The hospital builds Mrs. H's home packet, encrypts it in this browser, and hands it over as a SMART Health Link: a QR code or a link that carries its own key. Ami, on her daughter's phone, opens it. The server in the middle holds only ciphertext and never sees the key. Ami holds a pseudonymous watch ID and the encrypted packet: no name, no record number, no account. The hospital keeps the mapping from ID to patient inside its own walls.
One honest limit: in this demonstration the "blind server" is this browser's own storage, so the link opens here (or in another tab of this browser) and nowhere else. Scan the QR with a phone and the page will say so. The link format, the encryption and the key handling are the real specification; a hosted blind server is the next build. Synthetic data. Not for clinical use.
The watch assembles the home packet from the whole admission: the reconciled list, what changed, the one thing to watch.
A QR at the bedside. The hospital keeps the mapping from code to patient inside its own HIPAA fence.
Scans the code. Holds only a pseudonymous watch identifier and the encrypted packet.
url (where the encrypted file lives, at least 256 bits of entropy, at most 128 characters), key (32 random bytes, base64url, 43 characters), exp, flag and label (at most 80 characters). It is base64url-encoded and prefixed with shlink:/.L, long-term, so the hospital can update the packet behind the same link, and U, so the url returns the one encrypted file directly by GET with a recipient parameter. The specification does not allow U together with a passcode (P); a passcode-protected bridge uses the manifest request instead, and that is how a production bridge would likely run.alg "dir", enc "A256GCM", cty "application/fhir+json", done with the browser's own Web Crypto. Optional DEFLATE compression is omitted to keep the demonstration readable.#. Browsers do not send what follows # to the server, so the key never reaches a server log.Source: SMART Health Links Protocol, SMART Health IT, docs.smarthealthit.org/smart-health-links/spec. The pseudonymous watch ID, the hospital-side mapping and the question back to the transitional care nurse are AI MedAgent's design on top of the standard.
Daniel Pettus spent forty years in medical device and health IT leadership at Alaris, CareFusion and BD, contributed to IHE Patient Care Device interoperability standards, and is named on two United States patents. He writes Inside the Loop at insidetheloopdp.substack.com and is the author of The Technology Was Never the Problem, at pettusbook.com.
AI MedAgent is a research demonstration of a patent-pending method. Advisory only. Not a medical device. Not for clinical use. Synthetic data only.