Patient-Owned Health Data. Connected. Augmentable. AI-Ready.
The 21st Century Cures Act gave every patient a legal right to their complete health record, and over 45,000 providers now offer single-patient exports. The transport problem is largely solved. But access is not the same as usability: what arrives is a raw FHIR bundle, a sprawling C-CDA archive, or an unstructured PDF, formats engineered for institution-to-institution exchange, not for a patient managing a chronic condition across five providers. FHIR is an exceptional shipping container, but it does not deliver usable, readable, or actionable information to patients. Cascade Bridge does.
Patients face three distinct barriers: Collecting data scattered across providers, portals, and devices; Connecting those fragments into a single, deduplicated, computable picture; and Controlling that data, augmenting it, sharing it selectively, and reasoning over it with AI they can trust.
A universal receiver. EHI exports from any FHIR or C-CDA system, PDFs and scans, wearable streams, and self-reported data flow into one encrypted, patient-owned pod. No format is rejected. No data is left behind.
Every record becomes RDF, anchored to the same SNOMED CT, LOINC, and RxNorm codes the source systems already use. The reconcile engine deduplicates, fuses overlapping observations, and surfaces conflicts with provenance and trust ranking.
Explore your record organized by meaning. Correct it without erasing the source. Ask on-device AI questions and get answers with citations. Share selectively through a health wallet. Your data, your terms.
Cascade Bridge is a reference application, built on the open-source Cascade Protocol, that closes these gaps. It ingests all types of clinical and wellness data, EHI exports from any FHIR or C-CDA system, PDFs, wearable streams, and self-reported data, and produces a navigable, semantically linked, locally encrypted health knowledge graph with complete provenance tracking. The result is a health record patients can actually use: explore, augment, query with AI, and share selectively, with every fact traceable to its source.
A 45-year-old project manager whose complete health story exists in seven different places. None of them talk to each other.
Priya's mother had ovarian cancer at 51. Two years ago, a consumer genetic test reported that Priya carries a BRCA2 Variant of Uncertain Significance. Today she manages cancer surveillance through her oncologist, sees a primary care doctor in a different health system, works with a behavioral health therapist, and tracks daily metrics on her Apple Watch. Her 18-year-old daughter Maya has never been tested. Her oncologist's portal speaks SMART on FHIR. Her primary care system only offers C-CDA XML. The genetic counseling clinic mailed a 12-page PDF. Her behavioral health practice prints discharge summaries on paper. The Cures Act gave her the legal right to all of it, but the uneven implementation across providers makes assembly nearly impossible. The rest of this page follows Priya's data through Collect, Connect, and Control.
Priya has tried to pull her records together. Her oncologist's portal supports SMART on FHIR, so she can download a clean FHIR R4 bundle. Her primary care system only offers C-CDA XML. The genetic counseling clinic mailed her a 12-page PDF. Her behavioral health practice will not share electronically at all, and prints discharge summaries on paper. Her Apple Watch streams to HealthKit, her supplement diary lives in a third-party app, and her email holds a year of appointment confirmations she has never aggregated. The Cures Act gave her the legal right to all of it, but the uneven implementation across providers makes assembly nearly impossible.
Some systems, like her oncologist's, offer rich, well-formed bundles; others emit partial exports. And even a complete bundle describes more than it delivers. Scans, faxes, and PDFs appear as DocumentReference resources, but the binary content lives behind the provider's authentication layer. When Apple Health pulled Priya's EHI export, the references arrived, but the content did not. Wearable and patient-generated data (supplements, symptoms, daily metrics) can be expressed in FHIR, but EHRs rarely ingest it, so it stays in separate silos the bundle never touches.
Cascade Bridge is a universal receiver. One tap connects to 800+ health systems through Apple Health's SMART on FHIR integration. C-CDA archives import natively through an 11-section handler with Epic and Cerner normalization. PDFs and scans are parsed by on-device AI and tagged cascade:AIExtracted, so their provenance is visible at every later step. Apple Watch streams, supplements, and self-reports flow into the same encrypted, patient-owned pod. And for patients who don't remember every provider, on-device AI can scan email for appointment confirmations and billing notices to surface sources they may have missed.
Cascade Bridge accepts any health data, from any source. No format is rejected. No data is left behind.
Priya's records are finally in one place, and they immediately fight each other. Her primary care bundle lists her tamoxifen as active. Her recent surgical discharge says it was stopped. Her oncologist references a different dose. Two C-CDA exports from a single portal yield thousands of duplicated labs. Each individual file is internally consistent. Together, they are noise.
FHIR is a hierarchical document tree designed for institutional exchange. Its human-readable text is trapped inside isolated JSON objects, which is fine for transport but poor for cross-source reasoning. Any application that wants to merge Priya's seven records must implement custom reconciliation logic, typically dozens of nested SQL JOINs against shredded FHIR tables, or fragile GraphQL layers, and every downstream app must reinvent it. There is no shared, computable representation of "Priya, the patient," only seven versions of her record, each stamped by a different system.
This is where the RDF (Resource Description Framework) knowledge graph enters. RDF is a mature W3C standard built for interoperability and for reasoning. Cascade Bridge translates every FHIR resource, C-CDA section, PDF extract, and wearable observation into RDF triples (subject, predicate, object), anchored to the same SNOMED CT, LOINC, and RxNorm codes the source systems already use. The cascade reconcile engine deduplicates labs by LOINC code, fuses overlapping observations, and validates the graph against SHACL shapes. When it hits the tamoxifen conflict it does not silently overwrite: it creates a cascade:ConflictDetail node that preserves both records, tags each with provenance (the oncologist, the primary care system, the discharge bundle), ranks them by trust, and surfaces the conflict for Priya to review.
Every fact says exactly where it came from and what it means: one canonical, deduplicated, computable representation of Priya's health, ready for reasoning and AI.
Control is where Cascade Bridge unlocks experiences that are fundamentally impossible with static EHI exports. This is where Priya's legal right to access her data becomes truly actionable.
Priya notices her primary care record still lists a medication she stopped a year ago. She marks it inactive, but Cascade Bridge does not erase the EHR's original assertion. It records her correction with prov:wasDerivedFrom linking back to the source fact, with full provenance. Authority is preserved; her record finally matches her life.
Priya asks her on-device AI, "Why did my LDL spike this year?" The AI traverses the graph, sees that her statin was paused during her surgery, correlates the timing with the lab trend, and answers with explicit citations to the exact lab results, the medication-hold record, and the discharge note. Every claim is reconstructible down to its originating EHI export.
Two years ago, Priya's BRCA2 variant was classified as a Variant of Uncertain Significance. In a typical portal, that PDF would gather digital dust forever. This morning, an international clinical consortium published an advisory:CascadeAdvisoryPatch that reclassifies her exact variant from VUS to Pathogenic. Because her data lives in a graph rather than a static file, Cascade Bridge ingests the patch, traverses her genomics:PedigreeMember relationships, and surfaces a plain-language alert about the impact on her and her daughter Maya. Her agent automatically books an appointment with a genetic counselor for next week.
Before the appointment, the clinic sends a SMART Health Check-in request, a wallet-mediated request for specific items: insurance, demographics, current medications, family history, the BRCA2 variant report, and an intake questionnaire. Priya opens it on her phone. Acting as her health wallet, Cascade Bridge shows her exactly what each item will share. She approves family history and the BRCA2 variant, and declines her behavioral health record as not relevant to this visit. The intake questionnaire is pre-populated from her graph; she reviews and signs. The clinic receives a structured, signed, encrypted response, and the counselor sees Priya's pedigree and current variant interpretation before she even walks in.
The same Collect, Connect, Control workflow as designed for the Cascade Bridge iOS app. These are annotated screens from the product design.
Most health apps treat interoperability as a data transport problem. Cascade Bridge treats it as a knowledge representation problem. It does not replace FHIR; it is the AI-ready downstream consumer of it, upgrading the bundles a provider already exports into a patient-owned reasoning graph that local AI agents can actually understand.
Cascade Bridge stores every fact as a linked statement in RDF, the same W3C standard that powers knowledge graphs at Google, Wikipedia, and Wikidata. On top of it, the Cascade Protocol composes a three-layer vocabulary.
Layer 1, Established Standards. Imports raw, immutable clinical codes (SNOMED CT, LOINC, RxNorm, ICD-10) exactly as the source system exported them. Cascade never invents codes for concepts that standard terminologies already classify, and patient outputs share back in those same canonical codes.
Layer 2, Cascade Domain Context. Resolves conflicts and enforces provenance. Every raw code is wrapped with where it came from, when it arrived, and how trustworthy it is, and disparate data points (a medication, a lab, a symptom, a wearable reading) are linked so the graph captures the patient's story, not the institution's filing system.
Layer 3, Patient-Facing Translation. Produces plain-language summaries, condition-specific dashboards, and visit-prep templates, turning opaque codes into something a patient can understand and act on, without ever severing the chain back to Layer 1. It is what lets a focused app like POTS Check share the same foundation as cancer surveillance or genomic counseling.
Consider another patient, Alex Rivera. He is prescribed lisinopril (an ACE inhibitor), self-reports an over-the-counter potassium supplement, and has a recent lab showing potassium at 5.1 mEq/L. Three sources, three silos, one severe hyperkalemia risk, invisible unless something stitches them together. In Cascade's graph it is one traversal, and the interactive graph below visualizes Alex's exact case.
| Subject | Predicate | Object | Layer |
|---|---|---|---|
| Lisinopril Rx | clinical:rxNormCode | rxnorm:314076 | 1 |
| Lisinopril Rx | clinical:therapeuticClass | "ACE Inhibitor" | 2 |
| Lisinopril Rx | cascade:dataProvenance | cascade:EHRVerified | 2 |
| K+ supplement | cascade:dataProvenance | cascade:SelfReported | 2 |
| K+ lab result | health:resultValue | "5.1 mEq/L" | 1 |
| K+ lab result | health:interpretation | "HIGH" | 2 |
| Visit prep summary | checkup:flaggedRisk | "K+/ACE interaction" | 3 |
No SQL JOIN gymnastics, no per-application reconciliation logic. The interactive 3D health graph visualizes this exact interaction.
It would be dangerous for an AI agent to confuse a heart-rate reading from a Fitbit with one from an ICU monitor. In raw FHIR, the Provenance resource is optional and frequently omitted. In the Cascade Protocol, provenance is non-negotiable.
Every record must carry a cascade:dataProvenance tag or it fails SHACL validation. Apple Watch readings are DeviceGenerated; EHR labs are ClinicalGenerated; a symptom diary is SelfReported; a consortium update is ConsortiumAdvisory.
Every record entering a pod is checked against a SHACL shape: required fields, value ranges, mandatory provenance, cardinality, datatypes. A malformed or unattributed record is rejected at the boundary, not discovered later.
Every AI citation is a live URI pointing back to the source triple. A reviewing clinician can follow the chain back to the original FHIR or C-CDA record in one click. This is the explainability that healthcare demands.
Cascade Bridge follows an "established vocabularies first" principle. Rather than asking providers to change their systems, it ingests the formats they already export and anchors every fact to FHIR, LOINC, SNOMED CT, RxNorm, and PROV-O before introducing any Cascade-specific term.
| Standard | Version | Cascade implementation |
|---|---|---|
| FHIR | R4 | Lossless conversion; 0% silent drops (vs. 47.7% baseline) |
| HL7 C-CDA | v2.1 | Native converter; 11 section handlers; Epic + Cerner normalization |
| US Core IG | v6 | Full profile conformance; required terminologies preserved on import |
| SMART App Launch | v2 | Apple Health bridge + direct EHR authorization |
| W3C PROV-O | 1.0 | Six-level provenance taxonomy; every record carries its lineage |
| W3C RDF (+ SHACL + OWL) | 1.1 / 1.0 / 2.0 | Knowledge graph foundation in Turtle; shape validation and formal semantics |
| Solid Protocol | 0.9 | Patient-owned pod storage; WebID access control |
Patient data is encrypted at rest with AES-256-GCM, with keys in the device's hardware-backed Secure Enclave. There is no centralized server to breach and no operator with administrative access. Because Cascade Bridge receives data through patient-directed access, it is neither a covered entity nor a business associate under HIPAA; the applicable rule is the FTC Health Breach Notification Rule, and NIST-standard encryption qualifies the data as "secured." The architecture is built for the direction of the ONC HTI-5 proposed rule, which continues to recognize patient-directed AI agents as legitimate actors, and it is USCDI v7 ready: new data elements map to the existing vocabulary with no schema revision required.
Cascade Bridge is not a theoretical architecture. The core pipeline already runs in production, and the protocol underneath it is open: SDKs, a CLI, and a published specification that any team can build on.
A production iOS and watchOS app built entirely on the Cascade Protocol Swift SDK, with encrypted pod storage and provenance-tracked results.
The cascade CLI and agent perform multi-source reconciliation with on-device AI, available now on npm.
TypeScript, Python, and Swift SDKs plus the full protocol specification are published and documented on this site.
The unified iOS experience and the production SMART Health Check-in wallet bring Collect, Connect, and Control together in one place.
Cascade Bridge is the reference application. The protocol beneath it is open, and every new app inherits the full Collect-Connect-Control stack, authoring only the Layer 3 vocabulary it needs.
View Documentation Read the EHIgnite narrative