FAQ
Frequently asked questions about OnePath Connect.
Do I need a BAA before testing?
No. Sandbox access is available without a BAA. A BAA is required before accessing production endpoints where real PHI may be involved.
How is my users' data isolated from other partners?
Each partner gets a completely isolated FHIR context. FHIR records, observations, and AI outputs are logically partitioned by partner ID and enforced at the database layer — not just the application layer.
What AI model powers the insights and coaching features?
OnePath uses a combination of clinical-grounded foundation models. The specific models are abstracted from your integration — they may be updated to improve quality without changing the API interface.
Can I store the API responses in my own database?
Yes, within the bounds of your BAA and HIPAA obligations. API responses that contain PHI are subject to the same HIPAA safeguards as data you receive from any covered entity.
What happens if a user revokes consent?
A consent.revoked webhook is fired immediately. All future API calls for that user will return 403 INSUFFICIENT_SCOPE. Previously cached insights are invalidated.
Do you support SMART on FHIR?
Inbound EHR connections (Epic, Cerner, Athenahealth) support SMART on FHIR OAuth. Contact partners@onepath.health to discuss EHR integration.
What's the SLA for the Partner API?
99.9% uptime target for the Partner API. See status.onepath.health for live status and historical uptime.