SMART Health Cards and Links FHIR IG, published by HL7 International / FHIR Infrastructure. This guide is not an authorized publication; it is the continuous build for version 1.0.0-ballot built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/smart-health-cards-and-links/ and changes regularly. See the Directory of published versions

Home Page

Official URL: http://hl7.org/fhir/uv/smart-health-cards-and-links/ImplementationGuide/hl7.fhir.uv.smart-health-cards-and-links				Version: 1.0.0-ballot
Draft as of 2024-08-05				Computable Name: SMARTHealthCardsandLinks

Overview

Paper medical records–such as vaccination histories and insurance cards–are easily lost or damaged, are difficult to authenticate, and are often not on-hand when they’re needed.

SMART Health Cards and Links are FHIR-based standards that address these challenges, enabling individuals to receive their health information and share it with others in a tamper-proof and verifiable digital form.They provide a digital version of an individual’s clinical information that can be kept at the ready and easily shared with others when the need arises–using a QR code, mobile app or web browser.

Together SMART Health Cards and Links provide options that support multiple goals–from keeping a small amount of verifiable medical information close by to authorizing a trusted party to access their entire medical record. They empower individuals with secure, equitable, and privacy-preserving access to their clinical information.

Examples of what an individual can do using these standards include:

• receive proof of critical immunizations on a physical card or in a mobile app and allow others to verify them by scanning the attached QR code
• scan their insurance card’s QR code when checking in at their doctor’s office–transmitting their member ID and other coverage information directly to the clinic’s system
• send an elementary school a link to their child’s immunization history, allowing the school to verify the information with the immunization registry and copy in the details if it wishes
• receive a “ticket” to access the results of a lab test when they’re ready
• give a provider time-limited or ongoing access to some or all of their medical data, including the ability to search.

IG Organization

The implementation guide is organized into two sections:

• SMART Health Cards describes the protocol that allows an individual to keep a copy of their important health records with them in the form of a secure QR code that may be saved digitally or printed on paper. SMART Health Cards build on international open standards and decentralized infrastructure to provide end-user privacy and the ability to work across organizational and jurisdictional boundaries. This section includes:
  • Cards User Stories
  • the formal SMART Health Cards specification
  • the Issue Verifiable Credential operation for requesting and generating SMART Health Cards
  • SMART Health Card examples
  • a description of Cards credential modeling
  • a Cards FAQ and changelog

• SMART Health Links describes the protocol that enables storage and sharing of more information than can be kept on a single SMART Health Card (using cloud storage) and provides additional sharing options including limited-time access, long-term sharing of data that can evolve over time, and protecting access with a PIN that can be communicated to the recipient out-of-band. This section contains:
  • Links User Stories
  • the formal SMART Health Links specification
  • SMART Health Link examples

Referenced Specifications

This implementation guide relies on the following external specifications:

• IETF (Internet Engineering Task Force) RFC 7515 - JSON Web Signature (JWS)
• IETF RFC 7517 - JSON Web Key (JWK)
• IETF RFC 7518 - JSON Web Algorithms (JWA)
• IETF RFC 7519 - JSON Web Token (JWT)
• IETF RFC 7638 - JSON Web Key (JWK) Thumbprint
• IETF Network Working Group RFC 1951 - DEFLATE Compressed Data Format Specification version 1.3
• IETF Network Working Group RFC 4648 - Base64 Data Encodings
• IETF Network Working Group RFC 4868 - Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with IPsec
• IETF Network Working Group RFC 5280 - X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL)
• IETF BCP 195 - Transport Layer Security (TLS)
• Cross-Origin Resource Sharing (CORS)

Contributing

The Verifiable Clinical Information (VCI) coalition convened the original consensus group that started the work that led to this implementation guide. The Argonaut Project and CARIN Alliance were also key contributors.

Sponsoring HL7 Workgroup

FHIR Infrastructure

Authors

Editor: Josh Mandel	jmandel@gmail.com
Assisting author: Frank McKinney	fm@frankmckinney.com
Publishing lead: Mark Roberts	mark.roberts@leavittpartners.com

Dependencies

Package hl7.fhir.uv.extensions.r4#5.1.0 This IG defines the global extensions - the ones defined for everyone. These extensions are always in scope wherever FHIR is being used (built Sat, Apr 27, 2024 18:39+1000+10:00)

Cross Version Analysis

This is an R4 IG. None of the features it uses are changed in R4B, so it can be used as is with R4B systems. Packages for both R4 (hl7.fhir.uv.smart-health-cards-and-links.r4) and R4B (hl7.fhir.uv.smart-health-cards-and-links.r4b) are available.

Global Profiles

There are no Global profiles defined

IP Statements

No use of external IP