OpenAI says ChatGPT Health now has an integration with Epic that gives clinicians read-only access to patient health records. According to TechCrunch, the connection allows clinicians to import patient data into ChatGPT Health; it does not mean ChatGPT can write back to Epic records.
For independent practices, specialty clinics, and other smaller healthcare organizations using Epic, this is worth watching. It signals that AI tools are moving closer to the systems where staff do their real work—but proximity to patient data raises the bar for evaluation, privacy, and oversight.
Why business owners should care
A clinician’s day is full of information gathering: reviewing history, medications, lab results, notes, referrals, and patient messages. A read-only connection could make it easier to bring relevant context into an AI-assisted workflow without manually copying details between systems. That potential is meaningful, especially for small teams trying to reduce administrative drag while preserving time for patients.
But an integration is not the same as a safe, useful workflow. The source says OpenAI provides read-only access to health records for clinicians. It does not establish that every Epic customer can use the feature immediately, that every type of patient data is included, or that the tool is appropriate for every clinical task. Those details matter.
There is also a crucial distinction between helping staff organize or summarize information and making clinical decisions. An AI-generated summary can omit context, misunderstand a record, or state something incorrectly. Clinicians remain responsible for reviewing information and using their professional judgment. Small organizations should not treat an AI connection as an autopilot for care, documentation, billing, or patient communication.
If your organization is earlier in its AI journey, start with lower-risk operational work before connecting tools to sensitive records. Our overview of AI-powered transcription for business workflows explains why clear review steps and data-handling rules matter even when the task seems straightforward.
What to watch before adopting an EHR-connected AI tool
1. Confirm exactly what data moves and who can access it
Ask vendors and your internal IT or compliance lead to document the data flow in plain language. Which Epic fields can be accessed? Is data retrieved only when a clinician requests it? Is it retained, logged, or used for model improvement? Which user roles can connect accounts and view results?
“Read-only” is an important limit, but it answers only one question: whether the AI tool can change the record. It does not replace a full review of privacy, security, user permissions, contracts, and your organization’s policies. Healthcare organizations should also confirm whether the proposed use fits their applicable legal and contractual obligations rather than assuming an integration settles those questions.
2. Choose one narrow, reviewable use case
Do not begin with “use AI on patient records.” Begin with a specific job where a qualified person can verify the output. For example, a clinic might test whether the tool helps a clinician prepare a concise chart-review checklist before a visit. Another possible use is drafting a nonclinical internal summary that a staff member checks against the source record.
Define what the tool may do, what it may not do, and who signs off. Avoid allowing generated output to become part of a patient record automatically unless your organization has deliberately designed, tested, and approved that workflow. The goal is to reduce repetitive effort, not to add a second system that staff cannot trust.
3. Measure value alongside risk
A pilot should have a baseline. Track a small number of practical measures, such as time spent preparing for appointments, number of corrections needed in AI output, user adoption, and whether clinicians believe the result improves their work. Collect examples of failures as seriously as examples of success.
Also create an escalation path: staff need to know what to do when an answer is inaccurate, incomplete, or unexpectedly exposes information. This is not bureaucracy for its own sake. It is how a small practice avoids turning a promising tool into a hidden operational risk.
For a structured starting point, a practical AI readiness audit for your business can help identify suitable first use cases, data boundaries, and the people who need to approve a pilot.
The PAD Take
If you use Epic, do not rush to connect an AI tool simply because the option exists. First, select one clinician-reviewed task, map the data involved, and get clear answers from your vendor and compliance stakeholders about access, retention, and permissions. Then run a limited pilot with success measures and a documented human-review step before expanding use.
