OpenAI connected ChatGPT Health to Epic Systems on September 1, embedding AI directly inside the EHR platform that runs clinical operations at roughly 40% of US hospitals and holds records on 325 million patients. This is not a health app launch. It is a platform move — OpenAI inserted itself as the ambient AI layer between clinicians and their patient data, without requiring doctors to switch tools.
What Actually Shipped #
The integration operates in two modes. In the first, clinicians pull authorized patient context from Epic — appointment notes, lab results, medications, specialist documentation — into a ChatGPT conversation. In the second, ChatGPT is embedded directly inside the Epic EHR interface, eliminating context-switching entirely. The connection is read-only in both modes. ChatGPT cannot write to the chart, place orders, or alter clinical documentation.
Alongside the Epic connector, OpenAI launched a Healthcare Public Data plugin tying ChatGPT to nine official datasets simultaneously: PubMed, ClinicalTrials.gov, CMS Coverage, DailyMed, openFDA, RxNorm, Medicare Care Compare, and two additional government sources. A physician can cross-reference drug interactions against DailyMed and check relevant clinical trials without ever leaving the patient chart.
The Access Tax #
None of this is available to organizations that have not done the compliance work. Three requirements apply before any Protected Health Information can touch ChatGPT. First, a signed Business Associate Agreement with OpenAI — without one, HIPAA prohibits using patient data in the system. Second, a ChatGPT Work or Enterprise subscription — the free tier does not qualify. Third, organizational approval from the hospital itself: Epic controls which applications can connect via its FHIR APIs, and health system administrators must explicitly authorize the connection.
OpenAI validated safety with physicians across 4,363 ratings spanning 27 clinical use cases: 99.1% rated safe, 93% or higher rated accurate. That sounds reassuring until you run the math — roughly 39 of those evaluations came back problematic. In software, that is noise. In clinical medicine, that is someone’s medication contraindication getting missed.
Who Gets Hurt #
Every startup that built its product around AI-assisted patient record retrieval is now competing with a ChatGPT bundle. Hospital CIOs have a new default answer when smaller vendors pitch — “we’ll wait and see what Epic plus OpenAI does next.” That is not a rejection; it is indefinite postponement, which is functionally the same for a company burning runway.
The $1.6 billion invested in specialized ambient documentation tools — Abridge, Ambience, Suki, Heidi — is safer. Read-only access does not touch their core value: AI that listens while clinicians talk and writes the note afterward. Prior authorization, clinical coding, and longitudinal patient monitoring also remain open territory. According to TechCrunch, OpenEvidence — the physician-focused AI that raised $250M at a $12B valuation in January — has insulation through specialty-specific depth and FHIR-native integrations that general-purpose ChatGPT does not replicate.
The Privacy Question Has Not Closed #
OpenAI’s BAA covers US HIPAA compliance at the institutional level. It does not cover international deployments. India has no equivalent to HIPAA’s statutory protections. Patient records flowing through OpenAI’s infrastructure under a US BAA carry no designated legal protection in most of the world’s healthcare markets. Two pending lawsuits against OpenAI predate this integration — both involve allegedly dangerous medical outputs. The BAA limits institutional liability. It does not constrain what the model tells a physician who acts on its output.
What Comes Next #
This integration is the template, not the endpoint. Google DeepMind and Anthropic both have the model capabilities and enterprise relationships to build equivalent EHR connectors. Write-access — ambient documentation, prior authorization, clinical coding — is the obvious next frontier, and the one that will genuinely restructure clinical workflows. Federal regulators at CMS and HHS are watching; how AI-assisted care gets reimbursed will determine whether these integrations deepen or stall.
Developers building in healthcare now have a clearer picture of what OpenAI controls: the read layer inside Epic, connected to nine public datasets, available to organizations willing to sign a BAA and pay for Enterprise. The write layer, specialty depth, and longitudinal monitoring remain open. For the moment.