On September 1, 2026, OpenAI announced an integration with health systems running Epic EHR. Health organizations operating using Epic EHR are able to plug in patient information into ChatGPT for Healthcare.
Epic is behind the scenes for almost 40 percent of hospitals in the United States and keeps records of over 325 million patients. Thus, this solution covers a large part of the US healthcare system.
By doing this, Doctors will be able to extract patient history, including his/her notes, laboratory results, and medications.
When doing this, they can either manually add context to it or use an embedded version within Epic. The software is capable of generating summaries, synthesizing various pieces of information, and identifying any changes made since the last appointment.
Here's the limit to this - The connection is read only. ChatGPT cannot write notes back into Epic, place orders, or message patients directly.
Behind the scenes, health systems set this up through FHIR-based OAuth scopes tied to a clinician's existing Epic permissions.
What Will ChatGPT's Integration with EPIC EHR Enable for Healthcare Providers
The immediate advantage for the clinician is speed. Rather than scrolling through pages of notes to figure out what happened since their last visit, a clinician can simply have ChatGPT summarize a complicated chart or provide the necessary context.
The initial health care providers testing the integration of this technology include UCSF Health, AdventHealth, Cedars-Sinai, and HCA Healthcare.
A new plugin called Healthcare Public Data was introduced by OpenAI, which connects ChatGPT with nine different public datasets, such as ClinicalTrials.gov, PubMed, RxNorm, and DailyMed. A clinician can now compare a patient's background with information on clinical trials and medications in the same conversation.
During its internal testing, the accuracy rate of the public data connectors used by ChatGPT varied between 93.2 and 98.6 percent.
Dr. Jesse Ehrenfeld, the president of the American Medical Association, sees this transformation as an inevitable one rather than an option. In his words, 'physicians who embrace artificial intelligence will displace physicians who refuse to embrace it.'
This is not to supersede clinical judgment but to lower the paperwork and hurdles between a physician and a decision.
The HIPAA and Patient Privacy Risks of ChatGPT in Healthcare
This Integration of ChatGPT with Epic would not automatically be HIPAA-compliant in itself. Honestly, it all depends on the contract and how the system is designed.
- A software application that comes into contact with protected health information or PHI is supposed to have a BAA. OpenAI’s enterprise integration with Epic runs under such a BAA. However, even a BAA is not sufficient. The platform requires that there should be no data retention at all. In this way, any prompts from a patient are never utilized for training the model underlying the service.
- The minimum necessary principle is another aspect that HIPAA imposes. Covered entities must restrict access to ePHI to only that amount of data that is absolutely needed to perform a certain task. For example, when an AI agent fetches the whole medical history of a patient for writing a simple referral letter, then it is dealing with excessive information.
- It is important to pay attention to access controls, as well. Permissions and single sign-on determine who can access a system, but they are silent about the processing of PHI by a machine learning algorithm.
- Third-party connections widen that gap. When public datasets, plugins, or shared drives sit in the same AI workspace as patient records, the boundary between trusted and untrusted content gets blurry. A malicious instruction buried in an external document can end up processed by the same model handling a patient's chart.
- Shadow AI is a related and growing risk. When a clinician pastes patient notes into a personal, consumer ChatGPT account instead of the enterprise tool, they bypass the BAA entirely and trigger a HIPAA violation, often without realizing it.
HHS has been direct about what it expects from covered entities. The agency stresses proactive risk analysis and documented safeguards for ePHI, not compliance measures adopted only after a breach.
How Agentic AI Can Automate Clinical and Administrative Workflows
ChatGPT's Epic integration is read only, but the broader industry is already moving toward agentic AI.
These are systems that do not just retrieve information, they act on it, under human supervision. Instead of summarizing a chart, an agentic system can update it, schedule around it, and follow up on it.
Here is where that shift is having the biggest impact:
- Ambient clinical documentation: AI scribes listen during the appointment and draft the note automatically. The Permanente Medical Group reported saving over 15,700 clinical hours using ambient AI scribes across 2.5 million encounters.
- Patient history retrieval: Agents pull scattered notes, labs, and specialist records into one summary before an appointment even starts, cutting down on the manual chart review that eats into a clinician's day.
- Prior authorization: Manual requests take clinical staff over two hours per claim on average. Agentic systems that check eligibility, pull documentation, and submit requests through FHIR APIs can compress that down to roughly 14 minutes.
- Patient scheduling: Agents can check the clinical prerequisites for a test, sync appointments in real time to avoid double bookings, and send prep instructions automatically.
- Care coordination: Automated follow-up messages notify patients when results come in, reducing the number who fall through the cracks between appointments.
The administrative case for automation is hard to ignore. Physicians and their staff spend an average of 13 hours a week on prior authorization alone, across nearly 39 requests per physician.
Using Thunai On-Prem for Complete HIPAA-Compliant and Secure Automation Workflows
The risks above point to one conclusion. Healthcare AI needs guardrails built into the architecture, not added on afterward.
Thunai AI for healthcare can deploy on-premises, built specifically for this use case, where deployment happens in a health system’s own infrastructure, rather than a multi-tenant cloud one.
- EHR and API connectivity: Direct, bi-directional connections to Epic, Cerner, and athenahealth systems, enabling two-way data flows in a governed way rather than just reading the data..
- Role-based access: Everyone, human and agent, works with permissions aligned with the clinical role of the individual.
- Least-privilege permissions: Each system gets the exact data that is needed, satisfying HIPAA’s requirement for the minimum necessary standard.
- Data isolation: Patient-level data remains in the health system’s own environment, rather than in a multi-tenant cloud setting.
- Audit trails: Everything that is requested, retrieved, and acted on is auditable in terms of compliance and incident response.
Want to know how? Reach out to the team at Thunai to know more!
