The surface
Standards where they exist, honesty where they do not
Two audiences read this page: an integration engineer at a laboratory who needs to know what our interface expects, and a developer building against the patient API. Both deserve the actual shape of the thing rather than a diagram.
Resources
| Resource | Carries |
|---|---|
| DiagnosticReport | The report as issued, with status and version history |
| Observation | Discrete results, LOINC-coded, with interval and flag |
| Specimen | Collection, source, and accession linkage |
| ServiceRequest | The order, with indication and ordering practitioner |
| ImagingStudy / Media | References to slide images and gross photography |
| Consent | Authorizations and patient-granted scopes, as records rather than as configuration |
| AuditEvent | Access and disclosure history, queryable by the entitled roles |
| Coverage / Claim | Payer linkage and claim state where the tenant is entitled |
Authorization
Tokens carry a tenant, a role, and any active grants. A patient-authorized app receives scopes limited to that patient's own record. There is no token that grants cross-tenant read without an explicit grant behind it, which means a leaked credential has a blast radius rather than a jackpot.
HTTP 403
{
"resourceType": "OperationOutcome",
"issue": [{
"severity": "error",
"code": "forbidden",
"details": { "text": "withheld: part2-consent-required" },
"diagnostics": "Data class part2 requires consent naming this recipient."
}]
}Refusals are specific
A denial names the data class and the condition that would satisfy it. An opaque 403 produces a support ticket and, where the requester was entitled, an information blocking problem. Both are avoidable by saying what is wrong.
Interfaces and bulk
- HL7 v2.5.1 ORU^R01 inbound and outbound, with ORM and OML for orders, over TLS or SFTP.
- Acknowledgements are real. We alert on missing ACKs rather than assuming delivery.
- Bulk FHIR export for panel-level pulls, scoped to a tenant and a group.
- Webhooks for result finalization, corrections, critical values, and release events, delivered with retry and an idempotency key.
Configuration through an agent
There is a published design for a Model Context Protocol server that exposes the configuration plane — code mapping, interface parameters, tenant structure, and release scoping — as tools an agent can call. Patient data is deliberately not part of it, and no tool can widen a permission. It is not built. The design and the constraints are written down before the implementation on purpose.
Access to documentation
The interface specification, the LOINC mapping guide, and the sandbox are provided under agreement rather than published, because the request volume that follows a public sandbox is not something a small team should absorb before it has to.
Getting credentials
Sandbox access needs two things: an executed business associate agreement, and a note about which interfaces you intend to call. The first is self-serve; the second is a sentence in an email.
Which stakeholder is currently asking you for data you cannot easily give them?
That is the useful first conversation, and it is a short one. Bring the laboratories, the practices, and the thing that breaks today.
service@meta.clinic Read the release model first