Hi Steve,
Thanks for the quick reply. Based om my experience I think it would be good to allow three types of URL authentication:
1 - sending username/password in the payload of a post message.
2 - sending username/password as get parameter
3 - using integrated windows authentication
The first two options are by no means secure but are typically the best you can achieve in a "heterogeneous" IT environment hospitals are. The third option is good from a security point of view but not all "calling" applications will be able to support it.
With his range of options I guess you can handle 99% of the integration needs.
Another often asked request is that while invoking the application through a URL the user should not be allowed to navigate outside the context of the URL parameters.
I hope you'll find this useful.
Best regards,
Andries