How do you pronounce FHIR?

It is pronounced like the word fire. It stands for Fast Healthcare Interoperability Resources.

Does SMART on FHIR share my password with the app?

No. You sign in on the hospital’s own page, and the app receives a limited permission to read your records, not your password.

Do I need a patient portal account to use it?

Yes, in most cases. You sign in with your patient portal username and password, so set up the portal first.

Can I take back an app’s access?

Usually yes. Most apps let you disconnect a hospital, and many hospital portals let you remove apps from your account settings.

What SMART on FHIR means for patients, in plain words

November 6, 2026 · 5 min read · Vita Health Coach

The short answer

SMART on FHIR is a pair of open standards that let you connect an app of your choice to your hospital records. FHIR is a common format for health data, and SMART is a safe way for you to sign in at the hospital and give an app permission to read your records without sharing your password. Federal rules require certified US hospital record systems to offer it.

FHIR: a common language for health records

FHIR stands for Fast Healthcare Interoperability Resources. It is said like the word fire. It was created by HL7, a nonprofit group that writes standards for health data. Interoperability simply means different computer systems can share information and understand it.

Before standards like FHIR, every hospital system stored data in its own way. Moving a lab result from one place to another often meant printing it or faxing it. FHIR breaks health information into small, standard pieces called resources. A lab result is one kind of resource. A medicine, an allergy and an immunization are others.

Because the pieces follow the same pattern everywhere, an app that understands FHIR can read a lab result from many different hospitals in the same way.

FHIR is an open standard, which means anyone can read it and build with it. That is one reason so many hospitals and apps can use it.

SMART: a safe way to let an app in

SMART started as a research project at Boston Children’s Hospital and Harvard Medical School. The letters stand for Substitutable Medical Applications, Reusable Technologies. The SMART App Launch standard describes how an app asks for permission and how you give it.

It works much like signing in to a website with an account you already have. When you connect, the app sends you to the hospital’s own sign-in page. You type your patient portal username and password there, not in the app. The hospital then shows what the app wants to read, and you approve it.

The app receives a digital permission, often called a token, instead of your password. That permission can be limited in time and in what it covers, and you can usually take it back.

Why US hospitals offer it

The 21st Century Cures Act, passed in 2016, led to federal rules on patient access. Under the federal health IT certification program, certified electronic health record systems must offer a standard connection for patient apps, built on FHIR and SMART. That requirement took effect at the end of 2022.

Separate rules from the Centers for Medicare and Medicaid Services require many health plans, such as Medicare Advantage and Medicaid plans, to offer similar patient access through apps. Information blocking rules add that providers should not get in the way of a patient’s access without a valid reason.

The result is that most US hospitals and large clinics now have this standard door. Patients can choose which app to use, rather than being limited to the hospital’s own portal.

What it looks like when you connect

You do not need to know any of the technical details to use it. From the patient side, connecting a hospital usually takes a few minutes.

Some hospitals ask you to choose which kinds of records to share, or how long the permission should last. Read each choice. A longer permission lets new results keep coming in; a shorter one means you will need to sign in again later.

In the app, you choose to add a hospital or clinic and search for it.
The app opens the hospital’s own sign-in page.
You log in with your patient portal account.
The hospital shows a screen listing what the app may read. You approve it.
You return to the app, and your records begin to load.

What it can and cannot do

SMART on FHIR covers a defined set of data called the United States Core Data for Interoperability, or USCDI. It includes lab results, medicines, allergies, health conditions, immunizations, vital signs and many clinical notes. The list grows over time.

It does not usually include scan images, and some hospitals hold back certain sensitive notes. Each hospital or health system is a separate connection, so if a parent sees doctors at three systems, you connect three times. You also need a working patient portal login first, because that is what you sign in with.

Sometimes a connection fails or is slow to load. That is usually a setup issue at the hospital or the app, and the portal help desk can often help.

Data also flows one way. Connecting an app lets it read your records; it does not let the app change what is in the hospital’s record. If something in the record is wrong, ask the hospital to correct it.

Is it safe?

The standard itself is designed for safety. You never hand your password to the app, and the hospital controls the sign-in. You approve what is shared.

What happens after the data reaches the app depends on the app. HIPAA covers hospitals and health plans, but usually not an app that you pick yourself. Before connecting, read the app’s privacy policy. Check whether it shows ads, sells or shares data, and how it protects data on your phone. You can usually disconnect an app later from its settings or from the hospital’s portal.

If you connect a parent’s records, use your own proxy login rather than your parent’s password. That way the hospital knows who connected the app, and your parent can see and remove your access.

How Vita Health Coach helps

Vita Health Coach, an iPhone and iPad app from VitaMedas, Inc., uses SMART on FHIR to connect US hospitals and clinics; about 96,000 are in its hospital list. You sign in on the hospital’s own page, and Vita never sees the portal password. Results, medicines, allergies, conditions, immunizations and visit summaries come into each person’s own file, and hospital records are sealed on the phone with a key only that phone holds. There are no ads, and health data is never sold.

Questions people ask

How do you pronounce FHIR?: It is pronounced like the word fire. It stands for Fast Healthcare Interoperability Resources.
Does SMART on FHIR share my password with the app?: No. You sign in on the hospital’s own page, and the app receives a limited permission to read your records, not your password.
Do I need a patient portal account to use it?: Yes, in most cases. You sign in with your patient portal username and password, so set up the portal first.
Can I take back an app’s access?: Usually yes. Most apps let you disconnect a hospital, and many hospital portals let you remove apps from your account settings.

Sources

Vita Health Coach is an iPhone app that keeps a parent’s hospital results in their own file and explains each new one in plain words. Free to try; paid plans in the App Store.

Vita Health Coach on the App Store

General health information, not medical advice. Vita Health Coach explains; it never diagnoses. In an emergency, call 911 or your local emergency number. Read the medical disclaimer.