Realistic EHR portal simulations for testing SMART on FHIR apps: a hospital portal and an insurer portal, each with patient login, clinical data, and an OAuth consent screen.
Patient-access integrations do not fail at the FHIR layer. They fail at the portal — the login page that redirects oddly, the consent screen that drops a scope, the session that expires mid-flow. If your test environment starts at the token endpoint, you never rehearse the half of the flow your users actually see. These portals put the whole path under test.
The hospital portal is shaped like a provider patient portal: chart summary, visits, results, medications. The insurer portal is shaped like a payer member portal: coverage, claims, explanation of benefits. Both support a patient picker for test convenience and both hand a real SMART launch to your registered app.
Register an app under Sandbox → Apps, set its launch and redirect URIs, then start an EHR launch from the portal. Your app receives iss and launch exactly as it would from a production EHR. Deep links to a specific patient and URL parameters for portal branding are supported for demo recording.
Note on the trust model: the patient picker is synthetic-data behavior. It is impersonation, not authentication, and it exists because there are no real people behind these records. Do not copy the pattern for production PHI. See the SMART on FHIR guide for the authorization details and security and trust for how the sandbox is isolated.