DrChrono integration guide
How to connect HealthArc to DrChrono
Your administrator creates an API application under Account → API, sends us the Client ID and Client Secret, and clicks Authorize when DrChrono asks. HealthArc handles configuration, token refresh and testing.
At a glance
The DrChrono integration in six lines
| Connection type | DrChrono API application with OAuth 2.0 |
|---|---|
| Where it runs | Cloud to cloud. Nothing to install on your servers or workstations |
| Who sets it up | A DrChrono user with the Settings permission, under Account → API |
| Tokens | Access tokens last 48 hours and HealthArc refreshes them automatically |
| What we need | Client ID and Client Secret, shared securely |
| Security | HIPAA compliant, SOC 2 compliant, BAA signed before any data moves |
Data flow
What moves between DrChrono and HealthArc
From DrChrono into HealthArc
- Patient demographics and the patient list
- Allergies
- Medications
- Problems and diagnoses
- Providers and locations
- Appointments
- Clinical notes, lab results and vital signs, if your implementation uses them
From HealthArc back to DrChrono
- Monthly care-management notes, where the API access granted allows write-back
- Write-back scope confirmed in writing during scoping
Exact fields depend on your DrChrono configuration and the programs you run, and are confirmed in writing during scoping. HealthArc only requests the data those programs need.
Before you start
What you need in place
None of this needs an IT team. Most of it is a decision or a name, and the scoping call covers anything you haven’t settled yet.
- An active DrChrono account
- Administrator access, or a user with the Settings permission
- Permission to create API applications
- Access to Account settings in DrChrono
- A signed HealthArc agreement and business associate agreement
Your time investment4–8 hours
Total time from your team, across the whole setup. HealthArc does the build.
Where your time goes
- Scoping call
- Authorizing HealthArc in DrChrono
- Approving the mapping
- Reviewing the pilot
No IT team neededLive in about 30 days
Setup steps
7 steps from first call to go-live
Most practices are monitoring patients within about 30 days of signing.
- 1Practice + HealthArc
Agreements and scoping
We confirm the programs you want to run, the providers and locations involved, and who owns clinical work and billing on your side. The HealthArc agreement and business associate agreement are signed before any data moves. Your team also receives the Redirect URI to use in DrChrono.
- 2Practice administrator
Open API management
Account → API
Sign in with an administrator account and open the API page. It only appears once the Settings staff permission is enabled.
- 3Practice administrator
Create a new API application
Account → API → New Application
Click New Application, fill in the fields and click Save Changes.
- Application name, for example “HealthArc Integration”
- Redirect URI: your HealthArc team provides it
The DrChrono application form. Fill in Name and Redirect URIs, then click Save Changes. Client ID and Client Secret appear after saving. - 4Practice administrator
Send the credentials to HealthArc
DrChrono generates a Client ID and Client Secret when you save. Share them securely with your HealthArc implementation team.
- Client ID
- Client Secret
- Practice name and practice ID, if applicable
- 5Practice + HealthArc
Confirm the data HealthArc can access
We agree which clinical resources the integration uses, such as demographics, medications, problems, providers, locations and appointments. These set the OAuth scopes for the application.
- 6Practice administrator
Authorize HealthArc in DrChrono
After we configure the integration, you’re redirected to DrChrono. Log in, review the requested permissions and click Authorize. That’s it. HealthArc refreshes the access tokens automatically from then on, so nobody on your team has to log in again to keep the connection running.
- 7HealthArc + practice
HealthArc configures, tests and goes live
Once we have access, our implementation team configures the DrChrono connection, validates authentication and data access, maps providers and locations, and tests with a small pilot group. Your Customer Success Manager confirms when the integration is complete, and we train your team before enrollment opens.
Who does what
Your team and ours
| Task | Your practice | HealthArc |
|---|---|---|
| Create the API application | Yes | – |
| Provide the Redirect URI | – | Yes |
| Share the Client ID and Secret securely | Yes | – |
| Authorize HealthArc (OAuth) | Yes | – |
| Token refresh and technical build | – | Yes |
| Staff training | – | Yes |
| Ongoing monitoring and support | – | Yes |
Security
How patient data is protected
BAA first
A business associate agreement is signed before any patient data moves.
Encrypted
Databases are encrypted at rest, and data in transit uses TLS only.
SOC 2 and HIPAA
HealthArc’s security program follows the SOC 2 framework, and the platform is HIPAA compliant.
U.S. hosting
Data is stored on AWS in the United States.
Full details are on the HealthArc security page.
FAQ
DrChrono integration questions
How do I connect HealthArc to DrChrono?
Go to Account → API, click New Application, enter an application name and the Redirect URI from HealthArc, and save. Send HealthArc the Client ID and Client Secret, then click Authorize when DrChrono asks you to approve the permissions.
What if I can’t create the API application?
Contact DrChrono support through the EverHealth support web form, or email the DrChrono API team, with your practice name, the API application name and a short description of the HealthArc integration. Your HealthArc team can give you the connected API username if DrChrono asks for it.
Which data does HealthArc access in DrChrono?
Typically demographics, the patient list, allergies, medications, problems, providers, locations and appointments, plus clinical notes, labs and vitals if your programs need them. The resources set the OAuth scopes and are confirmed during scoping.
How often do we need to authorize?
Once. Access tokens last 48 hours and HealthArc refreshes them automatically using the refresh token.
Is it safe to share the Client Secret?
Share it only with your HealthArc implementation team through the secure channel they set up, never by plain email or chat.
Ready to connect DrChrono?
Book a scoping call. You’ll leave with a written implementation plan for your practice, your programs and your go-live date.
DrChrono and EverHealth are trademarks of their respective owners. HealthArc is an independent company.