Heidi Health and Epic: Two Very Different Answers Depending on Your Plan

The clinician opens Heidi on a phone or in a browser tab, selects or names the patient, records the consultation, reviews the generated note, and copies it into the open note in Hyperspace or Hyperdrive. Heidi's individual plans also offer browser extensions and templates that make the paste tidier. Nothing reads from Epic, nothing writes to Epic through an interface, and the patient identity in Heidi is whatever the clinician typed.

The risks are the standard ones for a disconnected scribe, and they fall on the organisation rather than the clinician. First, protected health information is flowing to a vendor with which the health system may have no business associate agreement, because the individual signed up personally. The HIPAA and AI page explains why that is the organisation's problem, and the breach exposure calculator estimates the cost. Second, wrong chart pastes are possible and undetectable by the system. Third, the note enters Epic as free text, bypassing templates and SmartData, so quality reporting and coding lose structure. Fourth, Heidi's free tier terms and data handling differ from its enterprise terms; read the ones that apply to the plan actually in use. Our HIPAA compliant AI scribe checklist is the practical test.

None of this is specific to Heidi. It is what happens whenever a consumer style scribe is used against an enterprise EHR without the enterprise knowing.

As listed on the vendor's site in September 2026: a SMART on FHIR launch from the chart, so patient and encounter context is set before recording; availability in Hyperspace and Haiku, with offline capture; scheduling and demographic sync; drafts written back aligned with Smart Data Elements and mapped to SmartSections including HPI, physical exam, assessment and plan, results and attestation; a phased rollout model the vendor describes as test, pilot and scale; and approval on Epic Showroom. Heidi also published a blog post about extending the Epic integration to Haiku.

What is not published: any named Epic reference customer on the integration page, the Epic version floors, the interface inventory, an implementation timeline, or which pricing tier includes the build. Heidi's public pricing page lists free, Clinician, Practice and Enterprise tiers without dollar amounts, and the Epic build is presumably Enterprise, but the page does not say so. Until you have a reference site and a specification, treat the enterprise build as a credible claim to test rather than a proven integration. The questions in our integration questions guide are the ones to put to the vendor, and the AI medical scribe use case page sets out what a pilot should measure.

• The Showroom vendor client and the SMART on FHIR launch configuration, raised through your integration request process, after confirming the listing exists and covers your Epic release.
• Security review and an enterprise business associate agreement, with audio retention, processing location, subprocessors and model training settled in writing. Heidi is an Australian founded company with US operations; ask where US data is processed.
• Template and SmartSection mapping for each note type in scope.
• Mobile device management for Haiku, and a decision on what happens to clinicians already using personal Heidi accounts, including data migration or deletion.
• A pilot with named clinicians and a control group, before any wider rollout.

The last item matters more for Heidi than for most vendors. If clinicians are already pasting from personal accounts, the enterprise rollout has to replace that workflow rather than sit beside it, and the personal accounts have to be closed with their data handled correctly. Our governance and compliance service designs that transition.

The first is the gap between the two answers on this page. Heidi's marketing leans on scale of individual adoption, and that adoption inside Epic organisations is overwhelmingly on the copy and paste path. An organisation evaluating the enterprise build should not count personal users as evidence that the integration works.

The second is verification. The enterprise Epic build is new relative to Abridge, Dragon Copilot, Ambience, Nabla and Suki, and Heidi publishes fewer specifics than any of them. Ask for the reference site first.

The third is pricing opacity. No dollar amounts are published for any tier, which makes the frequent search "is heidi free" easy to answer for individuals and hard to answer for organisations. Our Heidi pricing page sets out what is known, and the scribe pricing comparison puts it beside the Epic embedded vendors, all of which have pages under integrations.

• Which Epic organisations are live on the SMART on FHIR build, on which Epic releases, and can we speak to one without the vendor present?
• What is the Showroom listing URL, and which category is it in?
• Which tier includes the Epic build, at what per clinician price at our volume, and with what minimum term?
• Exactly what is written back, into which SmartSections, and can we see it against our own templates in a sandbox before signing?
• Where is audio processed and stored for US customers, for how long, and is any of it used to train shared models? Put it in the enterprise BAA.
• How will personal accounts held by our clinicians be migrated or closed, and what happens to their data?

Our vendor HIPAA question list covers the compliance items in more depth.

Heidi is the vendor most likely to already be in use on your Epic instance without anyone having approved it, and the one whose enterprise claims are hardest to check from public material. An independent review finds out how many clinicians are pasting from personal accounts, quantifies the exposure, obtains the enterprise specification and reference site, and tests the SMART on FHIR build against your templates beside the established Epic embedded vendors. We take no vendor commissions and no position on whether the answer is Heidi, another scribe, or a policy change first.

Our vendor selection service runs the comparison and our governance and compliance service handles the personal account problem. Book a call and bring your best guess at how many clinicians are already using it.