A SMART on FHIR bolt-on that Hyperspace can embed.
HEART launches from Epic the way any embedded application does. Registered with Epic Vendor Services. No credentials to configure, no data to migrate, no workflow to change.
Launches beside Epic.
Never in place of it.
HEART reads FHIR R4 resources the moment a clinician opens a chart. Patient, Condition, Observation, AllergyIntolerance, Encounter — synthesized into one view organized by care surface, not by resource type.
- SMART on FHIR R4 · PKCE OAuth 2.0
- Registered with Epic Vendor Services (Non-Prod + Prod Client IDs)
- Embeds inside Hyperspace via configurable frame-ancestors
- 15-minute inactivity kill · session dies on tab close
- 8-tier role-based access — from LPN (5 min) to Physician (60 min)
Different roles. Different windows. Same clarity.
HEART's access model was designed around how clinicians actually work — not a generic user-permissions matrix. Session length, elevation windows, and scoped resource sets differ by role.
"I want the whole trend on one screen — not 40 tabs."
"Show me pre-op labs, active meds, and the last three encounters. That's the call."
"Diagnostic reasoning support without diagnostic claims — that's the line HEART respects."
"I need to see every patient on the unit at once — not click into each one."
"Priors and clinical context, side-by-side with the study. Not in another tab."
"When vitals shift, I want to see the trend, not just the current reading."
"Quick check on assigned patients. Get in, verify, get back to care."
"Audit trail, elevation logs, access reviews — all in one console. No PHI needed."
Regulated by construction.
Not by promise.
HEART's architecture is what makes it compliant. Not policy language. Not attestation. The read-only, zero-retention, session-only design closes categories of risk before they're categories.
HIPAA
Security Rule §164.312 · Privacy Rule §164.502 · Breach Rule §164.400
AlignedNon-Device CDS
Satisfies all four §3060(a) criteria. Informs, never diagnoses. No FDA 510(k) required.
AlignedSHIELD Act
GBL §899-bb WISP documented · §899-aa breach notification cascade in place
AlignedAWS BAA + HCLS
Executed base BAA + Healthcare & Life Sciences addendum · us-east-2
ExecutedObject Lock 6yr
COMPLIANCE mode · KMS CMK · CloudTrail data events · tamper-evident by construction
DeployedVendor Services Registered
Non-Production + Production Client IDs issued · SMART on FHIR R4
RegisteredSOC 2 Type 2
Drata assessment · Q4 2026 target · continuous compliance monitoring
Assessment Q4 2026Delaware C-Corp
GiraffStack, Inc. · 83(b) election filed · fully registered · single officer
RegisteredSee the trend.
Treat the patient.
HEART is in early provider access. Sign in with your issued credentials, or request access if your institution is evaluating.