AI Integration for Epic MyChart

AI integration connects to MyChart's core functional surfaces: the Secure Messaging API for patient-provider communication, the Questionnaire engine for digital intake, the Appointment and Health Maintenance modules for proactive outreach, and the Health Record via FHIR for contextual data retrieval. The goal is to embed AI agents that operate within these existing workflows—triaging incoming messages to appropriate staff, drafting responses for clinician review, processing form submissions to update the chart, and generating personalized educational content based on a patient's conditions, medications, and upcoming procedures.

A production implementation typically involves a middleware layer that subscribes to MyChart webhooks (e.g., new message, form submission) and uses FHIR APIs to retrieve relevant patient context from the EHR. An AI orchestration service processes the event—such as classifying a message urgency or extracting data from a PDF intake form—and either returns a suggested action to the Hyperspace inbox for staff approval or, for low-risk workflows, executes an automated response (e.g., sending post-op instructions). All AI-generated content is logged with an audit trail, and patient-facing outputs are configured to require a human-in-the-loop for clinical advice, adhering to Epic's governance model and avoiding unauthorized practice of medicine.

Rollout is phased, starting with high-volume, low-risk workflows like appointment reminder confirmations, medication renewal intake, and post-visit follow-up questions. This builds trust and demonstrates operational relief for staff drowning in message volume. The integration is governed through the same change control and compliance reviews as any Epic build, with prompts, data flows, and agent permissions documented in the health system's AI governance framework. The result is a MyChart experience that reduces administrative burden, improves response times, and keeps patients engaged without overloading clinical teams.

The core architecture involves deploying an AI middleware layer that sits between MyChart's APIs and your chosen LLM (e.g., OpenAI, Anthropic, or a private model). This layer handles several critical functions:

• Secure Data Routing: It acts as a secure proxy, ingesting patient-initiated messages, form submissions, and appointment data via Epic's FHIR API or Interconnect webhooks. All outbound calls to external AI services are stripped of direct identifiers where possible, using patient context tokens managed internally.
• Context Enrichment: Before sending a prompt to the LLM, the middleware retrieves relevant, authorized patient context from the EHR—such as upcoming appointments, recent lab results, or medication lists—using the patient's unique ID. This grounds the AI's responses in the patient's specific clinical situation.
• Tool Calling & Workflow Execution: For actions like scheduling or form completion, the AI agent uses defined tools (e.g., check_appointment_availability, update_intake_form) that call back into Epic's APIs. All such actions are logged and typically require a final human-in-the-loop approval or patient confirmation within MyChart before committing changes.

Data governance is enforced at multiple points. A strict prompt guardrail system validates every LLM call against policies for PHI handling, clinical safety, and organizational tone. For example, responses related to symptoms are always appended with standard disclaimers to contact care teams. All AI-generated content, along with the source patient data and prompts used, is written to an immutable audit log within your secure environment, linking back to the Epic audit trail. Access is controlled via the same RBAC (Role-Based Access Control) principles as Epic itself, ensuring only authorized systems and, by extension, AI agents can interact with patient data based on defined scopes.

A successful rollout follows a phased, use-case-specific approach. Start with low-risk, high-volume workflows like automated responses to routine scheduling inquiries or post-visit satisfaction surveys. This allows for monitoring, clinician feedback, and tuning of guardrails without impacting critical care. Subsequent phases can introduce more complex workflows, such as AI-drafting responses to patient medication questions for nurse review or summarizing pre-visit intake forms for the provider. Each phase includes defined quality gates—measuring accuracy, patient satisfaction, and clinician burden—before proceeding. This iterative, governed approach ensures the AI integration enhances the patient and provider experience within MyChart while maintaining Epic's rigorous standards for security and compliance.

All AI interactions with MyChart data must be governed by Epic's existing role-based access control (RBAC), ensuring the AI only accesses data permissible for the acting user or service account. We architect integrations to use Epic's FHIR APIs and SMART on FHIR scopes, never storing raw PHI. AI-generated content is written back to the EHR as a draft within the appropriate module (e.g., In Basket, Patient Instructions), enforcing the standard clinician review and co-sign workflow before it becomes part of the legal medical record. Every AI action is logged to the Epic audit trail, creating a transparent chain of custody for all automated messages, summaries, or form processing.

A phased rollout is critical for adoption and risk management. We recommend starting with a low-risk, high-volume use case in a single pilot department, such as automating follow-up instructions for common post-visit scenarios. This initial phase validates the integration's data flows, performance, and user acceptance. Subsequent phases can introduce more complex workflows, like intelligent patient intake form triage or personalized educational content generation, expanding to additional departments or service lines based on measured impact and refined governance protocols.

Continuous monitoring is built into the operational layer. We implement human-in-the-loop (HITL) review queues for a percentage of AI outputs to monitor quality and catch edge cases. Performance is tracked against key operational metrics, such as In Basket response time reduction or patient call deflection rates, not just AI accuracy scores. This controlled, iterative approach ensures the AI augments—rather than disrupts—clinical workflows, building a foundation for scalable, trusted automation across the MyChart patient portal. For a deeper technical look at connecting AI to Epic's data layer, see our guide on AI Integration for Epic Cogito and SlicerDicer.