Epic SMART on FHIR Integration Guide
Whether you're a vendor building for health systems or a health system building internal tools — this guide walks you through how VectorCare abstracts the complexity of SMART on FHIR integration.
What is SMART on FHIR?
SMART on FHIR is an open standard that lets applications securely access patient data from EHR systems. It combines:
- FHIR (Fast Healthcare Interoperability Resources): A modern data format for health information — think of it as the API standard for healthcare.
- OAuth 2.0: A secure authentication protocol that lets users authorize third-party apps to access their data without sharing passwords.
Without SMART on FHIR, you'd need custom point-to-point integrations with every EHR vendor. With SMART on FHIR, one integration pattern works across Epic, Cerner, and others.
VectorCare's role: We handle the SMART launch flow, OAuth token management, and FHIR resource mapping. Your app makes simple API calls.
FHIR Resources Available via VectorCare
When you build on VectorCare, you get authenticated access to these core FHIR resources from Epic:
| Resource | Use Case |
|---|---|
| Patient | Demographics, name, date of birth, contact info |
| Encounter | Visit details, timestamps, encounter type, location |
| Condition | Patient diagnoses and clinical problems |
| Observation | Lab results, vital signs, assessment scores |
| MedicationRequest | Active and historical medication orders |
| ServiceRequest | Referrals, orders for procedures or therapies |
| Appointment | Scheduled appointments and availability |
| Location | Facility information and care settings |
| Coverage | Insurance and eligibility data |
| Organization | Healthcare provider organizations and departments |
All resources are fetched with the patient's current authorization context — you never see data beyond what the logged-in user is permitted to access.
How the OAuth 2.0 / SMART Launch Flow Works
Here's what happens when a clinician launches your app from within Epic:
User clicks your app in Epic's app gallery
Epic redirects to VectorCare with a launch code
VectorCare exchanges the code for an OAuth access token (you don't see this step)
Your app receives a token and the patient context
Your app calls VectorCare's FHIR API with the token
VectorCare returns FHIR data directly from Epic
You don't manage tokens, refresh logic, or error handling. VectorCare's SDK handles it in 3 lines of code.
Epic Showroom Listing and Timeline
To launch on Epic, you need to be listed in Epic Showroom — Epic's official marketplace. VectorCare handles the submission.
You provide app metadata (name, description, logo)
Epic's app team reviews your security documentation (VectorCare provides templates)
Epic runs technical validation against their sandbox environment
Your listing goes live in the Showroom — a listing is optional once you have a live customer connection, but it is how multi-hospital distribution works
Day 1 in Epic, Week 2 on Showroom, Week 3+ live at the hospital. Epic’s own review queue is the variable: intake typically lands in weeks 1–3 and Epic review runs weeks 2–8, and a first hospital can pilot on the runtime in parallel while the listing is in flight. Without VectorCare, add 2–3 months for your own compliance work and Epic onboarding.
Data Access Scopes and Least Privilege
SMART on FHIR uses scopes to control what data your app can access. VectorCare enforces least privilege — your app only requests the scopes it actually needs.
patient/Patient.readRead patient demographicspatient/Encounter.readRead encounter historypatient/Observation.readRead observations (labs, vitals)patient/Condition.readRead active conditionspatient/MedicationRequest.readRead medicationsYou declare scopes once when you create your app on VectorCare. Epic sees exactly what you're asking for, and clinicians approve it at launch time. No hidden permissions, no scope creep.
Security: HIPAA, SOC 2 Type II, BAA
VectorCare operates as a HIPAA Business Associate. Your data is covered by a Business Associate Agreement (BAA) before your first user launches an app.
HIPAA Compliance
All data at rest encrypted (AES-256), in transit encrypted (TLS 1.2+)
SOC 2 Type II
Independently audited access controls, audit logging, change management
Encryption
Keys managed via AWS KMS; no plaintext tokens or patient data stored in logs
Access Logs
All API calls logged with user, timestamp, resource, and action for compliance audits
When you use VectorCare, you inherit these controls. No additional security work required from you.
Internal App Registration (Health Systems)
If you're a health system building internal tools, you don't go through Epic Showroom. Instead, your app is registered directly within your own Epic instance using Internal App Registration.
This means:
- No Showroom listing required — your app is private to your organization
- Faster deployment — skip the public review process
- Same FHIR capabilities — full access to Patient, Encounter, ServiceRequest, and other resources within your instance
- Your IT team controls access — scopes and permissions are managed internally
VectorCare handles the technical setup — OAuth client configuration, FHIR resource mapping, and security compliance — so your clinical informatics team can focus on the workflow, not the plumbing.