--- { "title": "Aidbox, Formbox & Payerbox 2609: SQL Materialization, Member Consent, and AI Scriber", "description": "Release 2609 adds dependency-aware SQL materialization and topic-based audit event delivery to Aidbox, signed member consent to the FHIR App Portal, AI Scriber in alpha to Formbox, and continuous matching to MDMbox.", "date": "2026-10-08", "author": "Valeria Fursa", "reading-time": "6 min read", "tags": ["Aidbox", "Forms", "Integrations", "MDMbox"], "utm-campaign": "release", "utm-content": "2609-release" } --- > For the complete documentation index, see [llms.txt](https://www.health-samurai.io/llms.txt). > Use it to discover all available pages before guessing URLs. --- Release 2609 adds dependency-aware SQL materialization and new options for storing, filtering, and forwarding audit events in Aidbox. The FHIR App Portal gets signed member consent, and Formbox introduces AI Scriber in alpha to fill forms from conversations. The release also includes Form Packages, updates to form authoring, and new payer data feeds. ## SQL on FHIR Materialization The new [AidboxMaterialization](https://www.health-samurai.io/docs/aidbox/modules/sql-on-fhir/aidbox-materialization) resource manages related SQL-on-FHIR definitions as PostgreSQL views or materialized views. It supports ViewDefinitions and SQL Libraries of type SQLView or SQLQuery. Queries that depend on a stored object read it directly instead of including a copy of its SQL. When a definition changes, the `$materialize` operation checks the SQL across its dependency graph before changing database objects. It skips objects that are already current and rebuilds those that need updating, together with affected dependents. Materialized-view refreshes are triggered explicitly; Aidbox does not schedule them automatically. The existing `ViewDefinition/$materialize` operation remains available for individual definitions. ## Audit Event Storage and Delivery Aidbox now publishes [audit events](https://www.health-samurai.io/docs/aidbox/access-control/audit-and-logging#audit-events-topic) through the built-in `AuditEventsR4BALP` topic. Teams can forward events to webhooks, Kafka, GCP Pub/Sub, and other supported destinations, or [store them in Aidbox](https://www.health-samurai.io/docs/aidbox/tutorials/security-access-control-tutorials/how-to-subscribe-to-audit-events#store-audit-events-in-the-auditevent-table) with an audit-events-recorder destination. The `security.audit-log.enabled` setting starts a built-in recorder; local recording supports FHIR R4 and R4B. Each destination can [filter events](https://www.health-samurai.io/docs/aidbox/modules/topic-based-subscriptions/aidbox-topic-based-subscriptions#filter-events-with-filterby) by type, subtype, and action. Aidbox builds only events accepted by at least one destination, so teams can select the operations they want to audit. With no destination on the topic, no audit events are built. The old settings for external repository delivery, batching, flush intervals, and request headers are deprecated and ignored. Existing integrations with an external audit repository configured through `security.audit-log.repository-url` stop receiving events after the upgrade. To keep forwarding, create a webhook destination with the same endpoint and make sure the repository accepts the new history Bundle format described in the [migration instructions](https://www.health-samurai.io/docs/aidbox/tutorials/security-access-control-tutorials/how-to-subscribe-to-audit-events#migrate-from-the-security-audit-log-settings). ### Member Consent in the FHIR App Portal Members can now record their data-sharing choices on a new [Data sharing page](https://www.health-samurai.io/docs/payerbox/fhir-app-portal/member-portal/consent-panel). They can opt out of Provider Access or authorize their plan to request records from previous or concurrent plans through Payer-to-Payer exchange. Provider Access sharing is on unless the member opts out; Payer-to-Payer requests require an opt-in. Each choice is signed and saved as a collection of FHIR resources including a Consent resource. Where representative signing is enabled, an authorized representative can record the member's choice. A representative's choice that expands data sharing requires [administrator approval](https://www.health-samurai.io/docs/payerbox/fhir-app-portal/consent-reviews); the previous choice remains in force until approval. A choice that reduces sharing takes effect immediately. [Consent settings](https://www.health-samurai.io/docs/payerbox/fhir-app-portal/consent-settings) control the plan Organization, authorization validity period, the non-sensitive-only option, and the list of previous payers. ### Data Integration The [Data Integration Reference](https://www.health-samurai.io/docs/payerbox/data-integration) adds feeds for [Claims](https://www.health-samurai.io/docs/payerbox/data-integration/carin-bb), [Prior Authorizations](https://www.health-samurai.io/docs/payerbox/data-integration/prior-auth), [Drug Formulary](https://www.health-samurai.io/docs/payerbox/data-integration/drug-formulary), and [Member Consent](https://www.health-samurai.io/docs/payerbox/data-integration/consent). Claims target CARIN BB 2.1.0, prior authorizations PDex 2.1.0, and drug formulary data PDex US Drug Formulary 2.1.0. ### PAS Analytics Successful PAS inquiries can be [recorded as AuditEvents](https://www.health-samurai.io/docs/payerbox/prior-auth/pas#recording-inquiry-exchanges) with `PAS_PERSIST_INQUIRIES=true`, which is off by default. [PAS Metrics](https://www.health-samurai.io/docs/payerbox/analytics/pas-metrics) 0.1.9 uses these records to count query exchanges and identify queries from providers other than the ordering provider. ## Formbox ### AI Scriber [AI Scriber](https://www.health-samurai.io/docs/formbox/ai-scriber), introduced in alpha, enters answers into Formbox forms from conversations. Users can dictate details, correct an answer, and move between pages or forms in a package by voice. The Scriber also looks up terminology codes and preserves evidence for generated answers. If an instruction is unclear, it can leave a note at the relevant field for the user to resolve. Users review the answers and validation results before submission. Scriber is disabled by default and must be enabled in the form's configuration. ### Form Packages and Authoring [Form Packages](https://www.health-samurai.io/docs/formbox/plan-definitions) bring reusable forms into one workflow. Answers can determine which forms appear and prefill fields in later forms. Packages can be shared by link or email and embedded in an application. Responses from the forms in a package can be exported as a single PDF. The Form Builder gets an [AI-first layout](https://www.health-samurai.io/docs/formbox/aidbox-ui-builder-alpha/ai-first-layout) in alpha, with chat beside the form preview for creating and editing forms through natural-language instructions. [Liquid Templates](https://www.health-samurai.io/docs/formbox/aidbox-ui-builder-alpha/printing-forms/liquid-templates) also gain AI-assisted editing and live preview, alongside tools for managing templates and linking them to forms. ## MDMbox: Continuous Matching and Aidbox Access [Continuous matching](https://www.health-samurai.io/docs/mdmbox/continuous-matching) matches existing records and keeps results current as records are inserted, updated, and deleted. Changes to prepared fields recompute affected matches and weights; deleting a record removes its matching pairs. Manual decisions and merge history remain available. Pausing a process preserves completed results and captured changes. Active processes recover after restarts and transfer matching work between instances during rolling updates. The Admin UI shows change-application and matching progress separately. Results can be downloaded as CSV or NDJSON, or browsed as paginated JSON with a decision-status filter. MDMbox now runs as an Aidbox App, so you reach both the [Admin UI](https://www.health-samurai.io/docs/mdmbox/authentication#admin-ui-through-aidbox) and the API through Aidbox. You no longer need a separate MDMbox host. Open the Admin UI at /mdmbox on your Aidbox address and send API requests to Aidbox too. Aidbox handles sign-in and access control for both, so a separate MDMbox login is no longer needed. ## Other Updates Aidbox adds [StructureDefinition version selection](https://www.health-samurai.io/docs/aidbox/configuration/storage-and-api-configuration#pin-the-type-definition) for API resource validation and [SMART patient-scope access to Binary resources](https://www.health-samurai.io/docs/aidbox/api/rest-api/other/binary#access-control-with-smart-patient-scopes) through their security context. Metrics, traces, and logs now take `service.name` from `BOX_INSTANCE_NAME`, with Aidbox as the default. Teams using a custom instance name should update dashboards and alerts that filter on the previous service name. ## Read the Full Release Notes For the complete changelog and configuration details, read the release notes for: - [Aidbox](https://www.health-samurai.io/docs/aidbox/overview/release-notes) - [Formbox](https://www.health-samurai.io/docs/formbox/release-notes) - [Payerbox](https://www.health-samurai.io/docs/payerbox/releases) - [MDMbox](https://www.health-samurai.io/docs/mdmbox/release-notes#september-2026)