How it works
A SMART Health Link can carry a whole imaging study. This page opens the site's sample link and follows one slice of a brain MRI through each layer, from the link to the picture. Every excerpt below comes from the live sample, through real requests and decryption in your browser.
Opening the sample link…
1 The SMART Health Link
A SMART Health Link is shlink:/ followed by a small JSON payload, encoded so it fits in a URL or a QR code. The payload says where the shared data is (url) and holds the key that decrypts it (key). Your browser never sends the key to the server.
How exactly
2 The JWE
The url points to one file: a JWE (JSON Web Encryption), encrypted bytes with a short JSON header. Your browser downloads it and decrypts it with the link's key.
How exactly
3 The FHIR Bundle
Inside the JWE is a FHIR Bundle: a list of health records in the FHIR standard. This one holds the Patient, an ImagingStudy for each study, and a DiagnosticReport for each radiology report.
How exactly
4 The ImagingStudy
An ImagingStudy lists a study's series and, in each series, its instances: one per DICOM file, usually one image. Two extensions connect it to the images. linked-file names the encrypted file that holds the study and carries that file's own key. instance-length gives each instance's size in bytes.
How exactly
5 The encrypted file and its records
The encrypted file holds the study's DICOM files end to end, cut into 64 KiB records that are each encrypted on their own. Adding up the instance lengths gives where this slice starts, so your browser asks for just its records with one HTTP Range request (a request for a byte range of a file).
How exactly
6 What the server sees
The server that holds the encrypted file can't decrypt it. These are the requests this page has sent it: random ids and byte ranges. Like any web server, it also sees your network address and the time.
How exactly
7 The AES-256-GCM tag
Each record is encrypted with AES-256-GCM, which adds a 16-byte tag. Decryption checks the tag, so a record changed by even one bit is refused. Try it with the switch.
How exactly
8 The DICOM header and Pixel Data
Decrypted, the bytes are a DICOM file: a header of tagged attributes, then the Pixel Data, the image itself, which may be compressed.
How exactly
9 Range requests on demand
Your browser fetches the records for the images you look at, and nothing else. Move the slider and watch the count.
How exactly
Open it yourself
The full viewer, on the same sample: every study, the reports, and the DICOM files to download.