Even though ChatGPT for Healthcare can now integrate with Epic, health system leaders told Becker’s that generative AI does not get closer to the medical record unless its output can be traced, checked and audited against the chart and a clinician’s own judgment.
OpenAI announced Sept. 1 that it had added an Epic EHR integration and a public health data plugin to its enterprise healthcare platform, with San Francisco-based UCSF Health serving as the company’s pilot partner. The integration, which OpenAI said is read-only and does not write information back to the patient record, lets authorized clinicians pull together appointment notes, lab results, medications and specialist documentation inside ChatGPT or directly within Epic workflows.
“At AdventHealth, we evaluate emerging AI technologies against a simple standard: Can they measurably improve care while preserving patient trust and clinical judgment?” said Rob Purinton, chief AI officer at the Altamonte Springs, Fla.-based health system, a ChatGPT for Healthcare user. “Technical capability alone is not clinical readiness. We consider clinical use only when the evidence shows that an AI tool will support — not distract from — the human relationships at the heart of whole-person care.”
At Los Angeles-based Cedars-Sinai, the safeguard checklist doubles as one the health system has already been building against for nearly a year — not for OpenAI’s new integration, but for its own tool.
“We are evaluating how these new capabilities fit into our broader strategy. Our teams have been developing and deploying ChartChat, what we call our own in-chart solution, built and operated within our HIPAA-compliant Azure environment and using OpenAI models, for nearly a year,” said Cedars-Sinai CIO Craig Kwiatkowski.
Asked what safeguards his IT and compliance teams would need to see before approving a tool like OpenAI’s integration for clinician use with patient data, Mr. Kwiatkowski pointed to the same principles that shaped ChartChat’s design.
“For any tool handling patient data, our focus is on protecting access, preserving accountability and keeping clinicians in control,” he said. “That means things like secure authentication, access limited to existing EHR permissions, comprehensive audit logs, user training and clear expectations that AI-generated information must be verified against the chart and clinical judgment. ChartChat reflects this approach through patient-specific access controls, user-level credentials, detailed logging and built-in guidance designed to support, and not replace, clinical judgment.”
Cedars-Sinai, a ChatGPT for Healthcare customer, is in early discussions with OpenAI about the new integration, using what it has learned from ChartChat.
“Building our own solution has given us direct control over the user experience and roadmap, the ability to tailor workflows to local clinical needs, and flexibility in managing the underlying model and economics,” Mr. Kwiatkowski said. “We’ll need to consider those advantages against the packaged solution’s integration, governance, economics and any added value to our clinical teams.”
He said health systems don’t have to wait for big vendors to design products — they can build their own. “They can move incrementally and responsibly by starting small, controlled scaling, measuring adoption and feedback, and expanding as the technologies mature,” he said.
At Columbus, Ohio-based Nationwide Children’s Hospital, the bar is more binary: A tool isn’t considered unless there’s no other way to do the job.
“The requestor would need to present a solid use case that can’t be solved any other way,” said CIO Denise Zabawski. “Then we would do a thorough risk analysis that would include input from security, privacy, legal and compliance teams. We would also have to address data retention and ensure minimum necessary data access. If we are unable to engage front-end security controls, we would put a robust audit process in place.”
Ms. Zabawski said her organization hasn’t evaluated generative AI tools that connect directly to its EHR — “we are focused on using the Epic-provided features,” she said — and that OpenAI’s Epic integration doesn’t change that plan.
At Corewell Health, headquartered in Grand Rapids and Southfield, Mich., a direct EHR connection doesn’t ease the burden of proof for an AI tool — it heightens it, said Chief Medical Information Officer Daniel Smith.
“Privacy and security must be foundational, but they are only the beginning. We also need confidence that the information returned is accurate, understandable, grounded in the source record and easy for a clinician to verify,” he said. “And that evaluation cannot stop at implementation. These tools require ongoing monitoring just like any other technology that can influence patient care.”
Mr. Smith also drew a distinction between securing data and correctly interpreting it.
“Read-only access, existing EHR permissions and strong enterprise controls are important design choices,” he said. “But protecting the data and correctly interpreting the data are two different questions. The harder challenge is ensuring that an AI-generated synthesis is consistently accurate, clinically appropriate and transparent enough that clinicians can recognize when it gets something wrong,” he said.
Corewell Health is already using generative AI in its workflows, Mr. Smith said, and evaluates new tools on the problem they solve rather than the technology itself.
“Our focus is on where AI can give clinicians time to think, capacity to care and space for human connection, while improving the care we deliver rather than simply making today’s processes faster,” he said.
An Epic integration specifically, he said, raises the stakes of getting AI right without lowering Corewell Health’s standards for adopting it.
At Philadelphia-based Penn Medicine, the answer is a tool that’s already built and in daily use. Mitchell Schnall, MD, PhD, senior vice president for data and technology solutions, said ambient AI tools for scribing and pre- and post-visit workflows are already commonplace and deployed widely across the system.
For the question of what it takes to trust an AI tool embedded directly in the chart, he pointed to Chart Hero, the in-house generative AI tool Penn Medicine built to help clinicians sift through patient records. About 30 clinicians are now using the tool.
Dr. Schnall, a practicing radiologist, said he uses Chart Hero for nearly every case he reviews, calling it a major time-saver that surfaces information he otherwise wouldn’t have time to find. He pointed to two features he sees as central to trusting the tool.
“Every insight about the patient that Chart Hero surfaces includes a reference and link to where it learned the information from, so you have transparency and can check if you have questions,” Dr. Schnall said. “We built a model to monitor performance. … This allows us to track performance to monitor for drift.
“Importantly, we can also objectively assess the impact of changes in the system, ranging from changes in the foundation model version to changes in how we document. I think building in this level of transparency and quality monitoring is important to any AI implementation in the clinical workflow,” he said.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.
