---
name: iblai-connect-meditech
description: "Read MEDITECH Expanse data through the MEDITECH Interoperability Services: US Core FHIR R4 (tested in Greenfield Workspace) and expose it to an ibl.ai agent as an MCP tool. Use when the user asks an agent to work with MEDITECH Expanse data, or to set up a MEDITECH Expanse MCP connection on ibl.ai."
metadata:
  kind: guide
---

# MEDITECH Expanse connector for AI agents

> A starting point maintained on ibl.ai at https://ibl.ai/developer/connectors/meditech — not part of the iblai/vibe repository. Checked against MEDITECH's documentation on October 20, 2026; test it against your own MEDITECH Expanse setup before you rely on it.

MEDITECH Expanse is an electronic health record used by hospitals and health systems. It holds patient demographics, encounters, problems, allergies, medications, results, immunizations, care plans and clinical documents.

## Auth & conventions

- **API:** MEDITECH Interoperability Services: US Core FHIR R4 (tested in Greenfield Workspace) (FHIR R4). View-only US Core FHIR R4 APIs for USCDI data and patient-access FHIR APIs (DSTU2 and R4). Greenfield Workspace offers a sandbox against a real MEDITECH EHR with interactive docs; FHIR scheduling APIs are listed for Expanse customers.
- **Base URL:** https://{organization-host}/v1/uscore/R4 (per organization; listed in MEDITECH's brands bundle at https://fhir-apis.meditech.com/v1/brands)
- **Access:** Issued by your administrator. Developers, vendors and MEDITECH customers can register for Greenfield Workspace to test. It is not connected to customer environments, so production access is arranged with each MEDITECH customer organization.
- **Auth:** SMART on FHIR (OAuth 2.0 authorization code); OAuth 2.0 client credentials. Data exchange is protected by SMART on FHIR and OAuth 2.0. A live customer server lists authorization_code, client_credentials and refresh_token grants at {host}/oauth/token, with client secret or private_key_jwt client auth.
- Keep MEDITECH Expanse credentials in environment variables or the ibl.ai credential store. Never print a token in chat and never commit one to a file.
- Destructive or outward-facing calls are marked **Confirm with the user first** — do.

## Reads

- **Patients** — Patient read and search (US Core R4).
- **Results and vitals** — Observation and DiagnosticReport read and search.
- **Problems and allergies** — Condition and AllergyIntolerance read and search.
- **Medications and immunizations** — MedicationRequest and Immunization read and search.
- **Clinical documents** — DocumentReference read and search.
- **Encounters and procedures** — Encounter and Procedure read and search.

## Writes

- None. This skill only reads MEDITECH Expanse data.

## Expose it to an ibl.ai agent (MCP)

MEDITECH did not publish an MCP server of its own when this skill was checked. Host a small MCP server that wraps the calls above, then register it below.

First install the ibl.ai platform skills and connect your organization (writes `IBLAI_ORG`, `IBLAI_USERNAME` and `IBLAI_API_KEY` to `.env`):

```bash
npx skills add iblai/vibe --all
# then, in your coding agent:
/iblai-api-login
```

Every call below sends `Authorization: Api-Token $IBLAI_API_KEY`.

1. **Register the server** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-servers/` with `name`, `url`, `transport` (`sse` | `websocket` | `streamable_http`) and `auth_type` (`none` | `token` | `oauth2`). Capture the returned `id`.
   - MEDITECH Expanse supports per-user OAuth: `auth_type=oauth2` with `auth_scope=user` and a linked `oauth_service` makes each person connect their own account in the chat. It needs an `auth_{provider}` credential in the organization's credential store first.
2. **Create the connection** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-server-connections/` with `server`, `scope` (`platform` | `mentor` | `user`), `auth_type`, and either `credentials` + `authorization_scheme` or a `connected_service` id for OAuth. Credentials are masked on read; never send a masked value back.
3. **Enable it on the agent** — `GET https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mentors/{agent_id}/settings/`, add `mcp-tool` to `tool_slugs` and the server id to `mcp_servers`, then `PATCH` the full lists back. They are replaced, not merged.

Full reference: https://ibl.ai/developer/platform/mcp/mcp-connections and the `/iblai-api-agent-mcp` skill.

## Example prompts

- "Pull the active medication list for this patient from MEDITECH."
- "Show this patient's immunization history."
- "List lab results from the last 30 days and highlight abnormal values."
- "Summarize the problems and allergies on file before tomorrow's visit."

## Guardrails

- Records are HIPAA protected health information (PHI). The US Core API is view-only; apps reach a hospital's data only through that MEDITECH customer's endpoint and approval.
- Request the narrowest MEDITECH Expanse scopes or role the task needs, and prefer a read-only credential for agents that only answer questions.
- Return the fields the user asked for, not whole records; do not paste personal data into chat that the user did not request.
- Before any write, show the user exactly what will change and wait for a yes.
- Page through large result sets and back off on rate-limit responses instead of retrying in a loop.

## References

- MEDITECH Greenfield Workspace: https://ehr.meditech.com/ehr-solutions/greenfield-workspace
- Greenfield Workspace resources: https://ehr.meditech.com/ehr-solutions/greenfield-workspace-resources
- Patient Access APIs FAQ: https://home.meditech.com/en/d/restapiresources/pages/patientaccessapisfaqs.htm
- This connector on ibl.ai: https://ibl.ai/developer/connectors/meditech
- ibl.ai MCP server connections: https://ibl.ai/developer/platform/mcp/mcp-connections