Skip to main content

Architecture Overview

The AJ Smart FHIR Platform is a modular five-layer architecture. Each layer is independently deployable and replaceable.

The five layers​

Layer 5 — Applications
  SMART Client · Patient Portal · Clinician Portal · Third-party Apps

Layer 4 — Auth & Identity
  Auth Server · PKCE tokens · IdP Federation · Consent Manager

Layer 3 — FHIR Data Layer
  HAPI FHIR JPA · SMART Plugin · Scope Enforcement · Referral Module

Layer 2 — Compliance & Audit
  ATNA Audit · FHIR AuditEvent · GDPR · HIPAA · TEFCA · DISHA

Layer 1 — Infrastructure
  PostgreSQL · Docker Compose · AWS Lightsail · nginx + TLS

EHR launch flow​

  1. Clinician logs in → portal (Auth Server :9000/portal)
  2. Portal fetches patients from HAPI FHIR :8080/fhir
  3. Clinician selects patient → launch token created (atomic, 5-min expiry)
  4. Browser redirects to SMART Client /launch?iss=...&launch=token
  5. Client fetches /.well-known/smart-configuration (proxied to auth server)
  6. Client builds PKCE authorize URL (S256, 96-byte verifier) → redirects
  7. Auth server validates login, resolves launch token → patient + encounter
  8. Token response: access_token + patient + encounter + id_token (top-level JSON)
  9. Client calls HAPI FHIR with Bearer token
  10. SmartScopeInterceptor verifies RS256 signature + SMART scopes on every request
  11. AuditService writes FHIR AuditEvent for every access

Component interaction​

SMART Client ←──────────────────── Auth Server
    │          OAuth2 + PKCE           │
    │          access_token            │
    │          + patient               │
    ▼                                  ▼
HAPI FHIR JPA ◄─── SmartScopeInterceptor (RS256 JWT)
    │               SmartDiscoveryProxy
    ▼
PostgreSQL (HAPI data)   PostgreSQL (auth data)