Epic Systems runs the software behind medical records for a majority of U.S. hospital patients. If it changes how that data flows to patients directly, the ripple effects reach far beyond hospital IT departments — into small medical practices, health startups, and eventually employer benefits programs.
Epic has spent two decades as the dominant electronic health record (EHR) vendor, the software that hospitals and clinics use to store and manage patient charts. Its business model has always run through providers: hospitals and health systems buy Epic, and it's up to them whether to turn on patient-facing features like MyChart, the portal many patients use to see test results or message a doctor. Recent public comments and product signals suggest Epic is exploring AI tools that would give patients more direct control over their own data, rather than routing everything through a provider's decision to enable it.
This matters because Epic's current setup makes providers the gatekeepers. A hospital can choose to limit what a patient portal shows, how fast results appear, or whether a patient can export their full record easily. Federal rules under the 21st Century Cures Act already require certain data-sharing standards and bar most types of deliberate information blocking, but enforcement has been uneven and providers still have meaningful discretion over the patient experience.
An AI layer aimed at patients directly — say, a tool that lets someone ask plain-language questions about their own labs or medication history without waiting on a portal update — would shift some of that control away from the institution and toward the individual. Epic has already built AI features into its provider-facing tools, including systems that draft message replies and summarize charts for physicians. Extending that capability outward to patients would be a logical, if significant, next step.
This fits a broader pattern in health tech: incumbents that built their business on selling to institutions are being pulled toward consumer-facing AI because that's where the competitive and regulatory pressure is building. Apple has pushed its own health records feature for years with mixed traction, largely because it depends on EHR vendors cooperating on data access. Smaller health-data startups have tried to build patient-access tools on top of EHR APIs, often running into friction, fees, or slow approval processes from the very vendors, like Epic, that control the data pipes. If Epic builds its own patient-facing AI tool instead of just opening APIs wider, it keeps that market for itself rather than ceding it to third parties.
For small medical and dental practices running on Epic or an Epic-affiliated system, a shift like this could mean new patient engagement features arriving whether or not the practice asked for them, along with new questions about liability, patient consent, and staff training. Practices that currently rely on manual processes to field patient record requests might see some of that burden lifted — or shifted into new compliance work around AI-generated summaries reaching patients unfiltered.
For small health-tech vendors and telehealth startups building on top of EHR data, the bigger question is competitive. If Epic starts offering AI-powered, direct-to-patient tools, that could squeeze out third-party apps that currently serve as the go-between for patients wanting better access to their own records. Businesses in this space should watch whether Epic's move comes with expanded API access for outside developers or, more likely, tighter control funneling patients toward Epic's own tools.
The next signals worth tracking: any formal announcement at Epic's annual user conference, changes to its API terms for third-party developers, and how competitors like Oracle Health and athenahealth respond. Regulatory action from the Office of the National Coordinator for Health IT on information blocking complaints is also worth monitoring, since it could force Epic's hand regardless of its own product roadmap.
The bottom line: nothing has shipped yet, but a shift from provider-controlled to patient-direct data access, powered by AI, would change who small practices and health-tech vendors have to answer to when patients ask for their own information faster and in plainer language.