---
title: Application Access – Patient Selection
description: "# §170.315(g)(7) Application Access - Patient Selection Product Name: Legend EHR, LLC Version: 5.3 Certification Criterion:170.315(g)(7) Application access – patient selection Conformance Method:The health IT conforms with the §170.315(g)(7) Application access – patient selection requirements. ## **Overview** This document describes…"
url: "https://legendehr.com/docs/application-access-patient-selection/"
updated: "2025-10-15"
category: LegendEHR
---

# Application Access – Patient Selection

# §170.315(g)(7) Application Access - Patient Selection

Product Name: Legend EHR, LLC

Version: 5.3

Certification Criterion:170.315(g)(7) Application access – patient selection

Conformance Method:The health IT conforms with the §170.315(g)(7) Application access – patient selection requirements.

## **Overview**

This document describes how the LegendEHR FHIR-based API supports the requirements of §170.315(g)(7) — *Application Access: Patient Selection* — under the ONC Health IT Certification Program.

LegendEHR provides patient selection functionality via FHIR R4 APIs hosted on AWS HealthLake. These APIs enable third-party applications to query and retrieve patient data in compliance with USCDI v3 and SMART on FHIR authorization.

## **2. Base FHIR Endpoint**

### **Base URL (example):**

https://healthlake.us-east-1.amazonaws.com/datastore/1234/r4

## **3. Patient Resource Access**

Applications can retrieve or search for patients using standard FHIR RESTful operations:

**Example: Retrieve a specific patient**

GET [base]/Patient/{id}

**Example: Search for a patient by name or identifier**

GET [base]/Patient?name=Robert

GET [base]/Patient?identifier=12345

Each request returns a FHIR Patient resource conformant with **US Core Patient Profile (US Core v6.1.0 / FHIR R4)**.

## **4. Authentication & Authorization**

LegendEHR uses **SMART on FHIR (OAuth 2.0)** for authentication and authorization, integrating with **AWS Cognito** as the Authorization Server.
 The following endpoints are used:

- **Authorization Endpoint:**
   https://healthlakeoauth.auth.us-east-1.amazoncognito.com/oauth2/authorize
- **Token Endpoint:**
   https://healthlakeoauth.auth.us-east-1.amazoncognito.com/oauth2/token

Applications must obtain valid access tokens before making FHIR API calls.

## **5. Supported FHIR Operations**

| **Resource** | **Interaction** | **Description** |
| --- | --- | --- |
| Patient | read | Retrieve patient details |
| Patient | search | Search for patients by demographic parameters |
| Patient | history | Retrieve version history for a patient record |

## **6. Example Response**

{

"resourceType": "Patient",

"id": "fd05852e1f0c147dcf212e91372aee1d",

"name": [

{

"given": ["Robert"],

"family": "Smith"

}

],

"gender": "male",

"birthDate": "1946-11-04"

}

## **7. Compliance Statement**

LegendEHR attests that its FHIR API conforms with §170.315(g)(7) by enabling authenticated third-party applications to:

- Select and retrieve a single patient record,
- Query using patient identifiers or demographics,
- Access only authorized patient data through SMART on FHIR.

## **8. Versioning and Contact**

**Product:** Legend EHR, LLC v5.3
 **FHIR Version:** R4
 **US Core Implementation:** v6.1.0 (aligned with USCDI v3)
 **Contact:** support@legendehr.com