Every data call to the methods in ConnectToiHealthlabs.cs depend on the access token being in HttpContext.Session. What if an application wanted to store the key in a database? What if it wasn't a web app at all but a mobile app that was using a shared credential obtained from a web app?
My suggestion for a quick fix would be to pass in a string in that parameter list instead.