Epic integration guide
How to connect HealthArc to Epic
Your Epic Technical Coordinator does the authorization: find HealthArc in Epic Showroom, download and approve the HealthArc client record using our Client ID, and configure SMART on FHIR access. Then tell us it’s done, and HealthArc completes the connection.
At a glance
The Epic integration in six lines
| Connection type | SMART on FHIR and Epic FHIR APIs |
|---|---|
| Where it runs | Cloud to cloud. Nothing to install on your servers or workstations |
| Who authorizes it | Your Epic Technical Coordinator, with your security and application analysts |
| How | Download the HealthArc client record by Client ID and approve it for your environment |
| Scope | Per organization. One Epic customer’s approval doesn’t apply to another |
| Security | HIPAA compliant, SOC 2 compliant, BAA signed before any data moves |
Data flow
What moves between Epic and HealthArc
From Epic into HealthArc
- Patient demographics
- Problem list and diagnoses (ICD-10)
- Medications and allergies
- Encounters and admission, discharge and transfer events, where configured
- Practitioners and locations
- Vitals and lab results, where configured
From HealthArc back to Epic
- Care-management documentation, where your Epic team enables write-back
- Write-back scope agreed during scoping and security review
Exact fields depend on your Epic configuration and the programs you run, and are confirmed in writing during scoping. HealthArc only requests the data those programs need.
Before you start
What you need in place
None of this needs an IT team. Most of it is a decision or a name, and the scoping call covers anything you haven’t settled yet.
- An active Epic environment
- An Epic Technical Coordinator (TC) assigned to your organization
- An Epic Security Analyst, if your organization requires one
- Administrative approval to authorize third-party applications
- The HealthArc Client ID, from your HealthArc implementation team
- A signed HealthArc agreement and business associate agreement
Your time investment4–8 hours
Total time from your team, across the whole setup. HealthArc does the build.
Where your time goes
- Scoping call
- Authorizing HealthArc in Epic
- Approving the mapping
- Reviewing the pilot
No IT team neededLive in about 30 days
Setup steps
7 steps from first call to go-live
Most practices are monitoring patients within about 30 days of signing.
- 1Practice + HealthArc
Agreements and scoping
We confirm the programs you want to run, the providers and locations involved, and who owns clinical work and billing on your side. The HealthArc agreement and business associate agreement are signed before any data moves. You receive the HealthArc Client ID at this step.
- 2Health system
Bring in your Epic team
Contact your organization’s Epic implementation team. They authorize third-party SMART on FHIR applications in your environment.
- Epic Technical Coordinator (TC)
- Epic Application Analyst
- Epic Security Analyst
- 3Epic team
Find HealthArc in Epic Showroom
Search Epic Showroom for “HealthArc” or “HealthArc RPM”. If you need more help during implementation, your team can work with Epic through Vendor Services.
Epic ShowroomSearch Epic Showroom for “HealthArc” or “HealthArc RPM”. - 4Epic Technical Coordinator
Download and approve the HealthArc client record
Using the HealthArc Client ID from your implementation team:
- Sign in to the Epic on FHIR portal
- Locate the HealthArc application by its Client ID
- Download the client record
- Approve it for your organization’s Epic environment
- Configure the SMART on FHIR permissions and FHIR resource access HealthArc needs
- 5Epic team
Configure security and user access
Your team configures SMART on FHIR authorization, OAuth, user access permissions, launch configuration if applicable, and its security review. Some organizations also need firewall, network or proxy changes.
- 6Health system
Tell HealthArc it’s authorized
Notify your HealthArc implementation team and, if asked, provide:
- Epic organization name
- Environment: production or non-production
- Confirmation the HealthArc Client ID is imported and approved
- Any organization-specific FHIR endpoint details
- 7HealthArc + practice
HealthArc configures, tests and goes live
Once we have access, our implementation team configures the Epic connection, validates authentication and data access, maps providers and locations, and tests with a small pilot group. Your Customer Success Manager confirms when the integration is complete, and we train your team before enrollment opens.
Who does what
Your team and ours
| Task | Your practice | HealthArc |
|---|---|---|
| Provide the HealthArc Client ID | – | Yes |
| Download and approve the client record | Yes | – |
| Security review and SMART on FHIR configuration | Yes | – |
| Confirm authorization to HealthArc | Yes | – |
| Connection configuration and end-to-end testing | – | Yes |
| Staff training | – | Yes |
| Ongoing monitoring and support | – | Yes |
Security
How patient data is protected
BAA first
A business associate agreement is signed before any patient data moves.
Encrypted
Databases are encrypted at rest, and data in transit uses TLS only.
SOC 2 and HIPAA
HealthArc’s security program follows the SOC 2 framework, and the platform is HIPAA compliant.
U.S. hosting
Data is stored on AWS in the United States.
Full details are on the HealthArc security page.
FAQ
Epic integration questions
How do I connect HealthArc to Epic?
Your Epic Technical Coordinator finds HealthArc in Epic Showroom, signs in to the Epic on FHIR portal, downloads the HealthArc client record using our Client ID, approves it, and configures SMART on FHIR access. Then your team tells HealthArc, and we configure and test the connection.
Where do we get the HealthArc Client ID?
From your HealthArc implementation team. Your Technical Coordinator uses it to locate and download the HealthArc application record.
Do we need Epic Vendor Services?
Not to authorize HealthArc. Vendor Services is Epic’s program for implementation guidance, testing tools and technical support, and your team can use it if it needs extra help.
Is anything extra needed for backend or confidential clients?
Sometimes. Organizations using confidential clients or backend OAuth may need to exchange additional security information, such as client secrets or public keys, before activation.
Who at our organization needs to be involved?
Your Epic Technical Coordinator, usually an Epic Application Analyst and Security Analyst, and someone with authority to approve third-party applications.
Ready to connect Epic?
Book a scoping call. You’ll leave with a written implementation plan for your practice, your programs and your go-live date.
Epic is a trademark of Epic Systems Corporation. HealthArc is an independent company.