SoFaaS™ — SMART on FHIR runtime for Epic

What SoFaaS™ is

SoFaaS™ is the deployment runtime for SMART on FHIR apps inside Epic and other EHRs. It is not an integration platform (it complements Redox and 1upHealth rather than replacing them) and it is not a no-code builder. Code generation is a solved problem. What SoFaaS™ covers is everything around the code.

SoFaaS™ prepares the parts of the Epic deployment workflow that AI code generation tools cannot:

• Signing a Business Associate Agreement (BAA) or Data Processing Agreement (DPA) per jurisdiction
• Passing Epic's vendor security review
• Packaging the Epic Showroom submission. SoFaaS™ prepares the Showroom submission materials. Epic decides the listing. You file and hold it once your first hospital is live.
• Running inside a HIPAA-compliant hosted runtime (U.S. data residency) with SOC 2 Type II controls
• Maintaining the integration when Epic ships breaking FHIR changes (quarterly)

For a healthcare vendor, this is what shipping into Epic costs beyond the application code.

A Showroom entry needs at least one live Epic production connection. A listing is not go-live. A hospital can deploy without one.

Why SoFaaS™ exists

Healthcare integration is the part code generation does not solve. Cursor, Claude, Lovable, and similar tools can scaffold a SMART on FHIR app in an afternoon. What they cannot do is sign a BAA, pass Epic's security review, package a Showroom submission, host in a HIPAA-compliant runtime, or maintain the integration as Epic evolves. Epic still decides the listing.

The first hospital deal is the visible problem — typically 12-18 months from build start to production deployment. The hidden problem is every new hospital after the first: each is another 3-6 month compliance project with its own security questionnaire, BAA template, IT validation cycle, and evidence packet. Most vendors hit a compliance-ops wall around their fifth or sixth hospital.

SoFaaS™ centralizes the compliance posture. One audited runtime, one BAA template, one security profile, validated at the platform level. Hospitals review SoFaaS™ once and every app on the runtime inherits that trust. The tenth hospital deploys at the same speed as the first.

How it works

1. Day 1 — Working in Epic. Vendor signs up. SoFaaS™ provisions the workspace. The vendor's app connects to Epic and begins reading FHIR resources. Day 1 = working SMART launch in Epic.
2. Week 2: Showroom submission packet ready. You file it once your first hospital is live. SoFaaS™ prepares the materials against the runtime the listing will point at. The app owner files and holds the listing; Epic decides.
3. Week 3+ — Live at the hospital. First hospital live once their security review and BAA clear. The tenth hospital reuses the same runtime posture. Outer bound = Epic's queue + the hospital's BAA.

SoFaaS™ prepares the Showroom submission materials. Epic decides the listing. If Epic approves, your app appears in Showroom. A listing is not go-live.

Compliance and security

• Healthcare data agreements: BAA under HIPAA. Production PHI for SoFaaS™ stays in U.S. regions; cross-region replication is U.S.-only.
• Security audits: SoFaaS™ is SOC 2 Type II audited. The full report is available under NDA. Evidence packets prepared per hospital security questionnaire.
• Encryption: All in-flight traffic is TLS 1.2 or higher. All at-rest data is encrypted with managed keys.
• Access controls: Role-based access control at the vendor workspace level. SSO available for vendor teams. Every request through the runtime is logged.
• Pen testing: Independent penetration tests are run on a defined cadence by a qualified third party. Coordinated vulnerability disclosure policy.
• Incident response: Documented runbook with hospital notification path. Sub-processors are reviewable.

Pricing

Pricing is scoped to the deployment: an implementation fee plus a per-bed monthly recurring component tied to the size of the hospital deployment. Pricing is set against the value of the deal being unblocked, not against a published list price. Vendors with an active or stalled hospital deal can scope pricing on a 30-minute call.

How SoFaaS™ compares

• Integration platforms (Redox, 1upHealth, Particle Health): These platforms translate clinical data between systems. SoFaaS™ is a deployment runtime — apps run inside it, inside Epic. Redox and 1upHealth are partners we compose with.
• Building it yourself: 12-18 months to the first hospital, full compliance audit on the vendor, every new hospital another 3-6 month compliance cycle.
• Epic App Orchard / Showroom alone: App Orchard is retired. Epic Showroom is the catalog. SoFaaS™ prepares the Showroom submission materials. Epic decides the listing. SoFaaS™ is a compliant SMART on FHIR runtime, and it is not a Redox or 1upHealth replacement.

Frequently asked questions

Does SoFaaS™ replace what AI code generation tools do?

No. SoFaaS™ is complementary to AI code generation. Tools like Cursor, Claude, and similar can scaffold a SMART on FHIR app quickly. SoFaaS™ prepares the BAA / DPA, the security-review packet, and the Showroom submission materials, and it runs the hosted runtime and maintenance through Epic's quarterly changes. You file and hold the listing once your first hospital is live.

How is SoFaaS™ different from Redox or 1upHealth?

Redox and 1upHealth are integration platforms — they translate data between systems. SoFaaS™ is a deployment runtime — your app runs on it, inside Epic, with compliance handled and Showroom materials prepared. Redox and 1upHealth are partners we compose with.

Who owns the code and the data?

The vendor owns their app's code and IP. The hospital owns its data. SoFaaS™ operates the integration — the IP and data relationships stay where they belong.

Contact

Website: vectorcare.dev

Corporate: vectorcare.com

Email: contact@vectorcare.com