Is Epic AI HIPAA compliant?
Epic Systems Corporation signs a Business Associate Agreement with its customers, which HIPAA requires before a vendor handles patient data for you. Once it's signed, you can use Epic AI with patient data within the BAA's scope; whether your use is compliant still depends on your setup and your own policies. Epic Systems Corporation doesn't say whether the BAA covers its AI features.
Does Epic AI sign a BAA?
Yes, it signs a BAA
Epic's AI tools come inside its EHR, and an Epic legal agreement refers to HIPAA business associate terms already in place between Epic and its customers. No public Epic page says whether those terms cover the AI features or the AI models behind them.
Not confirmed for the AI features: Epic Systems Corporation doesn’t say whether its BAA covers Art (AI for clinicians), including AI Charting ambient notes, In Basket reply drafts and chart summaries; Emmie (AI for patients in MyChart); Generative AI using third-party language models (Azure OpenAI Service). Get that in writing before using them with patient data.
- Business associate
- Epic Systems Corporation
- Tool
- Epic AI
- Plans with a BAA
- Epic EHR customer license (health systems and medical groups)
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Epic EHR customer license (health systems and medical groups) | Signs a BAA | Through sales | Epic is licensed through enterprise contracts with no public pricing or self-serve signup. Epic's API Subscription Agreement says Epic may receive PHI from customers and that this access falls under the HIPAA business associate terms in place between the customer and Epic under a separate agreement. Those business associate terms are not published.[1] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Epic Systems Corporation says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Art (AI for clinicians), including AI Charting ambient notes, In Basket reply drafts and chart summaries | Not stated | Epic says these features are built directly into its software and draw on the medical record. AI Charting listens during visits and drafts notes and orders. No Epic page checked says whether the business associate terms cover them or how audio is handled.[2],[3] |
| Emmie (AI for patients in MyChart) | Not stated | Emmie answers patient questions in MyChart and can reference chart data such as notes, results and messages. The page does not discuss HIPAA, BAAs or data handling.[4] |
| Generative AI using third-party language models (Azure OpenAI Service) | Not stated | Epic's AI page describes a pipeline it calls HIPAA-compliant that uses models such as GPT-4. A 2023 Epic post announced Azure OpenAI Service integration. Neither page says whether the model provider is under a BAA.[2],[5] |
Compare Epic AI
- Epic AI vs athenaOne AIathenaOne AI: some plans
Sources
- API Subscription Agreement
- AI | Epic
- Epic AI Charting Rolls Out Alongside an Expanding Set of Built-In AI Capabilities
- AI for Patients | Epic
- Microsoft and Epic Expand Strategic Collaboration with Integration of Azure OpenAI Service
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.