Integrations overview

Beyond the pharmacy rail, neolife connects three families of third-party system: the chart your clinicians already work in, the lab that runs the panel, and the clinician network that sees the patient you can't. All three sit behind one object — a vendor connection — with one lifecycle, one health model, and one billing posture. Learning that object once is the whole surface.

The rule that shapes every page in this section: you hold the vendor contract and the vendor's API key; neolife relays the transaction. We don't resell a lab panel, we don't mark up a consult, and we don't sit inside your clinical agreement with a physician network. That's BYO, it's the only mode that ships, and it is enforced in code rather than in policy.

The four categories#

Category	What it is	Where it's documented
pharmacy	The compounding pharmacy that fills the prescription	Empower · Routing
emr	The chart: demographics, intake, medications, encounters	EMR & charts
lab	Diagnostics — the panel, the draw, the result	Labs
provider_network	A clinician network that can see a patient you can't cover	Provider networks

Pharmacy connections predate the vendor spine and keep their own surface; they appear here as a read-only projection so ops has one screen instead of four. Anything projected is managed where it was created — writing through a projection would give one logical connection two writers.

The connection lifecycle#

Every category walks the same five steps.

1 — Connect. POST /vendors/connections with a category, an adapter type, and a reference to where your credential lives. The credential itself is never a field on the connection: you pass a credentialsRef and the value stays in the secret manager, so a connection row is never itself a credential at rest.

2 — Probe. Connect immediately runs a health check rather than optimistically reporting success. A connection that can't reach the vendor is born degraded, not connected.

3 — BAA. A connection whose per-vendor BAA isn't on file stays pending even when the probe passes. PHI does not flow to a vendor on the strength of a working API key.

4 — Run. Orders, pulls, results, and consults flow. Every call writes a PHI-free sync log row you can read back.

5 — Revoke. POST /vendors/connections/:id/disconnect sets revoked. Nothing is deleted — the sync log and the identity map survive, because an audit trail that disappears when you disconnect isn't an audit trail.

Rule: a health check can never resurrect a revoked connection. revoked is terminal in the status machine; reconnecting is a new connection, deliberately.

The endpoints#

Method	Route	Permission
GET	/vendors/connections?category=	connections.view
GET	/vendors/connections/:id	connections.view
POST	/vendors/connections	connections.manage
POST	/vendors/connections/:id/health	connections.manage
POST	/vendors/connections/:id/rotate-webhook-secret	connections.manage
POST	/vendors/connections/:id/disconnect	connections.manage
POST	/vendors/connections/:id/billing-mode	billing.manage
GET	/vendors/connections/:id/sync-logs?limit=	connections.view

Note which permission guards the billing-mode route. Changing how a connection is paid for is a finance act, not a connection act — the person who can wire up a lab is deliberately not the person who can change what it costs.

Roles#

Permission	Grants
connections.view	See connections, their status, and their sync logs
connections.manage	Connect, health-check, rotate, disconnect
labs.view	See lab orders and results
labs.order	Place a lab order — licensure-gated
labs.result.review	Release a result to the patient — licensure-gated
consults.view	See consult requests and their outcomes
consults.request	Request a consult from a connected network

labs.order and labs.result.review sit in the clinical permission set alongside order approval and intake review. Ordering a diagnostic and signing off on its result are both clinical acts, so the permission belongs to the licence rather than to the org chart — an admin cannot hold either one.

Feature flags#

Every integration in this section is dark by default and revealed per workspace.

Flag	Scope	Governs
vendor_connections	global	The whole /vendors surface. Off = every route 403s
emr_integrations	tenant	Connecting a chart and pulling from it
emr_order_writeback	tenant	Writing a routed order back into the chart
labs_ordering	tenant	The BYO lab-ordering surface
labs_result_writeback	tenant	Pushing a completed result into the connected chart
provider_network_consults	tenant	Requesting a consult from a connected network
vendor_managed_billing	tenant	Counsel-gated. See billing & compliance

labs_result_writeback is triple-gated — it needs labs_ordering and emr_integrations and itself. It's the one path where lab PHI crosses into a third-party system, so it gets its own switch instead of riding either parent.

Next steps#

• EMR & charts — the five adapters, what each can actually do, and what happens when a chart is read-only.
• Labs — BYO keys, the four ways a sample gets collected, and the clinician gate in front of every result.
• Provider networks — how a consult finds a licensed clinician, and why the prescription it returns is never approved twice.
• Connection health — status semantics, degrade behaviour, and how to triage a connection that stopped working.
• Billing & compliance — why BYO is the only mode, in plain language.