Minimum bar: support patient/
scopes (e.g., patient/ExplanationOfBenefit.read
),
and authorize the app for each patient record. So here at authz time,
e.g., scope=launch/patient patient/ExplanationOfBenefit.read patient/Coverage.read ...
e.g., scope=launch/patient patient/*.read
Beyond the minumum, a server can support user-level scopes ("do you want to share all the records you have access to with the following app"...)