ChatGPT Health Integrates Epic Records for 325 Million Patients Under HIPAA Compliance

ChatGPT Health adds Epic integration for clinicians to import patient data

OpenAI said today that it is integrating ChatGPT Health with Epic's electronic health record (EHR) system, which holds data for over 325 million patients, to let clinicians import patient data and use AI to ask questions. The company said that in certain systems, it will also integrate ChatGPT directly within EHR workflows. With ChatGPT, clinicians can now access information like appointment notes, laboratory results, medications, and specialist documentation and summarize them easily. They can also look at patient history, identify changes, and prepare for future appointments. OpenAI said that in some deployments, clinicians can directly access ChatGPT for getting pre-visit review and building clinical timelines without leaving a patient chart. The company specified that the integration allows only read-only access to health records, and AI doesn't write anything back. OpenAI is also adding a new Healthcare Public Data plugin, which can fetch information from sources including ClinicalTrials.gov, CMS Coverage, RxNorm, DailyMed, and PubMed. The company said that the new plugin can help healthcare workers synthesize data for trial eligibility criteria, medication identifiers, coverage policy versions, and provider records. The company said that apart from enabling these new features, it is allowing organizations with a Business Associate Agreement to use ChatGPT Work, Codex, apps, and connectors in their workspace for compliant workflows. Last month, OpenAI rolled out ChatGPT for health to all U.S. consumers. The company said at that time that people are asking 300 million health-related queries to ChatGPT every week. Despite many deep integrations with medical systems, the company has maintained that AI is not suitable for diagnosis or treatment. OpenAI said that it collected over 4,300 responses from physicians across 27 clinical use cases, including pre-visit review, clinical timelines, medication review, and handoff summaries, and found that 99.1% of responses were safe. However, even a few unsafe answers can lead to harmful results for humans. A few days before this rollout, a Florida-based pastor sued the company, alleging that ChatGPT gave him a near-fatal recommendation. The company was also sued in May by family members of a user who blamed ChatGPT for giving wrongful advice related to dosage.

OpenAI links Epic patient records to ChatGPT under HIPAA

OpenAI has begun connecting patient records held in Epic, the largest electronic health record system in the United States, directly into ChatGPT. Clinicians at organisations that enable the integration can now ask questions such as, "What has changed since this patient's last visit?" and get an answer assembled from appointment notes, lab results, medications and specialist documentation. The announcement on September 1, 2026 also added a Healthcare Public Data plugin. It provides structured access to nine official datasets, including ClinicalTrials.gov, PubMed, RxNorm, DailyMed and Medicare coverage data. Why it matters The legal scaffolding supporting this is American. OpenAI offers a Business Associate Agreement, the contract that allows a vendor to handle protected health information under the US Health Insurance Portability and Accountability Act (HIPAA). That agreement is what makes the product usable in a hospital. India has no equivalent. There is no health-sector privacy statute and no concept of a business associate carrying direct statutory obligations. Since 2023, there has also been no legal category treating a medical record as different from any other personal data. A product built around HIPAA has nothing here to attach to. What has actually launched, and for whom Access is tiered, and the tiers matter. * ChatGPT for Healthcare customers get the Epic integration, enabled by a workspace administrator. * ChatGPT Enterprise customers can request it through their account team, as part of what OpenAI calls a Regulated Workspace. * Individual clinicians in the US get the public data plugin only. They cannot connect patient records. OpenAI's help documentation says the product is sold to large hospitals and health systems through its sales team. It does not say which countries it is available in, and MediaNama could not establish whether it is offered in India. The company says content shared with ChatGPT for Healthcare is not used to train its models. The safety number, and what it measures OpenAI says physicians reviewed more than 700,000 model responses and rated 99.1% of them safe across all use cases. It is a large evaluation and worth reading precisely. "Safe" is not the same as "accurate" or "clinically useful." A response can be safe and unhelpful. The evaluation was designed and run by the company selling the product. The methodology is not set out in the announcement: how safety was defined, who the reviewing physicians were, or how disagreements were resolved. None of that makes the figure wrong. It does mean it is a vendor's own metric, and it should be reported as one. What the agreement does not cover The Business Associate Agreement is narrower than it first appears. OpenAI's documentation states that it covers only the products and functionality listed as HIPAA-eligible. One exclusion is specific enough to matter. Improved memory, the feature that lets ChatGPT carry context between conversations, is disabled by default in these workspaces and, in OpenAI's words, "is not covered under your BAA." That is a sensible default. It also shows the wider problem with putting a general-purpose assistant into a clinical setting: the product has features that the compliance wrapper cannot accommodate, and switching them off is the customer's job. India drafted a health privacy law, then folded it into a general one The gap in India is not an oversight. It is the result of a decision. The Ministry of Health and Family Welfare drafted the Digital Information Security in Healthcare Act, known as DISHA, as a health-specific data protection law. It was never enacted. As Cyril Amarchand Mangaldas has recorded, the ministry submitted DISHA to MeitY "to be subsumed in the 'Data Protection Framework' Act to avoid duplicity of effort." That framework became the Personal Data Protection Bill, 2019. Through each of those stages, health data was treated as a category apart. The Information Technology (Reasonable Security Practices) Rules, 2011 classified it as sensitive personal data. The 2019 Bill did the same, expressly. The Digital Personal Data Protection Act, 2023 does neither. It creates no separate statutory category of sensitive personal data at all. A lab report, a psychiatric history and a browsing record sit under the same set of obligations. The Act is not silent on healthcare. It uses telemedicine and hospital scenarios in its own illustrations, and large processors face additional Significant Data Fiduciary duties, including a data protection officer and impact assessments. But the escalation is by the size of the entity, not by the sensitivity of what it holds. The remaining health-specific instrument is the Health Data Management Policy under the Ayushman Bharat Digital Mission. That is policy rather than statute, and it governs data within the ABDM ecosystem rather than the wider health economy. What this leaves unresolved For an Indian hospital weighing a product of this kind, three questions have no clear statutory answer. There is no template contract equivalent to a BAA. Liability between a hospital and an AI vendor is left to private negotiation rather than statute. There is no health-sector regulator with the standing to audit such an arrangement. And the DPDP Act's enforcement machinery is not yet fully operational, with key provisions taking effect in 2027. The clinical case, meanwhile, is real. Doctors working across fragmented records spend substantial time reconstructing a patient's history, and demand for tools that do it faster is not manufactured. The question is not whether the capability is useful. It is what happens when it arrives in a jurisdiction that decided a medical record needed no special protection. Questions MediaNama has sent to OpenAI * Is ChatGPT for Healthcare, or the Epic integration, available to customers in India? If not, is a launch planned? * Where is patient data processed and stored for customers outside the United States? * What contractual instrument is offered to customers in jurisdictions without HIPAA, and what obligations does it impose on OpenAI? * How was "safe" defined in the evaluation of 700,000 responses, who conducted the reviews, and will the methodology be published? * Which features besides improved memory fall outside the Business Associate Agreement? * Does the assurance that content is not used for training apply to all customers globally, or only to those covered by a BAA? Questions MediaNama has sent to the Ministry of Health and Family Welfare and the National Health Authority * Does the government consider the DPDP Act, 2023 sufficient for health data, given that it creates no separate category for it and that DISHA was subsumed rather than enacted? * Is any health-sector-specific data protection instrument under consideration? * Do the ABDM Health Data Management Policy or ABDM integration requirements address the use of third-party AI systems to process patient records? OpenAI, the Ministry of Health and Family Welfare, and the National Health Authority had not responded at the time of publication. This story will be updated if they do.