Bridge Athenahealth

BridgeDemo

SAML-based bridge that embeds the HDS doctor dashboard inside athenahealth’s EHR as a “Launch Outbound” embedded app. Doctors authenticate via SAML SSO — no separate HDS login required after onboarding.

Flow

1. Doctor opens the embedded app from athenahealth EHR
2. athenahealth sends a signed SAML assertion to the bridge ACS endpoint
3. Bridge resolves the doctor identity (practice ID + subject)
4. First time: onboarding UI — doctor creates or links an HDS account
5. Returning: bridge validates stored token and routes to doctor-dashboard

Smart Routing

After authentication, the bridge redirects to doctor-dashboard embedded mode based on context:

• No patient ID → /embed — data sets overview
• Known patient → /embed/patient/{username} — patient timeline
• Unknown patient → /embed/invite?athenaPatientId={id} — invite flow with QR code, email, and copy link

Patient Mapping

• athenahealth patient IDs are per-practice (not globally unique)
• Mapping key: {practiceId}:{doctorSubject}:{athenaPatientId} → HDS username
• One athena patient ID maps to exactly one HDS account per doctor (enforced, 409 on conflict)
• Mappings stored as events in the bridge’s Pryv account

Architecture

• bridge-athenahealth — SAML handling, doctor onboarding, patient mapping, routing
• doctor-dashboard (embedded mode) — all patient UI: invite, timeline, data sets
• Session sharing via localStorage — “Open full dashboard” works in a new tab

Tech Stack

• Node.js + Express, SAML via samlify
• Frontend: React + Vite (onboarding UI only, served at /app/)
• Deployed on Dokku (dev: demo-bridge-athena.datasafe.dev)

Testing

A mock athenahealth SAML IdP is deployed at demo-athena-test-idp.datasafe.dev for testing the full flow without a real athenahealth environment. Fill in doctor/patient fields and click “Launch Embedded App”.