ChatGPT meets Epic: read-only plus a BAA as the compliance template for 325M records

On September 1 OpenAI opened a connection between ChatGPT for Healthcare and Epic, the electronic health record system holding data on about 325 million patients across roughly 40% of US hospitals. Two constraints define the integration. Access is read-only, and the model cannot write to the patient record in any configuration. And it runs under a BAA, the HIPAA business associate agreement that makes OpenAI contractually liable for the data it touches. Seven health systems are launch partners, with UCSF running the pilot. In 4,363 physician evaluations, 99.1% of answers were rated safe. The clinical result is interesting. The compliance shape is what I would copy.

What was actually agreed

• Read-only: the model can retrieve and summarise from the record; it has no write path, not as an option, not behind a flag.
• BAA: the vendor accepts HIPAA obligations, which is the contractual step most consumer AI products never take.
• Scoped launch: seven systems, one named pilot, published evaluation counts.
• Human in the loop by construction: since nothing can be written back, every action that changes the record is still a clinician's.

That last point is the mechanism. The 99.1% figure sounds high until you ask what the remaining 0.9% would have done. With a write path, an unsafe answer becomes a wrong entry in a chart. Without one, it becomes a suggestion a clinician reads and rejects. The architecture converts a model error rate into a review load, which is a thing hospitals already know how to staff.

Why the contrast matters

The same week, Healthwatch and NHS reporting in The Guardian described AI medical scribes making errors in drug names and diagnoses, while the MHRA does not currently classify them as medical devices. Scribes write. They produce text that lands in the record unless someone catches it, and the regulator has not yet decided they need device-grade oversight. Put the two stories side by side and the difference is not model quality. It is direction of data flow. One system can only read from the source of truth; the other writes to it under time pressure.

The safest place to put a language model in a regulated system is behind a read-only interface to the source of truth, and the second safest place does not exist yet.

The pattern travels

I have used the same shape outside healthcare, most explicitly in the local SQL assistant with guardrails: the model gets a read-only database role, generates queries, and never holds a credential that can mutate anything. It works for finance, where the model can explain a ledger but not post to it, and for legal, where it can search a document set but not file, sign or redline the master copy. The rules are the same everywhere.

• Give the model a read-only credential at the infrastructure layer, not a prompt instruction. Prompts are not access control.
• Route every output that would change state through a human action that is logged separately from the model's suggestion.
• Sign a data-handling agreement with the vendor before the first real record touches the API. If the vendor will not sign, that is your answer.
• Publish or at least record your evaluation counts. 4,363 rated answers is a number a compliance officer can work with; a vague claim of testing is not.
• Validate the outputs structurally as well as clinically. Schema checks, citation checks and the output validation layer catch the errors a busy reviewer skims past.
• Keep the read scope minimal. Read-only across 325 million records is still a very large read; scope by patient, by encounter, by role.

The honest limit

Everything measurable here comes from OpenAI and its launch partners. 99.1% safe is a physician rating, on OpenAI's evaluation set, using OpenAI's definition of safe; I have not seen the rubric, the question distribution, or the inter-rater agreement. Seven health systems is a pilot, not a deployment across 40% of hospitals. And read-only removes one class of harm without touching another: a confidently wrong summary that a tired clinician trusts is still a patient-safety event, and no BAA prevents it. The template is right. The evidence that it works at scale is not in yet.