Online Test Request

Online Test Requesting (OLTR) Specification

This document defines how a third‑party application can securely launch a diagnostic test requesting system and receive data about the test requests made. It describes the secure, context‑driven process for launching an OLTR system from third‑party applications (typically a Practice Management System, e.g. EMIS Web). The launch process returns a single‑use, short‑lived URL that opens the OLTR system with pre‑populated patient data.

All solutions developed must undergo penetration testing by an accredited security testing company, and the results must be shared with the assurance team. Deployments must include robust security controls such as firewalls, IP whitelisting, web application firewall (WAF), and other industry‑standard protections.

Purpose

This API allows external patient‑centric systems to:

• Launch OLTR‑compliant systems without requiring user credentials.
• Pass patient and request context securely via application backends.
• Avoid exposing sensitive data in URLs.

---

Sequence diagrams

The following sequence diagrams describe the flow of calls and data to retrieve a single‑use launch URL, and then the use of that launch URL. Both flows include PKCE.

Requesting Launch URL + PKCE

This sequence is authenticated using the standard OAuth 2 client credentials flow. In the diagram, the ‘Third Party’ refers to the application that is trying to launch the OLTR application. The ‘Launch API’ is the component that this specification describes.

sequenceDiagram
title URL Retrieval
    participant UI as Third Party Client
    participant Server as Third Party Server
    participant IdP as Identity Provider
    participant API as Launch API

    UI->>Server: Request OLTR Access
    Server->>IdP: Authenticate (clientID, secret)
    IdP-->>Server: Access Token
    Server->>Server: Generate codeVerifier
    Server->>Server: Hash codeVerifier → codeChallenge
    Server->>API: POST FHIR data with access token + codeChallenge
    API->>IdP: Retrieve JWKS keys
    IdP-->>API: Retrieve JWKS Keys
    API->>API: Validate token & FHIR
    API->>API: Store codeChallenge + Store FHIR
    API->>API: Create launch token & URL
    API-->>Server: Launch URL
    Server-->>UI: Launch URL

Launching the OLTR System + PKCE

This sequence shows the use of the launch URL. This flow is authenticated by the single‑use, time‑limited token returned as part of the launch URL; client credentials are not required and no calls are made to the identity provider. In the diagram, the ‘OLTR Web Server’ is the server hosting the application to be launched.

sequenceDiagram
    title Launch System OLTR
    participant UI as Third Party Client
    participant OLTR as OLTR Web Server
    participant IdP as Identity Provider
    participant API as Launch API

    UI->>OLTR: Navigate to Launch URL with codeVerifier and token
    Note over OLTR: Extract launch token and codeVerifier
    OLTR->>API: Retrieve stored codeChallenge
    OLTR->>OLTR: Hash codeVerifier
    OLTR->>OLTR: Compare with stored codeChallenge
    OLTR->>OLTR: Check token valid and not used
    OLTR-->>UI: 200 Proceed if valid, else 401

---

PKCE enhancement (required)

To mitigate man‑in‑the‑middle risks:

• Client generates a code verifier (random string; recommended 64–128 bytes before Base64 URL encoding).
• Client hashes the verifier using SHA‑256 to produce the code challenge.
• codeChallenge is sent (Base64 URL encoded) with the launch URL request.
• codeVerifier is sent (Base64 URL encoded) when launching the OLTR system.
• Server compares the hashed verifier with the stored challenge.
• If there is a mismatch, return HTTP 401 Unauthorized.

Query string parameters:

• codeVerifier
• launchToken (returned by the API and required to launch)

Parameter naming is case‑sensitive for consistency across implementations.

Example PKCE code (C#)

PKCE can be implemented in any language; the examples below illustrate the approach.

Generate code verifier and challenge (launching system):

using System;
using System.Security.Cryptography;
using System.Text;
using Microsoft.IdentityModel.Tokens; // Base64UrlEncoder

public static class Pkce
{
    public static string GenerateCodeVerifier(int length = 64)
    {
        using (var rng = RandomNumberGenerator.Create())
        {
            var bytes = new byte[length];
            rng.GetBytes(bytes);
            return Base64UrlEncoder.Encode(bytes);
        }
    }

    public static string GenerateCodeChallenge(string codeVerifier)
    {
        using (var sha256 = SHA256.Create())
        {
            var bytes = Encoding.ASCII.GetBytes(codeVerifier);
            var hash = sha256.ComputeHash(bytes);
            return Base64UrlEncoder.Encode(hash);
        }
    }
}

Verify the challenge (OLTR system):

using System.Security.Cryptography;
using System.Text;
using Microsoft.IdentityModel.Tokens;

public static class PkceValidator
{
    public static bool IsValid(string codeVerifier, string codeChallenge)
    {
        using (var sha256 = SHA256.Create())
        {
            var verifierBytes = Encoding.ASCII.GetBytes(codeVerifier);
            var hashed = sha256.ComputeHash(verifierBytes);
            var computedChallenge = Base64UrlEncoder.Encode(hashed);
            return computedChallenge == codeChallenge;
        }
    }
}

---

Authentication flow

The API is intended for server‑to‑server communication for authentication and passing of context data. It must not be called directly by client applications, as the authentication mechanism would become vulnerable.

OAuth 2.0 – Client Credentials Grant

• It is the responsibility of the OLTR system provider or their customers to provide the identity provider (IdP) for client credentials.
• Server‑to‑server authentication only.
• Token obtained from an identity provider (e.g. Entra ID/Azure AD, Azure AD B2C, etc).
• Client ID and secret passed in the body of the application/x-www-form-urlencoded POST request.

Example token request (cURL)

curl --location --request POST 'https://{idp-url}/{tenant-or-policy}/oauth2/v2.0/token' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'client_id={CLIENT_ID}' \
  --data-urlencode 'scope={APP_ID_URI}/.default' \
  --data-urlencode 'client_secret={CLIENT_SECRET}'

Note: Access tokens are typically valid for short periods (for example, around one hour). The launching system is expected to check the expiration, then cache and reuse until expiry before requesting a new one.

---

Endpoint: Request Launch URL

POST /AccessApi/RequestLaunchUrl

Headers:

• Authorization: Bearer <access_token>
• Content-Type: application/json

Scope:

• ocs-launch.write

Body:

• FHIR R4 ServiceRequest (sparse) payload (see #fhir-payload-definition).

Example response

{
  "url": "https://{OltrServer}/secureLaunch?launchToken=abc123xyz"
}

Note: The client should append codeVerifier when navigating to the launch URL:

https://{OltrServer}/secureLaunch?launchToken=abc123xyz&codeVerifier={base64url-code-verifier}

---

FHIR payload definition

The payload must conform to a simplified FHIR R4 ServiceRequest resource. Required fields include:

• extension.action: Supported actions (for example OrderTest)
• extension.author: Person resource with identifier and name
• subject: Patient resource with demographics and identifiers
• requester: PractitionerRole with references to Practitioner and Organization
• performer: Organization expected to carry out the test
• identifier: Originating system ID
• authoredOn: Date/time of request

Example payload

{
  "resourceType": "ServiceRequest",
  "extension": [
    {
      "url": "https://fhir.tquest.emishealth.com/extension/action",
      "valueString": "OrderTest"
    },
    {
      "url": "https://fhir.tquest.emishealth.com/extension/author",
      "valueReference": { "reference": "#Author" }
    }
  ],
  "identifier": [
    {
      "system": "https://fhir.tquest.emishealth.com/Id/originating-system-id",
      "value": "d7d66a27-4923-43fa-ac6d-9148231ad567"
    }
  ],
  "authoredOn": "2023-11-06T19:43:05Z",
  "subject": { "reference": "#Patient" },
  "requester": { "reference": "#Requester" },
  "performer": [{ "reference": "#PerformingOrg" }],
  "contained": [
    { "resourceType": "Person", "id": "Author" },
    { "resourceType": "Patient", "id": "Patient" },
    { "resourceType": "PractitionerRole", "id": "Requester" },
    { "resourceType": "Organization", "id": "PerformingOrg" }
  ]
}

---

HTTP status codes

Code	Meaning	Notes
200	OK	Successful request
400	Bad Request	Validation errors; GUID returned
401	Unauthorized	Missing/invalid token or PKCE mismatch
403	Forbidden	Token lacks required scope
409	Conflict	IdByCaller already used
410	Gone	Launch token already used
500	Internal Error	GUID returned in test environment

---

Error handling

• 400: Include GUID for correlation with server‑side logging of error details.
• 401/403: No body returned.
• 409/410: Log server‑side; no body returned.
• 500: Include GUID for correlation with server‑side logging of error details.

---

Required headers

• Authorization: Bearer <access_token>
• Content-Type: application/json (POST)

---

Security considerations

• Launch URLs expire within ten seconds or less and are single‑use.
• Tokens must be securely stored and never exposed to frontend clients.
• Firewall must restrict API access to known IPs.
• JWT must be validated (audience, scopes).
• Penetration testing is required for every implementation.

---

FHIR data types

ServiceRequest

Name	Cardinality	FHIR Type / Length	Description
id	0..1	id / string 64	Logical Id of the request; set by the resource owner. Currently not used.
extension.action	1..1	string / 25	One of: OrderTest, UpdateTest, PatientSampleQueue, PatientRequestList, LocationSampleQueue, PatientReport, PatientReportList, LocationReportList.
extension.author	1..1	Person	Details of the person who entered the request, including their username.
identifier	1..*	Identifier	Only one identifier is processed; expected to be the originating system’s identifier for the request. System value: https://fhir.tquest.emishealth.com/Id/originating-system-id.
subject	1..1	Patient	Details of the patient.
authoredOn	1..1	dateTime	Date and time the request was made.
requester	1..1	PractitionerRole	Details of the requesting clinician and their organisation.
performer	1..1	Organization	Organisation expected to carry out the test.

Person

Name	Cardinality	FHIR Type / Length	Description
name	1..1	HumanName	Only usual name supported. Forename and surname are required.
identifier	1..1	Identifier	One instance required with system value: https://fhir.tquest.emishealth.com/Id/username.

Patient

Name	Cardinality	FHIR Type / Length	Description
name	1..2	HumanName	Patient’s usual name and previous name supported.
birthDate	1..1	date	Date of birth (e.g., 1968-03-31).
gender	1..1	code	Administrative gender: male	female	other	unknown.
address	1..1	Address	Patient’s address.
identifier	1..2	Identifier	National Identifier and/or Hospital Number. System URIs: https://fhir.nhs.uk/Id/nhs-number, https://fhir.tquest.emishealth.com/Id/chi-number, https://fhir.tquest.emishealth.com/Id/gha-number, https://fhir.tquest.emishealth.com/Id/hospital-number, https://fhir.tquest.emishealth.com/Id/ssn-number.
telecom	0..4	ContactPoint	Patient’s phone number/email.

HumanName

Name	Cardinality	FHIR Type / Length	Description
use	1..1	string	Possible values: usual, official, temp, nickname, anonymous, old, maiden. Only usual and old are supported. For old, only family name is used, limited to length 35.
prefix	0..*	string / 35	Patient title. Only one supported.
family	1..1	string / 70	Surname.
given	0..*	string / 70	Forenames; repetitions can be used for middle names. Total length of all repetitions is 35.

Address

Name	Cardinality	FHIR Type / Length	Description
use	1..1	code	Possible values: home, work, temp, old. Only home supported for patients; for clinicians, work may be used.
type	1..1	code	Possible values: postal, physical. Only physical supported.
line	0..5	string / 70	Up to five address lines.
postalCode	0..1	string / 10	Postcode.

ContactPoint

The system can store home phone and work phone. Mobile phone and email are also stored and assumed to be personal (home) use.

Name	Cardinality	FHIR Type / Length	Description
system	1..1	code	Possible values: phone, fax, email, pager, url, sms, other. Only phone and email supported.
value	1..1	string	The phone number or email address.
use	0..1	code	Possible values: home, work, temp, old, mobile. Only home, work, and mobile supported.

PractitionerRole

Name	Cardinality	FHIR Type / Length	Description
practitioner	1..1	Practitioner	Reference to the clinician.
organization	1..1	Organization	Reference to the clinician’s organisation.

Practitioner

Name	Cardinality	FHIR Type / Length	Description
identifier	1..*	Identifier	Only one instance supported. System values: https://fhir.hl7.org.uk/Id/professional-code, https://fhir.tquest.emishealth.com/Id/local-staff-code. Values must be agreed; the first option is intended for ODS/NACS code. Where local codes are used, both sides must use the same code set.
name	1..*	HumanName	Only one name supported.

Organization

Name	Cardinality	FHIR Type / Length	Description
identifier	1..*	Identifier	Only one instance supported. System values: https://fhir.nhs.uk/Id/ods-organization-code, https://fhir.tquest.emishealth.com/Id/local-org-code. Values must be agreed; where local codes are used, both sides must use the same code set.
name	1..1	string	Organisation name.

Identifier

Name	Cardinality	FHIR Type / Length	Description
system	1..1	uri	URI describing the code set
value	1..1	string	The identifier

---

Example FHIR ServiceRequest message

Below is an example of ServiceRequest for an OrderTest action.

{
  "resourceType": "ServiceRequest",
  "contained": [
    {
      "resourceType": "Person",
      "id": "Author",
      "identifier": [
        {
          "system": "https://fhir.tquest.emishealth.com/Id/username",
          "value": "helen.jackson"
        }
      ],
      "name": [
        {
          "use": "usual",
          "family": "Jackson",
          "given": ["Helen"],
          "prefix": ["Mrs"]
        }
      ]
    },
    {
      "resourceType": "Patient",
      "id": "Patient",
      "identifier": [
        {
          "system": "https://fhir.nhs.uk/Id/nhs-number",
          "value": "9999999999"
        }
      ],
      "name": [
        {
          "use": "usual",
          "family": "Sullivan",
          "given": ["Freida", "Jane"],
          "prefix": ["Mrs"]
        },
        {
          "use": "old",
          "family": "Jones"
        }
      ],
      "telecom": [
        { "system": "phone", "value": "01223 333333", "use": "home" },
        { "system": "email", "value": "freddy@mymail.co.uk", "use": "home" }
      ],
      "gender": "female",
      "birthDate": "1968-03-31",
      "address": [
        {
          "use": "home",
          "type": "physical",
          "line": ["70 Hopkins Close", "Cambridge"],
          "postalCode": "CB4 1FD"
        }
      ]
    },
    {
      "resourceType": "Organization",
      "id": "RequestingOrg",
      "identifier": [
        {
          "system": "https://fhir.tquest.emishealth.com/Id/local-org-code",
          "value": "LOC12345"
        }
      ],
      "name": "Requesting Organisation"
    },
    {
      "resourceType": "Practitioner",
      "id": "RequestingClinician",
      "identifier": [
        {
          "system": "https://fhir.tquest.emishealth.com/Id/local-staff-code",
          "value": "LOC9876"
        }
      ],
      "name": [
        {
          "use": "usual",
          "family": "Fraser",
          "given": ["Brenden"],
          "prefix": ["Dr"]
        }
      ]
    },
    {
      "resourceType": "PractitionerRole",
      "id": "Requester",
      "practitioner": { "reference": "#RequestingClinician" },
      "organization": { "reference": "#RequestingOrg" }
    },
    {
      "resourceType": "Organization",
      "id": "PerformingOrg",
      "identifier": [
        {
          "system": "https://fhir.tquest.emishealth.com/Id/performing-org",
          "value": "A12345"
        }
      ],
      "name": "The Hospital Trust"
    }
  ],
  "extension": [
    {
      "url": "https://fhir.tquest.emishealth.com/extension/author",
      "valueReference": { "reference": "#Author" }
    },
    {
      "url": "https://fhir.tquest.emishealth.com/extension/action",
      "valueString": "OrderTest"
    }
  ],
  "identifier": [
    {
      "system": "https://fhir.tquest.emishealth.com/Id/originating-system-id",
      "value": "d7d66a27-4923-43fa-ac6d-9148231ad567"
    }
  ],
  "authoredOn": "2023-11-06T19:43:05.2892329+00:00",
  "requester": { "reference": "#Requester" },
  "performer": [{ "reference": "#PerformingOrg" }]
}

---

Returning data

Currently, data is returned to the caller in the same way as the original OLTR specification: as XML contained within the page returned after submitting the request. In future, this will change to an API call to the launched application.

When the test request is submitted by the OLTR system, the response page must include a hidden IFRAME element named Notepad. The page loaded in the IFRAME must contain a TEXTAREA element called Output. This control contains the response XML for the launching application to extract.

Note: Schemas are available defining the returned XML.

Example HTML skeleton:

Example OrderTest response

<?xml version="1.0"?>
<onlineOrder xmlns="urn:e-mis-ahsl/clinicalinteroperability:v1"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="urn:e-mis-ahsl/clinicalinteroperability:v1 D:\Design\OpenSchemas\OnlineIntegrationv4\CIOnlineTestOrder04.xsd">
  <messageId>{131AF865-45E7-4AEA-A999-C7DFA0C98D03}</messageId>
  <serviceProvider>
    <system>
      <systemName>Indigo4 tQuest</systemName>
      <systemVersion>1.2</systemVersion>
    </system>
    <organisation>
      <name>County Hospital</name>
      <identificationCode>
        <value>COU1</value>
        <scheme>NHSORGANISATIONS</scheme>
      </identificationCode>
    </organisation>
  </serviceProvider>
  <patient>
    <dateOfBirth>19410412</dateOfBirth>
    <familyName>Duck</familyName>
    <firstNames>Donald</firstNames>
    <title>Mr</title>
    <nhsNumber>9999999999</nhsNumber>
  </patient>
  <orderHeader>
    <guid>{554BD643-499T-8D67-98D9-E7Z98653F419}</guid>
    <requestor>
      <familyName>Bloggs</familyName>
      <firstNames>John</firstNames>
      <title>Dr</title>
      <identificationCode>
        <value>G333333</value>
        <scheme>NHSGPNATIONALCODES</scheme>
      </identificationCode>
    </requestor>
    <timeofRequest>20040630093558</timeofRequest>
    <orderBatch>
      <refid>2</refid>
      <guid>8ac8b33e-ca70-11d8-8546-0060670781fd</guid>
      <orderReference>0000000420</orderReference>
      <Provider>
        <name>County Radiology Department</name>
        <identificationCode>
          <value>R000</value>
          <scheme>NHSORGANISATIONS</scheme>
        </identificationCode>
      </Provider>
      <OrderCategory>2</OrderCategory>
      <Status>R</Status>
      <LastStatusDate>20040630093612</LastStatusDate>
      <sample>
        <refid>579</refid>
        <description>[Radiology]</description>
        <sampleCompletionTime/>
      </sample>
      <testOrder>
        <refid>708</refid>
        <sample>
          <refid>579</refid>
        </sample>
        <testDescription>Chest X Ray</testDescription>
        <code>
          <value>CHEST X RA</value>
          <scheme>LOCAL</scheme>
          <term>Chest X Ray</term>
        </code>
        <Status>R</Status>
        <LastStatusDate>20040630093612</LastStatusDate>
      </testOrder>
    </orderBatch>
    <orderBatch>
      <refid>1</refid>
      <guid>8ac6f9b8-ca70-11d8-9036-0060670781fd</guid>
      <orderReference>0000000419</orderReference>
      <Provider>
        <name>County Microbiology Labs</name>
        <identificationCode>
          <value>M000</value>
          <scheme>NHSORGANISATIONS</scheme>
        </identificationCode>
      </Provider>
      <OrderCategory>1</OrderCategory>
      <Status>R</Status>
      <LastStatusDate>20040630093612</LastStatusDate>
      <sample>
        <refid>580</refid>
        <description>Purple cap EDTA 4.5ml</description>
        <sampleCompletionTime/>
      </sample>
      <testOrder>
        <refid>709</refid>
        <sample>
          <refid>580</refid>
        </sample>
        <testDescription>Malarial parasites</testDescription>
        <code>
          <value>MALARIAL P</value>
          <scheme>LOCAL</scheme>
          <term>Malarial parasites</term>
        </code>
        <Status>R</Status>
        <LastStatusDate>20040630093612</LastStatusDate>
      </testOrder>
    </orderBatch>
  </orderHeader>
</onlineOrder>

Example UpdateTest response

<?xml version="1.0"?>
<onlineOrder xmlns="urn:e-mis-ahsl/clinicalinteroperability:v1"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="urn:e-mis-ahsl/clinicalinteroperability:v1 D:\Design\OpenSchemas\OnlineIntegrationv4\CIOnlineTestOrder04.xsd">
  <messageId>{131AF865-45E7-4AEA-A999-C7DFA0C98D03}</messageId>
  <serviceProvider>
    <system>
      <systemName>Indigo4 tQuest</systemName>
      <systemVersion>1.2</systemVersion>
    </system>
    <organisation>
      <name>County Hospital</name>
      <identificationCode>
        <value>COU1</value>
        <scheme>NHSORGANISATIONS</scheme>
      </identificationCode>
    </organisation>
  </serviceProvider>
  <patient>
    <dateOfBirth>19410412</dateOfBirth>
    <familyName>Duck</familyName>
    <firstNames>Donald</firstNames>
    <title>Mr</title>
    <nhsNumber>9999999999</nhsNumber>
  </patient>
  <orderHeader>
    <guid>{554BD643-499T-8D67-98D9-E7Z98653F419}</guid>
    <requestor>
      <familyName>Bloggs</familyName>
      <firstNames>John</firstNames>
      <title>Dr</title>
      <identificationCode>
        <value>G333333</value>
        <scheme>NHSGPNATIONALCODES</scheme>
      </identificationCode>
    </requestor>
    <timeofRequest>20040630093558</timeofRequest>
    <orderBatch>
      <refid>2</refid>
      <guid>44e157da-ca71-11d8-8244-0060670781fd</guid>
      <orderReference>0000000421</orderReference>
      <Provider>
        <name>County Cytology Labs</name>
        <identificationCode>
          <value>CT00</value>
          <scheme>NHSORGANISATIONS</scheme>
        </identificationCode>
      </Provider>
      <OrderCategory>1</OrderCategory>
      <Status>R</Status>
      <LastStatusDate>20040630094124</LastStatusDate>
      <sample>
        <refid>581</refid>
        <description>Blood culture set</description>
        <sampleCompletionTime/>
      </sample>
      <testOrder>
        <refid>710</refid>
        <sample>
          <refid>581</refid>
        </sample>
        <testDescription>Blood culture</testDescription>
        <code>
          <value>BLOOD CULT</value>
          <scheme>LOCAL</scheme>
          <term>Blood culture</term>
        </code>
        <Status>R</Status>
        <LastStatusDate>20040630094124</LastStatusDate>
      </testOrder>
    </orderBatch>
    <orderBatch>
      <refid>2</refid>
      <guid>8ac8b33e-ca70-11d8-8546-0060670781fd</guid>
      <orderReference>0000000420</orderReference>
      <Provider>
        <name>County Radiology Department</name>
        <identificationCode>
          <value>R000</value>
          <scheme>NHSORGANISATIONS</scheme>
        </identificationCode>
      </Provider>
      <OrderCategory>2</OrderCategory>
      <Status>R</Status>
      <LastStatusDate>20040630093612</LastStatusDate>
      <sample>
        <refid>579</refid>
        <description>[Radiology]</description>
        <sampleCompletionTime/>
      </sample>
      <testOrder>
        <refid>708</refid>
        <sample>
          <refid>579</refid>
        </sample>
        <testDescription>Chest X Ray</testDescription>
        <code>
          <value>CHEST X RA</value>
          <scheme>LOCAL</scheme>
          <term>Chest X Ray</term>
        </code>
        <Status>R</Status>
        <LastStatusDate>20040630093612</LastStatusDate>
      </testOrder>
    </orderBatch>
    <orderBatch>
      <refid>1</refid>
      <guid>8ac6f9b8-ca70-11d8-9036-0060670781fd</guid>
      <orderReference>0000000419</orderReference>
      <Provider>
        <name>County Microbiology Labs</name>
        <identificationCode>
          <value>M000</value>
          <scheme>NHSORGANISATIONS</scheme>
        </identificationCode>
      </Provider>
      <OrderCategory>1</OrderCategory>
      <Status>D</Status>
      <LastStatusDate>20040630094124</LastStatusDate>
      <sample>
        <refid>580</refid>
        <description>Purple cap EDTA 4.5ml</description>
        <sampleCompletionTime/>
      </sample>
      <testOrder>
        <refid>709</refid>
        <sample>
          <refid>580</refid>
        </sample>
        <testDescription>Malarial parasites</testDescription>
        <code>
          <value>MALARIAL P</value>
          <scheme>LOCAL</scheme>
          <term>Malarial parasites</term>
        </code>
        <Status>D</Status>
        <LastStatusDate>20040630094124</LastStatusDate>
      </testOrder>
    </orderBatch>
  </orderHeader>
</onlineOrder>

Example PatientSampleQueue response

<?xml version="1.0"?>
<onlineOrder xmlns="urn:e-mis-ahsl/clinicalinteroperability:v1"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="urn:e-mis-ahsl/clinicalinteroperability:v1 D:\Design\OpenSchemas\OnlineIntegrationv4\CIOnlineTestOrder04.xsd">
  <messageId>{131AF865-45E7-4AEA-A999-C7DFA0C98D03}</messageId>
  <serviceProvider>
    <system>
      <systemName>Indigo4 tQuest</systemName>
      <systemVersion>1.2</systemVersion>
    </system>
    <organisation>
      <name>County Hospital</name>
      <identificationCode>
        <value>COU1</value>
        <scheme>NHSORGANISATIONS</scheme>
      </identificationCode>
    </organisation>
  </serviceProvider>
  <patient>
    <dateOfBirth>19410412</dateOfBirth>
    <familyName>Duck</familyName>
    <firstNames>Donald</firstNames>
    <title>Mr</title>
    <nhsNumber>9999999999</nhsNumber>
  </patient>
  <orderHeader>
    <guid>{554BD643-499T-8D67-98D9-E7Z98653F419}</guid>
    <requestor>
      <familyName>Bloggs</familyName>
      <firstNames>John</firstNames>
      <title>Dr</title>
      <identificationCode>
        <value>G333333</value>
        <scheme>NHSGPNATIONALCODES</scheme>
      </identificationCode>
    </requestor>
    <timeofRequest>20040630101548</timeofRequest>
    <orderBatch>
      <refid>2</refid>
      <guid>3289e71e-ca76-11d8-813a-0060670781fd</guid>
      <orderReference>0000000424</orderReference>
      <Provider>
        <name>County Cytology Labs</name>
        <identificationCode>
          <value>CT00</value>
          <scheme>NHSORGANISATIONS</scheme>
        </identificationCode>
      </Provider>
      <OrderCategory>1</OrderCategory>
      <Status>S</Status>
      <LastStatusDate>20040630101641</LastStatusDate>
      <sample>
        <refid>584</refid>
        <description>Blood culture set</description>
        <sampleCompletionTime>20040630101500</sampleCompletionTime>
      </sample>
      <testOrder>
        <refid>713</refid>
        <sample>
          <refid>584</refid>
        </sample>
        <testDescription>Blood culture</testDescription>
        <code>
          <value>BLOOD CULT</value>
          <scheme>LOCAL</scheme>
          <term>Blood culture</term>
        </code>
        <Status>S</Status>
        <LastStatusDate>20040630101641</LastStatusDate>
      </testOrder>
    </orderBatch>
    <orderBatch>
      <refid>2</refid>
      <guid>27c11c6c-ca76-11d8-9876-0060670781fd</guid>
      <orderReference>0000000423</orderReference>
      <Provider>
        <name>County Radiology Department</name>
        <identificationCode>
          <value>R000</value>
          <scheme>NHSORGANISATIONS</scheme>
        </identificationCode>
      </Provider>
      <OrderCategory>2</OrderCategory>
      <Status>S</Status>
      <LastStatusDate>20040630101622</LastStatusDate>
      <sample>
        <refid>582</refid>
        <description>[Radiology]</description>
        <sampleCompletionTime/>
      </sample>
      <testOrder>
        <refid>711</refid>
        <sample>
          <refid>582</refid>
        </sample>
        <testDescription>Chest X Ray</testDescription>
        <code>
          <value>CHEST X RA</value>
          <scheme>LOCAL</scheme>
          <term>Chest X Ray</term>
        </code>
        <Status>S</Status>
        <LastStatusDate>20040630101622</LastStatusDate>
      </testOrder>
    </orderBatch>
    <orderBatch>
      <refid>1</refid>
      <guid>27bf72e0-ca76-11d8-9318-0060670781fd</guid>
      <orderReference>0000000422</orderReference>
      <Provider>
        <name>County Microbiology Labs</name>
        <identificationCode>
          <value>M000</value>
          <scheme>NHSORGANISATIONS</scheme>
        </identificationCode>
      </Provider>
      <OrderCategory>1</OrderCategory>
      <Status>D</Status>
      <LastStatusDate>20040630101641</LastStatusDate>
      <sample>
        <refid>583</refid>
        <description>Purple cap EDTA 4.5ml</description>
        <sampleCompletionTime/>
      </sample>
      <testOrder>
        <refid>712</refid>
        <sample>
          <refid>583</refid>
        </sample>
        <testDescription>Malarial parasites</testDescription>
        <code>
          <value>MALARIAL P</value>
          <scheme>LOCAL</scheme>
          <term>Malarial parasites</term>
        </code>
        <Status>D</Status>
        <LastStatusDate>20040630101640</LastStatusDate>
      </testOrder>
    </orderBatch>
  </orderHeader>
</onlineOrder>

---

Action definitions

Name	Description
OrderTest	Create a new request for a specified patient.
UpdateTest	Add or remove tests from an existing request.
PatientSampleQueue	Amend sample information for an existing request.
PatientRequestList	List incomplete requests for a specified patient; selecting a request allows amendment of sample information.
LocationSampleQueue	List incomplete requests for a practice; selecting a request allows addition/editing of sample information.
PatientReport	Read‑only view of an existing request. No data is returned to the calling application.
PatientReportList	List all requests for a specified patient; opening a request gives a read‑only view. No data returned to the calling application.
LocationReportList	List all requests for a specified practice; opening a request gives a read‑only view. No data returned to the calling application.

---

Terminology

Item	Description
Request	One or more tests ordered by a practice user for a patient relating to one or more samples; may be processed by one or more lab locations.
Test/Orderable	A service provided by the lab (for example, blood test, x‑ray).
Order batch	Subset of a request: tests for a particular lab location.
Lab Location	Place where tests are performed (for example, Pathology Laboratory, Radiology department).
Practice	A surgery configured within the requesting system by the laboratory to avail its services.
Practice User	An individual within the practice authorised to access/request services through the requesting system. The login name matches the PMS login.
Request Status	Complete (submitted to the laboratory; immutable) or Incomplete (may be modified later).
PMS	Practice Management System – a system launching an OLTR system.
OLTR	Online Test Requesting.
OLTR System	A system launched by a PMS to handle electronic requesting of tests.

---