Yes, it's absolutely possible for a SMART app to both read from and write to an external repository. For example, reading configuration options or decision support rules maintained outside the EHR or storing information in a clinical study or claims system that's outside the EHR. Obviously you'd need to understand what an application did and be comfortable with what data was being accessed and stored and how that information was protected before enabling the SMART app within your environment.
One thing slips from my mind, can SMART app connect to another third-party server to get additional data, not originally submitted by the initiator? I do not see what can prevent it, at the same time I have not seen such use cases as well.
Kick-off meeting for SMART on FHIR and CDS Hooks today
Twitter