Release 2608 brings large Binary streaming, Google Cloud SQL IAM authentication, and scoped purge operations to Aidbox. It introduces Formbox Voice Agents for automated patient calls and a Payerbox data contract for inbound integrations, alongside updates to payer interoperability, prior authorization, analytics, and provider directory publishing.
Large Binary Files and Cloud Deployment
Aidbox can stream large Binary files between a client and external blob storage when offload is configured for the data element. It keeps only a small buffer in memory, so files can be larger than the memory available to the instance.
The blobNamePrefix parameter writes offloaded files as {prefix}/{uuid}. The prefix can separate environments or tenants in a shared Azure, AWS, or GCP bucket.
Storage and API configuration can be provisioned through an init bundle.
The Cloud SQL Java Connector integration connects Aidbox to Google Cloud SQL for PostgreSQL through the Cloud SQL JDBC socket factory, with IAM database authentication in place of a stored database password.
Subscription Event Delivery
Aidbox can copy a request correlation id into a topic-based subscription notification. The header name is configured with module.topics.correlation-id-header. NATS destinations receive the value as a native message header.
For Kafka, keyByResourceId uses the FHIR resource id as the message key. Events for the same resource go to the same partition and keep their order. Webhook destinations remain immutable in general, but the endpoint of a webhook-at-least-once destination can be updated when it is the only changed parameter.
Data Cleanup and API Behavior
Organization $purge deletes selected or all data belonging to an organization and its nested organizations. Group $purge works at the patient level: it deletes every Patient member of a Group together with the resources in each patient's compartment, either synchronously or asynchronously. Authorization is checked for every member before deletion begins, so a single denial leaves the group unchanged.
Other Aidbox changes:
- Create and update responses return an absolute FHIR
Locationheader. Setfhir.location-header-compliant-modetofalseto restore the previous relative form. - New settings control search parameter usage statistics.
fhir.search.param-stats.enabledcontrols collection, whilefhir.search.param-stats.flush-intervalsets how often buffered samples are written to PostgreSQL. Both support hot reload. - GraphQL references to contained resources resolve inline through the
resourcefield instead of returningnull. - Fixes are included for Aidbox UI, Multibox, and trace delivery through the OTEL connector.
For batch and transaction requests, Prefer: return=minimal now returns a response bundle without resource bodies, matching HAPI. Entries retain response.status, location, etag, and lastModified; failed entries retain their OperationOutcome. Clients that need the previous empty-body behavior should use Prefer: return=hs-headers-only. Single-resource endpoints are unchanged.
Voice Agents and the New Formbox UI
Release 2608 brings two major changes to Formbox. Voice Agents turn existing forms into automated patient voice calls: an agent asks the form's questions, captures the responses, and uses the form's existing content as the basis for the conversation. The new Formbox UI is now the default, with a cleaner, more streamlined way to work with forms; the legacy interface remains available for teams that need it.
Formbox also gets several smaller improvements this release: textareas in long forms keep a stable scroll position while users type, dates entered through an embedded iframe renderer are preserved correctly, custom attributes with boolean, integer, and decimal values are handled correctly on save, and larger, more resource-intensive PDF forms can be imported and converted into Questionnaire JSON.
A Published Data Contract for Payerbox
The Data Integration Reference defines the inbound data contract for Payerbox. It covers 24 USCDI v3.1 datasets mapped to US Core 6.1.0 and four Provider Directory datasets mapped to Plan-Net 1.2.0. Each dataset has a downloadable CSV template. Coded columns link to their value sets, such as the OMB Ethnicity Categories ValueSet.
Payerbox targets CARIN Blue Button 2.1.0 and PDex Plan-Net 1.2.0, replacing versions 2.0.0 and 1.1.0. CARIN BB 2.1.0 adds the Non-Financial Basis profiles used in Payer-to-Payer and Provider Access exports. Supported versions are listed on the Implementation Guides page.
Interoperability and Prior Authorization Updates
For Payer-to-Payer and Provider Access, $davinci-data-export accepts kick-off parameters on the query string and returns 400 for an inverted _since and _until window. $bulk-member-match and $provider-member-match no longer fail when a MemberBundle references resources that exist only on the requesting side. The member-match change requires BOX_FHIR_VALIDATION_SKIP_REFERENCE=true, as described in the deployment guide.
Payerbox rejects updates to a denied prior authorization regardless of how the utilization management system wrote the decision back; the Claim/$submit update flow describes the behavior. $submit-attachment uses the PAS PASTempCodes code system for supportingInfo.category. The previous system URL did not exist in the implementation guide and failed terminology validation.
For CRD, order-sign, order-dispatch, and appointment-book return a Coverage Information system action when coverage cannot be determined. Along with the explanatory card, the action annotates the draft order with covered=conditional, info-needed=OTH, and a human-readable reason, as required by Da Vinci CRD 2.1.0. order-select remains unchanged and returns the card only.
PAS Analytics and MPF Publishing
The PAS metrics package, io.healthsamurai.pas-metrics 0.1.6, is available for download with an Aidbox Notebook that charts each metric. Package details are available in the PAS Metrics documentation.
The MPF provider directory pipeline publishes data by contract year. InsurancePlan.period carries the published year, and providers that are not in network during that year are excluded. Network scope is derived from the configured plans on every run: administrators configure InsurancePlan ids, and the network Organization ids come from each plan's network[]. The Network Organization IDs setting has been removed, and previously stored values are ignored. The MPF Publications documentation describes the updated flow.
Read the Full Release Notes
This post covers the main changes across the three products. For the complete changelog and configuration details, read the release notes for:
