FAQ for Providers - IT Leaders Focus

Yes. HIPAA compliance is built in — minimal-scope Epic SMART on FHIR access, no PHI persistence, encrypted in transit, and HIPAA-aligned hosting with BAAs. This minimizes your risk during audits and compliance checks. Read our full Privacy Policy.

Yes. We use standards-based OAuth2 authentication, TLS 1.2+ encryption, and ephemeral access tokens within Epic’s integration framework. This ensures PHI is protected and only accessible during the session. Learn more on our Security Page 

Via Epic’s read-only SMART on FHIR APIs with standard, minimal scopes. Patient identity is confirmed through Epic’s MyChart portal, using Epic’s own authentication flow. This means no custom Epic builds, no data changes, and no risky workarounds are needed. 

No. Data from Epic is accessed only during the patient’s active session and is never stored by ClearChart.AI. Eliminating storage reduces security exposure and privacy risk. 

We start with Epic’s core patient-facing FHIR resources — labs, medications, problems/conditions, visit summaries, and results — focusing on high-value content that delivers immediate benefit.

We support a standalone secure link launch by default, allowing patients to access ClearChart.AI outside of MyChart while still authenticating through Epic. Embedded MyChart launch is also supported as an option, available at the health system’s request, so deployment can align with your Epic governance model and patient workflows. 

Contact us to arrange a pilot or proof-of-concept in a specific department or service line.  Reach out via our contact form or email info@clearchart.ai. We can configure a sandbox integration in Epic for validation before moving to a live pilot.