Enterprise integration reference

Document scope

Research execution on approved cohorts

FHIR sync to screening

Backend Services token exchange

POST /oauth2/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer
&client_assertion=<signed JWT>

// Header
{ "alg": "RS384", "kid": "epic-prod-2026-04", "typ": "JWT" }

// Payload (claims abbreviated)
{
  "iss": "<Epic Backend Services client ID>",
  "sub": "<Epic Backend Services client ID>",
  "aud": "https://fhir.epic.com/interconnect-fhir-oauth/oauth2/token",
  "jti": "d7f3a1b2-4c8e-4f91-9a2d-1e6b0c8d4f2a",
  "iat": 1748736000,
  "exp": 1748736300
}

Integration architecture summary

Environment separation, JWKS hosting, and rotation

{
  "keys": [{
    "kty": "RSA",
    "use": "sig",
    "alg": "RS384",
    "kid": "epic-prod-2026-04",
    "n": "1tCLz4Y...TRUNCATED...lpUmU3w",
    "e": "AQAB"
  }]
}

{
  "keys": [
    { "kid": "epic-prod-2026-04", "alg": "RS384", "..." },
    { "kid": "epic-prod-2026-10", "alg": "RS384", "..." }
  ]
}

Initial requested scopes

• system/Patient.readPatient resource for cohort binding and demographics used in deterministic rules
• system/Group.readResolve Epic cohort membership for approved trial evidence lists
• system/Observation.readLaboratory observations per Epic-tuned searches, not a full-chart extract
• system/Condition.readActive and problem-list context for inclusion or exclusion criteria
• system/MedicationRequest.readOutpatient medication orders for protocol-relevant criteria
• system/Procedure.readHistorical procedures referenced by criteria
• system/AllergyIntolerance.readAllergies via patient-scoped search only
• system/DocumentReference.readSearch, normalized to metadata only. No narrative content, no Binary follow-up.

FHIR resource handling and minimization

Clinical data boundary

• Evidence cohorts (Epic cohorts) are defined by approved protocol logic or institutional configuration.
• PHI is processed inside the institution-approved deployment boundary, with tenant isolation per the deploy contract.
• PHI never reaches an LLM. Criterion PASS / REVIEW / FAIL comes only from the deterministic engine on ingested FHIR. No patient identifiers or cohort-linked fields are serialized into any optional external request path.
• Helm deployments ship deny-by-default API egress NetworkPolicy with explicit CIDR allowlists for Epic FHIR, OIDC, in-cluster Postgres/Redis, and DNS.
• Screening outputs are criterion-level PASS, REVIEW, or FAIL with evidence references, never an ungrounded generative verdict.
• Sponsor and CRO visibility stays permissioned and de-identified by default. See Damaros Runtime for the full visibility model.

Audit, determinism, and replay

• Decisions are reproducible for a fixed protocol version, cohort snapshot, evidence snapshot, and evaluation_as_of.
• Every patient outcome is recorded at criterion level with PASS, FAIL, or REVIEW and a rationale.
• Protocol amendments link to versioned protocol IDs and engine versions.
• FHIR sync provenance (resource IDs, retrieval timestamps, cohort membership) attaches to the replay bundle.
• Replay classifies agreement or divergence between runs. No opaque "model decided" eligibility.
• Re-execution on the same snapshot produces identical criterion outcomes.

Security, privacy, and logging

• Signing keys and Epic access tokens are server-side secrets; FHIR traffic uses TLS.
• JWKS endpoints serve public key material only. Private PEM never appears in logs, JWKS JSON, or marketing bundles.
• Structured logs favor stable identifiers: request id, org id, trial id, non-PHI codes.
• Field-level exclusion lists omit free-text clinical narrative from default log templates.
• Access is role-based with organization and trial scope. Sessions are time-bound and attributable.
• Data at rest encryption and retention follow the deployment architecture and the customer BAA / DPA.

Epic app registration posture

Validation to production cutover

• Sandbox token exchange and FHIR read smoke tests against approved test cohort.
• Scope and search coverage review against locked protocol evidence requirements.
• Replay bundle completeness check on sample patients including REVIEW and FAIL paths.
• JWKS rotation drill in sandbox before production key lifecycle events.

Related documents

• Damaros Runtime
• Platform privacy and data handling
• Public website privacy notice (covers public JWKS hosting)
• Customer BAA / DPA and deployment security addendum (provided under contract)