Buyer data room

Patient-owned home BP log that speaks FHIR and produces a chart-ready report — without ever seeing a health-system password.

Full write-up: docs/buyer-data-room.md in the KeepBP repo. Contact: support@bloodpressuretracker.app

Request a pilot

Free clinic pilot: ~5–10 patients, ~2 weeks, feedback on PDF / share link. Optional SMART Connect when your org enables it — Parkview production Epic read is Live / E2E verified; other orgs still need enablement. Write-back remains sandbox.

Email support@bloodpressuretracker.app — Request a pilot

Also see Integrations · Security · data room write-up in repo docs/buyer-data-room.md

Architecture

Node.js / Express on Render
Postgres primary in production; SQLite optional for local/dev only
HTTP-only sessions (connect-pg-simple on Postgres); AES-256-GCM field encryption current on production when DATA_ENCRYPTION_KEY is set
Redis rate limits live when REDIS_URL is set (production)
SMART tokens server-side only — portal passwords never touch KeepBP

Security posture (Phases 0–3)

Phase 0–1 Live headers, CSRF, email verify, HIBP, lockout, session timeouts, optional TOTP/passkeys

Phase 2–3 Live on production Postgres + AES-256-GCM encryption, Redis rate limits, admin elevate; anomaly webhooks remain Planned until SECURITY_ALERT_WEBHOOK_URL

Controls mapped to SOC 2 / HIPAA Security Rule themes (access, encryption transit/at rest, audit, integrity, transmission, disposal) — Certification: not claimed. Details: Security.

Live Expiring patient-controlled share links (/share/:token); hash-only token storage; revoke anytime.

FHIR / EHR

Live Sandbox Epic SMART read + health-system picker — Parkview production read E2E verified (Connect → fetch → import; write-back still sandbox)
Live Cloudflare Worker egress for Render → *.epichosted.com when EPIC_FHIR_EGRESS_* is set — Connect → MyChart login verified 2026-09-17 for Johns Hopkins, Cedars-Sinai, Advocate Aurora, Atrium, Intermountain, Mount Sinai, NewYork-Presbyterian, BJC/WashU (not full E2E; no patient logins)
Sandbox Epic Observation write-back (production filing org-dependent / PEF) — PEF write-back playbook; sandbox write retested 2026-09-17 still returns Epic 59189 (PEF), so the code path works but the public sandbox cannot file. Production write-back waits on org PEF (Parkview ask drafted).
Live Sandbox Oracle Health / Cerner SMART read
Live FHIR R4 Bundle export; Inferno-style vital-signs smoke PASS (local structural)
Org ledger (probe vs E2E): docs/epic-org-verification.md · egress notes: docs/epic-fhir-egress.md

Metrics we track

Funnel events only (no PHI): signup, import, FHIR connect/import/write, report PDF + share create/view/revoke, export/delete. We do not invent MAU or hospital counts on this page. Authenticated admin diligence snapshots (audit counts) are available at /admin.html — not published here.

How to pilot

Create an account → log readings → Report tab → Download PDF or Create share link (default 7-day expiry).
Import → Epic public sandbox (or Oracle when client id is configured) → fetch → confirm.
Request a pilot / design partner / BAA: support@bloodpressuretracker.app.

Parkview production Epic read is Live / E2E verified. Other production MyChart orgs still need KeepBP’s patient SMART client enabled; until then, CSV + PDF / share link is the pilot path. Write-back is not claimed in production. See Integrations and Security.