHR integrations, focusing on using the SMART Health IT Sandbox for a smoother start.

Using the SMART Health IT Sandbox for Testing

The SMART Health IT Sandbox is a publicly available, free, and open-source platform that provides a simulated EHR environment. It’s designed specifically for developers to test their FHIR and SMART-enabled applications.

Here’s why the SMART Health IT Sandbox is an excellent choice for getting started:

  • No Setup Required: You can start testing immediately without needing to set up your own FHIR server or EHR.
  • Pre-populated Data: The sandbox comes with realistic, de-identified patient data, allowing you to test your application with various scenarios.
  • Built-in Tools: It provides a client app gallery, a SMART App Launcher, and a debugger to help you troubleshoot authentication and data access issues.
  • Standard-Compliant: The sandbox strictly adheres to the SMART on FHIR specifications, ensuring your app will work with other compliant EHRs.

Step 1: Configure Your App on the Launcher

Head to the SMART Health IT App Launcher. Configure your app by providing:

  • Launch URL: The entry point of your app. After launch, the sandbox redirects here with required params like:
    • iss → The FHIR server base URL
    • launch → An opaque launch context string
  • Redirect URL: Where the authorization server sends the user back after login/consent. This URL receives:
    • code → The OAuth2 authorization code
    • state → The state you supplied for CSRF protection
  • Client ID: A unique app identifier. (In the sandbox, this can be any string.)
  • Scopes: Define what data your app needs. According to SMART’s official guide, the minimum required scopes for an EHR launch are:
    • launch/patient
    • openid
    • fhirUser
    • patient/Patient.read (or other resource-specific scopes as needed)

Step 2: Fetch the Well-Known Configuration

Before exchanging codes, your app should discover the correct authorization and token endpoints dynamically, as outlined in the SMART App Launch documentation:

Commonly found at  – {FHIR_BASE_URL}/.well-known/smart-configuration.

Example

async function fetchSmartConfig(iss: string) {
  const res = await fetch(`${iss}/.well-known/smart-configuration`);
  if (!res.ok) throw new Error("Failed to fetch SMART configuration");
return res.json();
}

This returns JSON with important fields such as authorization_endpoint and token_endpoint.

 

Ready to Go Beyond the Sandbox?

Building a proof-of-concept is just the beginning. Scaling into a production-ready, compliant EHR integration requires expertise in workflows, compliance, and interoperability.

Step 3: Handle the Redirect and Authorization Code Exchange

When your app is launched, it will receive query parameters like iss and launch. After the user authorizes, the EHR redirects to your Redirect URL with code and state. Your app must exchange this code for an access token.

Example:

async function exchangeCodeForToken(
 tokenUrl: string,
 code: string,
 redirectUri: string,
 clientId: string
) {
const params = new URLSearchParams({
 grant_type: "authorization_code",
 code,
 redirect_uri: redirectUri,
 client_id: clientId,
});

const res = await fetch(tokenUrl, {
 method: "POST",
 headers: {
   "Content-Type": "application/x-www-form-urlencoded",
},
body: params.toString(),
});

if (!res.ok) throw new Error("Token request failed");
return res.json();
}

Step 4: Make FHIR API Calls

Once you have the access token, you can make authenticated calls to the FHIR server:

async function fetchPatient(iss: string, token: string, patientId: string) {
  const res = await fetch(`${iss}/Patient/${patientId}`, {
    headers: {
      Authorization: `Bearer ${token}`,
    },
  });
  if (!res.ok) throw new Error("Failed to fetch patient");
  return res.json();

Step 5: Launch and Test

The SMART Health IT Sandbox provides a SMART App Launcher that makes testing incredibly easy. Once your client app is configured:

  1. Select your newly configured client app from the launcher’s gallery.
  2. Choose a pre-populated test patient.
  3. Click Launch. The sandbox will perform the OAuth flow and redirect to your app’s Launch URL with the necessary parameters.

This is your chance to test that your app can successfully authenticate, parse the context, and correctly fetch and display the patient’s data from the sandbox’s FHIR server.

coma

Conclusion and Next Steps

By following these steps, you will have created a working proof-of-concept for an EHR integration without the need for a complex backend. The SMART Health IT Sandbox provides a reliable, standards-compliant environment that lets you focus on building the front-end features and clinical workflows of your application. Once you’re comfortable with the process, you can transition to a full-fledged EHR platform or a dedicated healthcare backend like Medplum, knowing your application’s logic is already sound.

Starting with a purpose-built platform and leveraging the SMART on FHIR standard dramatically accelerates development, allowing you to focus on creating the innovative solutions that will truly transform healthcare.

Keep Reading

Keep Reading

  • Let's create something together!