Integrating AI Agents with Epic

Four, described in the methods above, and they are not alternatives so much as layers. A typical embedded ambient documentation deployment uses FHIR for patient context, a Hyperdrive launch for the clinician experience, and a document write back for the signed note.

When a vendor says they are Epic integrated, ask which of those they mean. The word covers everything from a full embedded launch to a folder on a shared drive, and the difference is months of project time. The same question applies to every other system, which is why our EHR integration pages ask it in the same shape each time.

They are the pieces of one programme that replaced App Orchard, and the names matter because vendors use them loosely in sales calls. As Epic describes the programme on its site and in trade reporting from its 2023 launch, checked in September 2026:

• Showroom (showroom.epic.com) is the customer facing catalogue where an Epic organisation looks up third party products and services. It is the umbrella, not a tier.
• Connection Hub is the open directory inside Showroom. Any vendor that has built a live integration with an Epic customer can list for a modest annual fee, reported at 500 US dollars at launch. A Connection Hub listing means the vendor has connected somewhere. It does not mean Epic has reviewed the integration.
• Toolbox is the curated subset. Epic publishes recommended integration practices for particular software categories, and Toolbox lists the products that follow them. For ambient documentation this is the tier to look for, because it tells you the vendor built the launch and write back the way Epic wants it built.
• Workshop lists vendors co-developing with Epic. A small group, and a signal of depth.
• Vendor Services (vendorservices.epic.com) is the developer side: a paid subscription, reported at 1,900 US dollars a year at launch, that buys sandbox access, tutorials and technical support. Open.epic and fhir.epic.com carry the free public documentation.

So when a vendor says "we are in Epic's marketplace", ask which of these. Connection Hub is table stakes. Toolbox for the ambient documentation category is the meaningful claim, and it is checkable in ten minutes on the Showroom site. Neither replaces your own review, and Epic says as much in the listing terms. The fees quoted are as reported at launch; check the current figures with Epic before assuming them.

More than most buyers expect, and this is where timelines slip.

• Name an Epic analyst or integration owner. Without one, nothing moves, whatever the vendor promises.
• Raise the request through your own change process and find out how long that queue is before you sign anything.
• Complete a security review, which for a tool handling audio of clinical encounters will be a real review rather than a formality.
• Agree what gets written back, in what format, and into which part of the chart.
• Agree who tests it, and against what.

We scope this work as part of an AI readiness audit, because the answer changes the shortlist. A practice with no Epic analyst should not be buying a product whose value depends on one.

Two reviews run in parallel and neither is Epic's. The first is your own third party risk review, run by your security team against the vendor's SOC 2 or HITRUST evidence, a completed questionnaire, a penetration test summary and the architecture diagram that shows where audio goes. The second is the BAA and privacy review, run by compliance and legal. Epic's own review of a Toolbox listing is a check that the integration follows its published practices; it is not a substitute for either of yours, and Epic's terms say so.

For an ambient scribe the security review is a real review rather than a formality, because the vendor holds audio of clinical conversations before the note exists. The questions that take longest are these:

• Where is audio stored, in which cloud region, for how long, and can retention be set to zero after the note is signed.
• Which subprocessors sit behind the product, in particular the speech and language model providers, and are they flowed down in the BAA.
• How is the Epic connection authenticated: a backend system client with its own credentials, or a SMART launch carrying the clinician's context. Both are legitimate; shared service accounts are not.
• What audit logging exists on the vendor side, and can it be exported into your SIEM.
• Is your data used to train shared models, and what does the contract say.

Start the security review the week you shortlist, not the week you sign. At most health systems it is the item with the longest lead time, and it is the item most often blamed for a go live slipping by a quarter. The HIPAA and AI page sets out what the BAA has to say, and the questions to ask AI vendors about HIPAA are the questionnaire items in plain language. Once the vendor is live, the breach exposure tool models what a vendor side incident would mean for your notification duties.

Integration and compliance are separate approvals and they run on different clocks. A vendor can be listed in Epic's marketplace and still be wrong for you on retention, subprocessors or model training.

Get the business associate agreement moving in parallel with the technical work rather than after it. Ask specifically where audio is stored, how long it is kept, and whether your data trains shared models. The HIPAA and AI compliance page sets out what to insist on and what is negotiable.

Epic now ships generative AI features of its own inside the chart, developed with Microsoft and announced publicly since 2023, and it has described ambient documentation work built with partners. For a buyer this changes the question from "which scribe" to "buy a scribe, wait for Epic, or both".

Three things to weigh. First, availability: what Epic offers is tied to your version and your Epic contract, and the honest answer for many organisations is that the feature they read about is not yet switched on for them. Ask your Epic account team what is generally available on your version today, not what is on the roadmap. Second, depth: a third party vendor that has spent years on specialty note behaviour, coding support and multilingual encounters may still be ahead of a platform feature on the things your clinicians notice. Third, procurement: an Epic feature does not need a new BAA, a new security review or a new integration queue, which removes the three items that most often delay a third party deployment.

The practical reading is that Epic's own features raise the bar a third party has to clear, and they make "do nothing for six months" a defensible option where it was not before. They do not make the third party market irrelevant. Run the same bake off you would run between two vendors, with Epic's feature as one arm if it is available to you, and let the edit log decide. Where a third party wins, the AI scribe comparison sets out which ones are embedded in Epic.

There is no honest single number, and any vendor offering one is quoting their side of the work rather than yours. What we can say is that the sequence is predictable: security review, then integration request, then build, then validation, then a controlled go live.

The long pole is almost always your internal queue rather than the vendor's engineering. Two useful questions at the start: how many integration requests are ahead of this one, and who can reprioritise it. Ask them before you agree a go live date with the clinicians, because the date you promise them is the one they will remember.

No honest single number exists, so here is the sequence and where it stalls. Each stage is owned by someone on your side, and the timeline is the sum of their queues rather than the vendor's engineering.

Three blockers account for most slipped dates. The integration queue is the first: a health system mid upgrade or mid regulatory build will not prioritise a scribe, and no vendor can change that. The absence of a named Epic analyst is the second, and it is the reason we ask about it before recommending anything. The third is the write back specification: which note type, whether the scribe or the clinician is the author of record, how the encounter is matched when the clinician started recording before opening the chart. Agree all three in writing before the build starts, because changing them afterwards is a second project.

A hosted Epic instance, common for smaller organisations under a Community Connect arrangement, adds a fourth: the host's own governance and queue, over which you have little control. Ask the host what it has already approved for other Community Connect sites, because an approved vendor is months ahead of an unapproved one.

Thirteen vendors in our registry document an Epic path. The depth recorded here is what the vendor and Epic publish, checked in September 2026, and each pairing has its own page with the detail and the gaps.

Native means the vendor is embedded in Epic's clients, typically with a Hyperdrive launch and, for scribes, a presence in Haiku on the clinician's phone. API means the vendor builds on Epic on FHIR and the interfaces described above, and your team owns the connection. Workaround means no documented write back; the clinician copies the note from the vendor's app into the encounter. Workaround is not a reason to exclude a product for a small group, and it is a reason to exclude it for a health system that expects adoption to hold past month three.

Does Suki work with Epic is one of the most searched questions in this category. The short answer is yes, on Epic's published interfaces rather than as an embedded native client, so the clinician experience depends on how your team configures the launch. Dragon Copilot and Epic is the other frequent question, and the answer there is native, with the commercial path running through Microsoft. Both are answered in full on the linked pages.

More than the licence for the first year at most health systems, and almost none of it appears on the vendor's quote. Budget for five things.

• Vendor side fees. Some vendors pay Epic programme fees and pass them through as an integration or onboarding charge. Ask whether onboarding is included in the per clinician rate or invoiced separately, and whether there is a per site or per interface fee.
• Your analyst time. An Epic analyst and an interface analyst for the build and validation, then a fraction of an analyst on an ongoing basis for upgrades. If you do not have these people, the cost is a contractor day rate or the host's charge under a Community Connect arrangement.
• Security review time. A real review of an audio handling vendor is days of a security analyst's time, plus legal time on the BAA.
• Devices and enrolment. Scribes that run in Haiku need enrolled phones. Shared room microphones are an alternative with their own cost.
• Training and the internal owner. An hour per clinician at go live and a named owner who fixes templates in week three. Without the owner, adoption decays and the licence is paid for nothing.

Epic publishes its FHIR documentation openly, and the commercial terms for vendors in its programme are set by Epic and change; ask your Epic account team what applies to your contract rather than relying on a figure from a vendor. On the benefit side, the ROI calculator models returned clinician time with its assumptions printed on the page, and the EHR integration questions post lists what to ask before the order form is signed.

Ambient documentation is the usual first project, because the workflow is contained, the benefit is felt by the people doing the work, and the failure mode is a bad draft that a clinician corrects rather than a wrong action taken automatically.

After that, the ones with clean data boundaries tend to go best: documentation first, then the administrative queues where an agent drafts and a human approves. Anything that touches ordering, or that acts without review, belongs much later in the sequence and needs a governance conversation first.

If you want the ROI framing before the technical one, the ROI calculator models the documentation case with its assumptions on the page.

A shortlist built from your Epic version, your hosting arrangement, your integration queue and your specialties rather than from a vendor's pipeline. A read of the BAA and the order form against the retention, training and renewal clauses that matter. And a written write back specification and pilot design agreed with your analyst before the build starts, so the go live date you promise clinicians is one you can keep.

That is the work of an AI readiness audit for an organisation that has not yet chosen, and of vendor selection for one that has a shortlist. We take no vendor commissions and no referral fees, which is why the recommendation can be to wait for the feature Epic is already building for you. Book a call if you want that view before the security questionnaire goes out.