08.27.2026

Today’s release includes the following updates:

bugfix

  • Several improvements to the patient portal login workflow:
    • Invite and password-reset links no longer show “Expired link” when the link is still good. A link stays usable for its full lifetime and is spent only when the password is actually set.
    • When a different account is signed in on the same browser, an invite or reset link now names that as the reason and offers a one-click “Sign out and continue” that reopens the same link, rather than reporting the link as expired.
    • Patients who open the portal at a URL without a trailing slash, such as /app, now reach the portal instead of a 403 Forbidden.
  • Fixed an issue where signing in to the patient portal and then opening a page in Canvas gave a bare 403 error with nothing to act on — most often hit while testing the portal in a non-production environment. That page now explains that the portal session is in the way, and signs you out to the page you were headed for.

sdk

  • Vital sign readings are now available in the SDK data module — the records behind the Vitals command. Plugins can read a patient’s readings along with each individual measurement — the sign, its LOINC code, the value and the units — through the reading’s signs.
  • The Immunize command is now available in the SDK, so plugins can record a vaccine administered during a visit and the lot it came from. The instance’s vaccine catalog and its lot inventory are readable as Vaccine and VaccineLot, and supplying a lot fills in the manufacturer and expiration date for you.
  • The Lab Order command’s comment is now limited to 128 characters.