Patient Registration

Registration Flow

┌─────────────┐     ┌──────────────┐     ┌─────────────────┐
│  Patient     │────▶│  Find Org    │────▶│  Self-Register  │
│  Opens App   │     │  (Public API)│     │  (email+pass)   │
└─────────────┘     └──────────────┘     └────────┬────────┘
                                                   │
                    ┌──────────────┐     ┌─────────▼────────┐
                    │  Full Access │◀────│  Staff Verifies  │
                    │  (patient)   │     │  (optional)      │
                    └──────────────┘     └──────────────────┘

Steps

Find Organization — Patient searches for a healthcare org via the public API
Self-Register — Patient creates account with email, password, and demographics
Account Created — the membership starts in a self-registered state, pending review
Verification — Staff can optionally verify the patient's identity
Full Access — Patient can book appointments, message care teams, view records

Registration Status Flow

self-registered → patient → verified → (inactive)

Status	Description	Can Login	Can Book
`self-registered`	Just registered	Yes	Limited
`patient`	Active patient	Yes	Yes
`verified`	Identity confirmed	Yes	Yes
`inactive`	Deactivated	No	No

API Endpoints

Public Org Search (No Auth)

GET /fhir-api/Organization/search-public?name=Hospital&specialty=394802001

Register

POST /smart-auth/register-patient

{
  "email": "patient@email.com",
  "password": "secure-password",
  "given_name": "Jan",
  "family_name": "Novak",
  "birth_date": "1985-03-15",
  "gender": "male",
  "phone": "+421901234567",
  "organization_id": "org-uuid"
}

POST /smart-auth/authenticate-patient

Multi-Organization Registration

Patients can register at multiple organizations:

Each registration creates one organization membership
Login returns all affiliated organizations
Patient selects which org to access

Patient registration includes GDPR consent collection:

Treatment consent
Data processing consent
Communication consent

Each consent is stored as a FHIR Consent resource linked to the patient.

What Registration Creates

Record	Purpose
Login account	Credentials and session identity
FHIR `Patient` resource	The clinical record itself
Organization membership	Which organization the patient belongs to, and their approval status

The login account and the FHIR record are separate on purpose: one person can be a patient in several organizations, and each membership is approved — or not — independently.