Home›Healthcare›Epic EHR AI Integration

Epic EHR AI Integration: App Orchard, FHIR R4 APIs, and Accessing Epic's 250M+ Patient Records

Published February 25, 2026Reading time ~11 minCategory Healthcare AI

Epic Systems serves over 250 million patients in the United States — approximately 78% of the country's healthcare data flows through Epic's EHR platform. For AI vendors seeking to integrate with healthcare organizations, Epic integration is not optional; it is the primary integration pathway for the majority of large health systems, academic medical centers, and growing numbers of community hospitals and physician practices. Epic's integration ecosystem — App Orchard for third-party applications and SMART on FHIR for API access — provides the framework for compliant AI integration.

250M+
Patient records in Epic EHR systems (Epic Systems Corporation data)

Epic's own figures indicate over 250 million patient records across its deployed installations, representing a dominant share of U.S. healthcare data. Epic serves approximately 2,000+ healthcare organizations, including 27 of the 31 U.S. News Top Hospitals. Any AI platform that cannot demonstrate Epic integration capability is effectively excluded from the large health system market.

Epic App Orchard and SMART on FHIR Integration Requirements

Epic's Third-Party AI Integration Ecosystem
App Orchard
Epic's marketplace for third-party applications — AI vendors must apply, be reviewed, and be listed to gain broad Epic customer access
SMART on FHIR
OAuth 2.0 + FHIR R4 API standard used for Epic integrations — enables granular scope-based access control
Certified Scopes
AI applications must request minimum necessary FHIR scopes — Epic enforces scope limitations at the API level
MyChart
Epic's patient portal — AI patient communication can integrate via MyChart patient messaging APIs
Hyperspace
Epic's clinical interface — AI clinical decision support can surface within Epic Hyperspace via CDS Hooks

FHIR R4 API Integration for Epic

Epic's FHIR R4 APIs provide standardized access to patient clinical data. Key FHIR resources available through Epic APIs for AI integration:

Epic Scope Minimization Requirement: Epic's API governance requires applications to request only the minimum necessary FHIR scopes for their function. AI scheduling tools should not request clinical scopes (Condition, DocumentReference, MedicationRequest) unless the clinical data is required for the scheduling workflow. Requesting overly broad scopes is a basis for Epic App Orchard rejection and a HIPAA minimum necessary violation.

HIPAA Compliance for Epic AI Integrations

Epic AI integrations must maintain HIPAA compliance throughout the data access chain. Key considerations: OAuth tokens generated through SMART on FHIR are short-lived (typically 15-30 minutes) and should be discarded after session completion — not stored in AI vendor databases. AI must not cache Epic patient data beyond session needs. Audit logs of API calls to Epic are generated in the Epic audit system — AI vendor audit logs must be reconcilable with Epic audit trails in the event of an OCR investigation.

Compliance Checklist

Epic EHR AI Integration — Key Requirements

1

Epic App Orchard Application
AI vendors integrating with Epic at customer sites should apply for Epic App Orchard listing — this streamlines the integration approval process for Epic customers. App Orchard requires security review, integration testing, and customer reference documentation.

2

SMART on FHIR OAuth Implementation
Implement SMART on FHIR OAuth 2.0 correctly — use authorization code flow, not client credentials, for patient-facing applications. Request minimum necessary scopes. Implement token refresh correctly. Do not store bearer tokens beyond session expiration.

3

Epic Sandbox Testing
Use Epic's FHIR sandbox environment (open.epic.com) for development and testing before connecting to production Epic environments. Epic provides synthetic patient data for API testing without involving real PHI.

4

CDS Hooks for Clinical Integration
If the AI surfaces recommendations within Epic Hyperspace, implement CDS Hooks (Clinical Decision Support Hooks) specification. CDS Hooks allows AI to provide recommendations at defined decision points in the Epic clinical workflow — order entry, patient chart opening, appointment scheduling.

5

MyChart API for Patient Communication
AI patient communication can integrate with Epic MyChart via the MyChart patient messaging API. Messages sent through MyChart are HIPAA-compliant by default. Verify message threading, notification, and response routing with the Epic implementation team.

6

Epic Upgrade Compatibility
Epic releases major updates twice annually. AI integrations must be tested against Epic upgrade versions before deployment. Coordinate with the healthcare organization's Epic team to schedule integration testing during upgrade validation windows.

Frequently Asked Questions

What is Epic App Orchard and how does AI get listed?
App Orchard is Epic's marketplace for third-party applications that integrate with Epic EHR. To be listed, AI vendors must apply through the App Orchard program, complete Epic's security and integration review process, provide customer references, and maintain an active integration that passes Epic's technical review. App Orchard listing gives AI vendors visibility to Epic's 2,000+ customer organizations and streamlines the integration approval process for new customers.
How does SMART on FHIR work for Epic AI integration?
SMART on FHIR is an open standard that combines OAuth 2.0 for authorization with HL7 FHIR for data access. For Epic, SMART on FHIR allows AI applications to request specific FHIR resource access scopes, authenticate using OAuth 2.0, receive short-lived bearer tokens for API calls, and access only the patient data within the authorized scopes. Epic enforces scope limitations at the API level — AI cannot access data outside its authorized scopes regardless of application code.
What FHIR scopes does scheduling AI need from Epic?
Scheduling AI typically needs: patient/Patient.read (patient demographics), patient/Appointment.read (view existing appointments), patient/Appointment.write (create/modify appointments), and patient/Coverage.read (insurance verification). Clinical scopes (Condition, MedicationRequest, DocumentReference) should only be requested if the scheduling workflow specifically requires clinical data. Minimum necessary scope selection is both a HIPAA requirement and an Epic App Orchard requirement.
How should AI handle Epic OAuth tokens?
Epic SMART on FHIR tokens are short-lived (Epic default: 15-30 minutes) and should be treated as session credentials, not persistent credentials. AI must: (1) Use the token only for the duration of the patient interaction; (2) Not store the token beyond session expiration; (3) Implement token refresh using the refresh token for long sessions; (4) Discard tokens at session completion; (5) Never store tokens in databases or logs. Long-lived API tokens are a HIPAA security risk and not appropriate for patient-facing AI integrations.
What is the Epic upgrade testing requirement for AI integrations?
Epic releases two major upgrades annually (typically spring and fall). AI integrations must be tested against the new Epic version before the customer's upgrade date. Epic provides advance release notes and sandbox environments for upgrade testing. AI vendors should establish formal Epic upgrade testing processes with their healthcare organization customers to ensure integration continuity after each upgrade.

Integrate AI with Epic in Weeks, Not Months

Claire is built on FHIR R4 APIs with Epic App Orchard compatibility — providing healthcare organizations a proven integration path that meets Epic's security requirements and HIPAA compliance standards.

Book a DemoSee How It Works