Guide
Where each MVP requirement lives and how to try it. Everything runs in this browser with fabricated data; the EHRs are simulated and nothing is sent anywhere.
Demo accounts
Password for all: demo-pass-2026. Practitioners: areyes (Northside and Mercy), swhitfield (Mercy). Patient: rdelgado.
Tip: sign in as the practitioner in one tab and the patient in another. Each tab has its own session and consent changes show up in the other tab straight away.
Five-minute walkthrough
- 1.Sign in as practitioner areyes. Open Find a patient, search Northside for Delgado / Rosa, and click Request authorization.
- 2.Open Patient authorization. Rosa's request shows her demo user ID and password; click Sign in as Rosa Delgado (new tab), approve the request there, and choose whether Dr. Reyes may keep a copy.
- 3.Back in the first tab, Rosa now shows as Authorized. Click Retrieve records.
- 4.Open Session records. Try the example searches, and use Copy to note on a few entries.
- 5.Open Record composition. Pick a template, add your findings, and Save as PDF.
- 6.Sign out. The sign-out page shows what was deleted and what was kept, and confirms nothing was left behind.
The 10 requirements
| # | Requirement | Where | How to try it |
|---|---|---|---|
| 1 | User login (authentication) | Sign in | Passwords are hashed (PBKDF2). A session lasts 30 minutes. Practitioner pages refuse to open without one. |
| 2 | User profile (NPI validation) | My profile | Shows the stored registry check and lets you re-run it. |
| 3 | Practitioner search (NPI x EHR roster) | Practitioner directory | Search by name, NPI or specialty, filter by state, and add the providers from the patient's care history. Each is mapped to the EHRs that list them. |
| 4 | Practitioner EHR mapping (EHR roster, endpoints) | EHR connections | Each connected EHR with its FHIR, authorization and document endpoints, its roster, and whether you can query it. |
| 5 | Patient authorization (FHIR / HL7 APIs) | Access and consent | The patient approves a request, or grants access directly. Approval creates a FHIR Consent resource; without one, the document calls return 403. |
| 6 | Practitioner C-CDA patient query (by PII) | Find a patient | FHIR Patient search by last name plus first name, date of birth or MRN, narrowed by gender. Only works at EHRs where you are on the roster. |
| 7 | POST patient C-CDA records to the practitioner session (templates) | Find a patient - Retrieve records | The C-CDA is fetched, POSTed to the session, checked for the CCD template ids, and parsed section by section using each section's template id. |
| 8 | Practitioner search queries on C-CDA fields | Session records | Pick a section, a field, a condition and a value, e.g. Results / Flag / is exactly / High. |
| 9 | Patient authorization for practitioner records retention | Access and consent | The patient chooses whether the practitioner may keep a copy after their session, and for how long. Revoking deletes any kept copy. |
| 10 | Log out (session termination and data scrub) | Sign out button | Ends the session, deletes every document the patient did not allow to be kept, clears the request log, then checks browser storage for leftovers and reports the result. |