Written and maintained by CASRAI Editorial Board
Last updated
Clinical informatics engineers, hospital data architects, and research software developers integrating with Cerner EHR—now operated as Oracle Health following Oracle Corporation’s 2022 acquisition of Cerner—work across two complementary architectural layers: the real-time transactional Cerner Millennium Electronic Health Record and the cloud-based HealtheIntent longitudinal population health platform. Understanding how Millennium stores clinical events inside a unified relational database, how analysts extract research cohorts using Cerner Command Language (CCL), and how third-party apps launch inside PowerChart via Ignite APIs for Millennium (SMART on FHIR) is essential for enterprise health IT engineering.
How Is the Oracle Health (Cerner Millennium) EHR Architected?
Unlike hierarchical database EHR architectures (such as Epic Systems, which separates its real-time Chronicles operational database from its nightly relational Clarity reporting warehouse), Cerner Millennium was designed from inception around a single, person-centric relational database schema (historically called the Healthone Neutral Architecture, or HNA) running directly on an Oracle Relational Database Management System (RDBMS).
As examined in our comparison of Epic vs. Oracle Health (Cerner), Millennium unifies acute inpatient, ambulatory, emergency, perioperative, laboratory, and radiology modules on top of shared relational tables:
| Millennium Component / Module | Primary Clinical or Technical Role | Core Relational Tables & Data Artifacts |
|---|---|---|
| PowerChart | Primary clinician desktop user interface for inpatient and ambulatory charting, Computerized Provider Order Entry (CPOE), flowsheet documentation, and results review. | PERSON, ENCOUNTER, ORDERS, CLINICAL_EVENT, PROBLEM, DIAGNOSIS |
| FirstNet & SurgiNet | Specialized acute modules for Emergency Department tracking/triage (FirstNet) and perioperative/anesthesia documentation (SurgiNet). | ENCOUNTER, SURGICAL_CASE, PERIOPERATIVE_DOCUMENT |
| PathNet & RadNet | Integrated Laboratory Information System (PathNet—general lab, microbiology, anatomic pathology, blood bank) and Radiology Information System (RadNet). | ORDER_LABORATORY, RESULT, CLINICAL_EVENT |
| Discern Expert | Event-driven Clinical Decision Support (CDS) rules engine executing synchronous and asynchronous alerts inside PowerChart using an Evoke → Logic → Action architecture. | EKS_MODULE, EKS_DLG_EVENT, plus external HL7 CDS Hooks endpoints |
| MPages (Millennium Pages) | Customizable HTML5/JavaScript clinical summary views and specialty dashboards embedded directly inside a PowerChart tab, hydrated by backend CCL scripts or FHIR APIs. | Custom JSON/XML payloads returned by Discern Explorer (CCL) programs |
| HealtheIntent | Cloud-scale population health and longitudinal data platform that ingests, deduplicates, and normalizes multi-EHR clinical feeds and payer claims for quality reporting (eCQMs) and real-world evidence research. | Normalized longitudinal patient record and Oracle Health Learning Health Network (LHN) de-identified research cohorts |
The Role of Reference Code Sets (`CODE_VALUE`) in Millennium
A defining architectural feature of Cerner Millennium is its universal use of numeric Code Values (`CODE_VALUE` table) organized into numbered Code Sets (`CODE_SET`). Rather than storing text strings for encounter types, order statuses, lab assays, or units of measure across transactional rows, Millennium stores a foreign key (`_CD`, such as `CATALOG_CD`, `EVENT_CD`, `ENCNTR_TYPE_CD`, or `ORDER_STATUS_CD`) that references `CODE_VALUE`. For example:
- Code Set 71 (`ENCNTR_TYPE_CD`): Classifies encounter types (Inpatient, Outpatient, Emergency, Observation).
- Code Set 72 (`EVENT_CD`): Identifies individual clinical observation events stored in `CLINICAL_EVENT` (vital signs, laboratory analytes, nursing flowsheet rows, and clinical notes).
- Code Set 200 (`CATALOG_CD`): Defines the master orderable catalog for medications, laboratory tests, and diagnostic imaging.
- Code Set 6004 (`ORDER_STATUS_CD`): Tracks order lifecycle states (Ordered, In-Process, Completed, Canceled, Discontinued).
What Is Cerner Command Language (CCL) Used for in Clinical Data Extraction?
Cerner Command Language (CCL)—authored and executed through the Discern Explorer toolset—is Oracle Health’s fourth-generation, SQL-like procedural query and report-writing language. Because Millennium’s operational data already resides in an Oracle relational schema, informatics analysts and clinical trial data managers use CCL to query live or replicated standby databases directly for operational reporting, custom MPages, and clinical research cohort identification.
A standard CCL program (`CREATE PROGRAM … GO`) combines relational `SELECT` statements with procedural report-writer blocks (`HEAD REPORT`, `HEAD`, `DETAIL`, `FOOT`, `FOOT REPORT`) and built-in functions such as `UAR_GET_CODE_BY()` (User Access Routine to resolve a display key or CDF meaning into its site-specific numeric `CODE_VALUE`) and `UAR_GET_CODE_DISPLAY()` (to translate a numeric `_CD` back into human-readable text):
DROP PROGRAM cr_active_inpatient_labs:dba GO
CREATE PROGRAM cr_active_inpatient_labs:dba
PROMPT "Output to File/Printer/MINE" = "MINE"
WITH OUTDEV
; Resolve site-specific CODE_VALUEs using CDF Meanings (avoids hardcoding numeric IDs)
DECLARE dInpatientCd = f8 WITH CONSTANT(UAR_GET_CODE_BY("MEANING", 71, "INPATIENT")), PROTECT
DECLARE dAuthVerifiedCd = f8 WITH CONSTANT(UAR_GET_CODE_BY("MEANING", 8, "AUTH")), PROTECT
SELECT INTO $OUTDEV
p.person_id
, e.encntr_id
, patient_name = SUBSTRING(1, 50, p.name_full_formatted)
, event_name = UAR_GET_CODE_DISPLAY(ce.event_cd)
, result_val = SUBSTRING(1, 30, ce.result_val)
, units = UAR_GET_CODE_DISPLAY(ce.result_units_cd)
, event_dt_tm = FORMAT(ce.event_end_dt_tm, "YYYY-MM-DD HH:MM:SS;;D")
FROM
encounter e
, person p
, clinical_event ce
PLAN e
WHERE e.encntr_type_cd = dInpatientCd
AND e.active_ind = 1
AND e.disch_dt_tm = NULL
JOIN p
WHERE p.person_id = e.person_id
AND p.active_ind = 1
JOIN ce
WHERE ce.encntr_id = e.encntr_id
AND ce.result_status_cd = dAuthVerifiedCd
AND ce.valid_until_dt_tm > CNVTDATETIME(CURDATE, CURTIME3)
AND ce.view_level = 1
WITH NOCOUNTER, SEPARATOR = " ", FORMAT, TIME = 60
END
GOCritical CCL Engineering Rules for Research Extracts:
- Temporal Versioning (`valid_until_dt_tm`): In the `CLINICAL_EVENT` table, amended or corrected results create a new row while expiring the old row’s `valid_until_dt_tm`. Queries extracting current verified results must filter on `ce.valid_until_dt_tm > CNVTDATETIME(CURDATE, CURTIME3)` (or `= CNVTDATETIME(“31-DEC-2100 00:00:00”)`) and `ce.view_level = 1` to avoid pulling historical superseded rows or internal child metadata rows.
- Never Hardcode Numeric `CODE_VALUE` IDs Across Environments: Numeric `CODE_VALUE` keys differ between non-production (`CERT`/`MOCK`) and production (`PROD`) domains and across different health systems. Always resolve codes dynamically via `UAR_GET_CODE_BY(“MEANING”, code_set, cdf_meaning)` or map local codes to standard LOINC, SNOMED CT, and RxNorm terminologies.
- Query Timeout and Index Discipline (`PLAN` / `JOIN`): Because CCL queries can execute against the live transactional database or a read-only Oracle Data Guard standby node, always bound runtime with `WITH TIME = 60` and drive the query `PLAN` from indexed keys (`person_id`, `encntr_id`, `event_cd`, `clinsig_updt_dt_tm`).
How Do Developers Integrate with Cerner Ignite APIs for Millennium Using SMART on FHIR?
To support ONC 21st Century Cures Act certification (45 CFR § 170.315(g)(10)) and third-party clinical applications, Oracle Health exposes the Ignite APIs for Millennium based on HL7® FHIR® R4 (4.0.1) and the SMART App Launch Framework (OAuth 2.0 + OpenID Connect).
1. Developer Registration and Sandbox Testing
Developers register applications through the Oracle Health Developer Program (code Console), selecting one of three launch and authentication patterns:
- Provider EHR Launch (PowerChart / FirstNet Embedded): A clinician opens an MPage or chart tab inside PowerChart. Millennium passes an `iss` (FHIR server base URL) and `launch` context token to the app’s Launch URI. The app discovers the authorization and token URLs from `GET {iss}/.well-known/smart-configuration`, exchanges the code for a bearer token containing `patient`, `encounter`, and `fhirUser` claims, and renders inside the PowerChart frame.
- Patient Standalone or Portal Launch: Enables patients using the HealtheLife patient portal or third-party consumer apps to authorize read access to their USCDI clinical records (`patient/*.read`).
- System-to-System Backend Services & Bulk Data (`$export`): Uses asymmetric JSON Web Key Set (JWKS) client-assertion authentication (`system/*.read`) for backend research registries, ambient AI scribes, and population health analytics (`/$export` FHIR Bulk Data Access).
2. Core FHIR R4 Resources and Write-Back Capabilities
Ignite APIs for Millennium support both USCDI read access and clinical write-back across key FHIR R4 resources:
- Clinical & Demographic Reads: `Patient`, `Encounter`, `Condition`, `Observation` (vitals, laboratory results, social history), `MedicationRequest`, `MedicationAdministration`, `AllergyIntolerance`, `Immunization`, `Procedure`, `DiagnosticReport`, and `CarePlan`.
- Clinical Documentation Write-Back (`DocumentReference`): Third-party applications and ambient AI scribes create clinical notes in Millennium via `POST /DocumentReference` (passing XHTML or base64-encoded clinical note payloads mapped to a valid Millennium Note Type `CODE_VALUE` from Code Set 72) or retrieve raw clinical notes via the `Binary` resource.
- Health Information Exchange & HL7 v2 Coexistence: Alongside FHIR R4, Oracle Health installations exchange real-time HL7 ADT, ORM, and ORU messages via the OpenEngine interface engine and participate in national Health Information Exchange (HIE) frameworks (CommonWell Health Alliance, Carequality, and TEFCA).
Frequently Asked Questions
How is the Oracle Health (Cerner Millennium) EHR architected?
Cerner Millennium is built on a unified, person-centric relational database architecture (Healthone Neutral Architecture) running on an Oracle RDBMS. Acute inpatient, ambulatory, emergency (FirstNet), surgical (SurgiNet), laboratory (PathNet), and radiology (RadNet) workflows read and write to shared relational tables (`PERSON`, `ENCOUNTER`, `ORDERS`, `CLINICAL_EVENT`) indexed by numeric reference codes stored in the `CODE_VALUE` table, while cloud population health analytics run on HealtheIntent.
How do developers integrate with Cerner Ignite APIs for Millennium using SMART on FHIR?
Developers register their application in the Oracle Health code Console to obtain a Client ID and configure OAuth 2.0 scopes (`launch`, `openid`, `fhirUser`, `user/*.read`, `patient/*.read`, or `system/*.read`). During a PowerChart EHR launch, the app queries `/.well-known/smart-configuration` at the Millennium FHIR R4 base URL, completes the OAuth 2.0 authorization code exchange to receive active `patient` and `encounter` context, and calls FHIR R4 resources such as `Patient`, `Observation`, and `DocumentReference`.
What is Cerner Command Language (CCL) used for in clinical data extraction?
Cerner Command Language (CCL), run via Discern Explorer, is Oracle Health’s SQL-like procedural query language used to extract data directly from the Millennium relational schema, build operational and clinical trial cohort reports, execute Discern Expert clinical decision support rules, and power custom HTML/JavaScript MPages inside PowerChart.
