Try it free in the sandbox · first FHIR call in 5 minutesFree · 30 synthetic patients · no card

Clinic access requests with patient approval (CIBA)

The OpenID CIBA flow behind clinic access requests: reception enters the patient's email, the patient approves in the app or by email for 30, 90 or 365 days, and the clinic's application receives tokens.

A clinic reaches a patient's record on Anpheros only when the patient approves it. The clinic's application sends a request naming the patient's email address and the access it needs. The patient receives it in the Anpheros app and by email, sees who is asking and for what, chooses how long to allow it, and approves or refuses. If they approve, the clinic's application receives tokens and can read the record until the access expires or the patient withdraws it.

The flow is the standard OpenID Connect Client-Initiated Backchannel Authentication (CIBA) flow, in poll mode. It exists so that a receptionist does not need to hand the patient a phone or a link: the request goes to the patient, not through the clinic's screen.

Step by step

Reception enters the patient's email. The clinic's application calls POST /oauth/bc-authorize with its client credentials, the patient's email as login_hint, the scope it needs and a short binding_message the patient will see.
The platform answers the same way for every address. The response contains an auth_req_id, an expiry and a polling interval, whether or not that email has an Anpheros account. It does not reveal who has a record. A request for a person with no account simply expires.
The patient decides. They get a notification in the Anpheros app and an email. The request shows the organisation, the scope and the message. They choose a period of 30, 90 or 365 days and press allow or refuse. The link in the email does not approve anything when it is opened, because mail scanners open links; the patient has to press the button.
The clinic polls. The application calls POST /oauth/token with the grant type urn:openid:params:grant-type:ciba and the auth_req_id. While the patient has not decided, the answer is authorization_pending. After approval the tokens are returned once. A refusal returns access_denied and an unanswered request returns expired_token.
The clinic reads, and writes, within the granted scope. Every read is logged and visible to the patient. A clinic can change or delete only what it wrote itself.

What protects the patient

Verified email only. A request matches only an account whose email is verified, so nobody can receive another person's requests by creating an account with their address.
Scoped and time-limited. Access is per resource type and action, for a stated period. A request that nobody answers expires within a day by default and in at most seven days.
Revocable at any time. Revocation takes effect on the next request. The clinic cannot refresh its way back in.
Visible. The patient sees every connection and every access in the app. See consent and access model.

What a clinic needs to build

A confidential OAuth client registered with the platform, with its secret kept on the server.
A polling loop that respects the interval and handles the four outcomes.
A way to show the patient's decision to reception ("waiting for the patient", "approved until …", "refused").
Handling of the returned tokens as short-lived credentials: access tokens last 30 minutes and refresh tokens rotate on every use. See authentication and OAuth.

For a clinic that prefers to open a consent page in front of the patient, for example at the desk, the standard authorisation-code flow with PKCE and SMART on FHIR standalone launch is also supported.

Frequently asked questions

Does the patient have to be in the clinic?

No. They can approve from their own phone or from the email link, wherever they are. So a request can be sent before the appointment, and a patient who is abroad can still approve it.

What if the patient has no Anpheros account?

The request is accepted and then expires without a decision, and the clinic cannot tell whether an account exists. The patient can create an account and the clinic can send a new request.

How long does the access last?

The patient chooses 30, 90 or 365 days when they approve. They can withdraw it earlier.

Can the clinic see everything in the record?

Only the scope the patient approved. Scopes are set per resource type and action, and can be filtered by category.

Is the request flow a standard?

Yes. It is OpenID Connect CIBA, so existing OAuth libraries can be used. See the healthcare API with patient consent guide for the wider model.

Is this live?

Yes, on the platform in private beta. Production access needs a verified organisation and a signed data processing agreement.