KeepBP speaks SMART on FHIR so patients can import blood pressure Observations from Epic/MyChart (and related sandboxes), normalize them, and export a chart-ready report or FHIR Bundle — without KeepBP ever seeing a portal password.
Status legend
Live Sandbox Planned
Statuses below match Integrations. We do not invent verification claims.
Epic / MyChart patient read
Live Sandbox verified — Standalone SMART App Launch with PKCE. Searchable health-system picker over Epic’s published FHIR R4 production endpoints. Default empty search shows the Epic public sandbox plus a short featured list.
- Parkview Health production read is Live / E2E verified (Connect → fetch → import via the KeepBP Connect production client).
- Only Parkview is production
e2e_verifiedfor Connect → fetch → import. Authorize / Connect-to-login probes for other orgs are not full E2E. - Other production orgs still need
EPIC_PROD_CLIENT_IDplus org enablement / auto-download; the picker alone does not unlock every MyChart. - Production Connect is read-only (BP fetch) unless scopes are explicitly overridden.
- If Connect is rejected, CSV import remains the fallback.
Scopes (honest split)
- Sandbox:
openid,fhirUser,offline_access,launch/patient,patient/Observation.read,patient/Observation.write,patient/Patient.read - Production (Parkview etc.): read-only by default —
openid,fhirUser,launch/patient,patient/Observation.read,patient/Patient.read
FHIR Bundle export
Live US Core–shaped vital-signs Observations from Your account → Download FHIR Bundle (GET /api/export/fhir-bundle). Inferno-style smoke PASS on 2026-09-16 (133 checks). See repo docs linked from Integrations.
Write-back (PEF) — planned for production filing
Sandbox Planned Patient-controlled home BP as US Core vital-signs Observations (panel 85354-9, with automatic retry as separate systolic/diastolic + pulse), explicit confirm, KeepBP provenance note.
Code path is live in sandbox; retested 2026-09-17 it still returns Epic 59189 (PEF), so the public sandbox cannot file. Production orgs must enable flowsheet mapping — write scope alone is not enough. KeepBP surfaces Epic fhirDetail / OperationOutcome text when filing fails.
Oracle Health / Cerner
Live Sandbox verified Oracle Health / Cerner SMART R4 read — E2E verified: Connect → fetch → import. Deployment still requires ORACLE_CLIENT_ID / CERNER_CLIENT_ID after code Console registration. Production Fetch retest after the 2026-09-17 timeout/parallel-query fixes is parked pending CernerCare login; no new production E2E verification is claimed.
Egress note
Live When needed, Render → Epic-hosted FHIR proxies (*.epichosted.com) route through a Cloudflare Worker egress proxy for server-side discovery, token exchange, and Observation read/write. Browser MyChart authorize redirects do not need the Worker.
What we never do
- Ask for or store MyChart / portal passwords
- Pull a full chart dump, medications, problems, or clinical notes
- Claim medical-device status, diagnosis, or treatment advice
Trust pages: Security · Not medical advice · full status matrix: Integrations.