Epic EHR Integration via SMART on FHIR R4

Architecture Overview

sycana AI connects to Epic EHR instances using standard HL7 FHIR Release 4 (R4) and the SMART on FHIR specification. Connections utilize the OAuth 2.0 Backend Services authentication profile, using asymmetric public/private key pairs (RS384) to generate signed JSON Web Tokens (JWTs) without requiring interactive human credentials.

Key FHIR Resources

FHIR Resource	Interaction	Clinical Purpose
`ServiceRequest`	Read (Search)	Ingests inbound electronic referral orders, order codes, priority flags, and referring clinician NPIs.
`Patient`	Read (Search/Match)	Resolves Master Patient Index (MPI) records by MRN, demographics, and contact info to prevent duplicates.
`DocumentReference`	Read / Create	Reads attached clinical notes, operative reports, and labs; files structured AI triage summaries back to the patient chart.
`Appointment`	Create / Update	Writes confirmed booking slots directly into the provider's Cadence schedule block.
`Coverage`	Read	Retrieves primary and secondary payer policy IDs, group numbers, and plan eligibility context.

Required OAuth 2.0 Scopes

In accordance with the principle of least privilege, sycana AI requests only system-level scopes necessary for referral intake and scheduling coordination:

system/ServiceRequest.read: Read referral orders placed in Epic.
system/Patient.read: Resolve patient demographics and verify chart identity.
system/DocumentReference.read: Read attached notes and imaging summaries.
system/DocumentReference.write: Attach structured referral packets to the chart.
system/Appointment.write: Book confirmed appointment slots into Cadence.
system/Coverage.read: Verify active health plan identification.

Deployment & Onboarding Workflow

Epic App Orchard / Vendor Registration: sycana AI client credentials and public JWKS endpoints are registered in your Epic instance.
Interconnect & FHIR Endpoint Configuration: IT security verifies network connectivity and whitelists Sycana's dedicated IP ranges.
Department & Cadence Provider Mapping: Provider NPIs, specialty service lines, and scheduling visit types are mapped to Sycana provider profiles.
Parallel Verification: Referrals are ingested in shadow mode to verify field mapping accuracy before enabling production writeback.

Security & Data Boundaries

sycana AI never stores unencrypted Epic client secrets or clinical databases on local storage. All data in transit is encrypted using TLS 1.3, and data at rest is protected with AES-256. Every FHIR API request and response is recorded in an immutable, tamper-evident hash-chained audit log with a 7-year retention period.