--- { "title": "Aidbox, Formbox & Payerbox 2607: SMART Health Cards, Binary Storage, and UM Integration", "description": "Release 2607 adds SMART Health Cards, validation for data already stored in Aidbox, native Binary REST handling, external base64Binary storage, and PAS routing into external utilization management systems.", "date": "2026-08-07", "author": "Valeria Fursa", "reading-time": "6 min read", "tags": ["Aidbox", "Integrations", "Forms"], "utm-campaign": "release", "utm-content": "2607-release" } --- > For the complete documentation index, see [llms.txt](https://www.health-samurai.io/llms.txt). > Use it to discover all available pages before guessing URLs. --- Release 2607 brings several changes to how FHIR data is issued, validated, stored, and exchanged. Aidbox adds SMART Health Cards, validation for resources already stored in the database, native REST handling for Binary resources, and external storage for large `base64Binary` payloads. On the payer side, PAS requests can be routed into external utilization management systems, including HealthEdge GuidingCare. Formbox gets improvements to form completion, validation, and extraction workflows. ## SMART Health Cards Aidbox 2607 introduces [SMART Health Cards](https://www.health-samurai.io/docs/aidbox/api/rest-api/other/smart-health-cards). The `$health-cards-issue` operation creates a verifiable health credential from FHIR data and signs it as a compact JWS. Patients can present the resulting credential as a QR code or file. Aidbox publishes the verification public key through a JWKS endpoint, so compatible SMART Health Cards verifiers can validate the credential independently. ## Validate Data Already in Aidbox FHIR validation often happens when data enters the system. That does not cover records imported without validation or data that needs to be checked again after profiles change. The reworked [`$batch-validate`](https://www.health-samurai.io/docs/aidbox/modules/profiling-and-validation/batch-resource-validation) operation runs validation against resources already stored in Aidbox. It supports synchronous and asynchronous execution and stores results indexed by validation issue, with drill-down to the affected resources. This is particularly useful after bulk imports or profile changes, when teams need to understand the quality of data already in production rather than wait for validation errors to surface during the next write. ## Better Handling of Binary Data Two changes in 2607 address files and other binary payloads stored in FHIR. The [`/fhir/Binary`](https://www.health-samurai.io/docs/aidbox/api/rest-api/other/binary) endpoints now follow FHIR REST content-negotiation rules. Clients can send raw content to `POST` or `PUT` using its actual `Content-Type`, rather than wrapping the payload in FHIR JSON first. On read, Aidbox can return either the decoded binary content or the FHIR Binary resource, depending on the requested `Accept` type. Large `base64Binary` values no longer need to live inside PostgreSQL either. With [`dataOffloadToExternalStorage`](https://www.health-samurai.io/docs/aidbox/configuration/storage-and-api-configuration/offload-base64binary-to-external-storage), fields such as `Binary.data`, `DocumentReference.content.attachment.data`, and `Patient.photo.data` can be stored in external blob storage. Aidbox keeps the blob location and hash with the resource and restores the content when the resource is read through the API. Clients still receive the normal FHIR representation. The setting is configured per API through `$create-api` or `$configure-api`. Azure Blob Storage is currently supported. For systems storing images, documents, and other large payloads in FHIR, this keeps those bytes out of PostgreSQL tables, history, backups, and replication without forcing applications to use a separate file-access API. ## Bundle and Bulk Import Performance [FHIR Bundle](https://www.health-samurai.io/docs/aidbox/api/rest-api/bundle) processing and [`aidbox.bulk/load-from-bucket`](https://www.health-samurai.io/docs/aidbox/api/bulk-api/bulk-import-from-an-s3-bucket) both receive performance improvements in 2607. Bundle validation has also been fixed, along with [patient filtering in consent-aware bulk export](https://www.health-samurai.io/docs/aidbox/api/bulk-api/export#consent-based-patient-filtering). Other Aidbox improvements include better [AccessPolicy debugging](https://www.health-samurai.io/docs/aidbox/tutorials/security-access-control-tutorials/debug-access-control), expanded [`X-Original-Uri`](https://www.health-samurai.io/docs/aidbox/api/rest-api/fhir-search) support, correct handling of `backport-filter-criteria` in [FHIR topic-based subscriptions](https://www.health-samurai.io/docs/aidbox/modules/topic-based-subscriptions/fhir-topic-based-subscriptions), and fixes in Multibox, Resource Browser, and the [Metrics server](https://www.health-samurai.io/docs/aidbox/modules/observability/metrics/monitoring/use-aidbox-metrics-server). [`AidboxMigration`](https://www.health-samurai.io/docs/aidbox/configuration/migrations) also gets an `execution-type` parameter for SQL that must run outside a transaction, including PostgreSQL statements such as `CREATE INDEX CONCURRENTLY`. ## PAS to External Utilization Management Payerbox 2607 adds a configurable path between [Da Vinci PAS](https://www.health-samurai.io/docs/payerbox/prior-auth/pas) and a payer's [utilization management system](https://www.health-samurai.io/docs/payerbox/prior-auth/um-integration). Requests can be routed according to `Claim.insurer`. The `pas-passthrough` connector forwards PAS requests to an external implementation of `Claim/$submit` and `Claim/$inquire`, while preserving identifiers and avoiding duplicate submissions during retries. A [separate connector](https://www.health-samurai.io/docs/payerbox/prior-auth/um-integration#choosing-a-connector) integrates with HealthEdge GuidingCare through its REST API. Payer-configured FHIR `ConceptMap` resources handle value translation between PAS and GuidingCare. Both routes are configured through [`UMTenantConfig`](https://www.health-samurai.io/docs/payerbox/api-reference/configuration-resources/um-tenant-config). Payers do not have to replace their existing UM workflow to expose a Da Vinci PAS interface. Payerbox can handle the FHIR-facing exchange while decisioning stays in the system already used by the organization. ## Validation at the PAS and CRD Boundary Not every integration mismatch needs to reject an otherwise usable request. For PAS, configurable [lenient validation](https://www.health-samurai.io/docs/payerbox/prior-auth/pas#validation-strictness) can treat display-name differences and referenced-resource profile mismatches as warnings. Structural errors, profile violations, and missing references remain blocking. [CRD](https://www.health-samurai.io/docs/payerbox/prior-auth/crd#validation-strictness) gets similar flexibility for hook-context references that exist in the EHR but are not available inside Payerbox. Strict validation remains available where the complete referenced context is expected. ## Payer-to-Payer and Provider Access [`$davinci-data-export`](https://www.health-samurai.io/docs/payerbox/api-reference/operations/davinci-data-export) now removes remittance and enrollee cost-sharing information from exported `ExplanationOfBenefit` and `Coverage` resources. That includes totals, payments, benefit balances, prices, adjudication amounts, `costToBeneficiary`, subrogation, and other monetary elements. Clinical and administrative content, extensions, and contained resources remain in the export. ## PAS Analytics with SQL on FHIR The `io.healthsamurai.pas-metrics` package, version 0.1.2, is available on request. It contains 10 [`ViewDefinition`](https://www.health-samurai.io/docs/payerbox/analytics/sql-on-fhir) resources and 15 `Library` resources implementing metrics suggested by the PAS Implementation Guide. That gives teams a starting point for tracking PAS workflow performance without first building a separate reporting model and ETL pipeline around the operational data. Results land in the same [flat views](https://www.health-samurai.io/docs/payerbox/analytics/flat-views) that back the rest of Payerbox analytics. See the [Payerbox analytics documentation](https://www.health-samurai.io/docs/payerbox/analytics) or contact Health Samurai to request the package. ## FHIR App Portal The [app-detail page](https://www.health-samurai.io/docs/payerbox/fhir-app-portal/admin-portal) now includes privacy-policy and terms-of-service links. Missing values are shown as "Not provided," and applications requesting patient data without a privacy policy are flagged with a warning. Administrators can also add a free-text note when declining an app, alongside the predefined decline reason. For [provider-directory publishing](https://www.health-samurai.io/docs/payerbox/run-payerbox/provider-directory-pipeline), [MPF pipeline configuration](https://www.health-samurai.io/docs/payerbox/api-reference/operations/mpf-pipeline-api) now supports the `index.json` file. ## Formbox Formbox 2607 focuses on several details in the form-filling flow. NHS-themed forms support custom labels for continue and submit buttons. A "save and exit" action is shown by default in the NHS app and is also available on the web when a redirect-on-submit link is configured. Date, time, and datetime validation now recognizes incomplete values without clearing what the user has already typed. With 12-hour time fields, users can be prompted for "am" or "pm" while keeping the rest of the input intact. Time items are supported in `enableWhen` conditions, and open-choice questions can submit custom values entered through "specify other." Template-based extraction gets improvements to layout, subject-reference generation, and allocated ID dependencies. Form Builder now clears calculated-expression validation errors once they are resolved. Pagination has also been improved in the forms grid and added to the form gallery. ## Before Upgrading Three Aidbox changes may require migration work. The `/fhir/FHIRSchema` endpoint has been removed. FHIR profiles should be defined with standard `StructureDefinition` resources, which the [FHIR Schema validator](https://www.health-samurai.io/docs/aidbox/modules/profiling-and-validation/fhir-schema-validator) compiles internally. The Zen `seed` and `seed-v2` engines and the `SeedImport` resource type are gone as well. Configuration that needs to load at startup should use [Init Bundle](https://www.health-samurai.io/docs/aidbox/configuration/init-bundle). C-CDA conversion has moved out of Aidbox. The built-in converter and `/ccda/*` endpoints are no longer part of the server; these workflows now run through [Interbox](https://www.health-samurai.io/docs/interbox). ## Read the Full Release Notes This post highlights the main changes across the three products. For the complete changelog, read the release notes for: - [Aidbox 2607](https://www.health-samurai.io/docs/aidbox/overview/release-notes) - [Formbox 2607](https://www.health-samurai.io/docs/formbox/release-notes) - [Payerbox 2607](https://www.health-samurai.io/docs/payerbox/releases) The product documentation includes the exact configuration details, fixes, and migration guidance to review before upgrading.