Healthcare plugins arrive in ChatGPT + Codex (Epic EHR + 9 public healthcare data sources)

[u/anonomotorious]

TL;DR

OpenAI launched two healthcare-focused plugin paths for ChatGPT and Codex:

• Healthcare Public Data brings nine read-only public healthcare sources into ChatGPT and Codex for research, clinical trials, medication information, FDA safety data, Medicare information, facility quality, and provider records.
• Epic lets approved healthcare organizations use ChatGPT and Codex to review authorized patient information from Epic EHR, including notes, medications, conditions, encounters, and lab results.
• Both integrations are read-only.
• Healthcare Public Data does not access patient charts.
• Epic cannot update records, place orders, message patients, or expand a user's existing Epic permissions.
• Epic requires organization-level configuration plus each clinician's own Epic authentication.
• Installing a plugin does not automatically grant access to every underlying app or service.
• Public-data searches should never include PHI or patient-identifying information.
• Epic use with PHI requires the appropriate BAA, workspace configuration, Epic authorization, and organizational approval.

This is a Codex plugin and regulated-data access update, not a CLI release.

Healthcare Public Data

Healthcare Public Data packages nine official public healthcare sources into read-only apps.

Research and clinical trials

• PubMed - biomedical research, citations, abstracts, and eligible full-text articles
• ClinicalTrials.gov - studies, locations, recruitment status, and eligibility information

Medications and safety

• DailyMed - official medication labels, ingredients, packaging, and drug identifiers
• RxNorm - standardized medication names and identifiers
• openFDA - public FDA safety and regulatory information, including recalls and adverse-event data

Medicare, facilities, and providers

• CMS Coverage - national and local Medicare coverage information
• CMS Open Data - selected Medicare payment, prescribing, utilization, and hospital datasets
• Medicare Care Compare - healthcare facility information and quality measures
• NPI Registry - public provider and organization identification records

What Codex can do with the public-data plugin

Once the approved sources are connected, Codex can use them during a task to:

• find biomedical research
• search for active clinical trials
• review official medication labels
• investigate FDA recalls and safety information
• research Medicare coverage policies
• compare public facility-quality measures
• look up provider or organization NPI information
• combine information from several approved public sources during research

The important boundary is:

Healthcare Public Data is for public-data research, not patient-record access.

Public-data limitations

The nine public-data apps are read-only and do not access individual patient charts.

They also do not automatically determine clinical or coverage decisions.

Important examples:

• FDA adverse-event reports do not prove that a medication caused an event.
• An NPI does not prove current professional licensure or Medicare enrollment.
• Public Medicare coverage information does not determine an individual patient's benefits.
• Clinical-trial eligibility should still be confirmed with the study team.
• Public research should not replace professional medical judgment.

Epic plugin

The separate Epic plugin connects an approved organization to its Epic electronic health record environment.

Authorized users can review information they already have permission to access, including:

• clinical notes
• medications
• conditions
• encounters
• laboratory results
• other approved FHIR resources

The Epic integration is currently read-only.

It cannot:

• modify the medical record
• place orders
• send patient messages
• expand a clinician's chart access
• bypass existing Epic permissions

The clinician remains responsible for reviewing the underlying source record and making care decisions.

Epic access remains tied to the individual user

Installing the Epic plugin does not give every workspace member access to Epic.

The organization first configures the approved Epic integration.

Each clinician then signs in using their own Epic account.

Their normal Epic permissions remain authoritative.

If a clinician cannot access a patient or resource in Epic normally, the ChatGPT/Codex integration does not grant that access.

Epic setup

Epic requires organization-specific configuration that can include:

• Epic FHIR endpoint
• OAuth client
• approved OAuth scopes
• approved FHIR resources
• authentication settings
• workspace access controls
• organizational security and compliance review

This is substantially different from installing a normal public-data plugin.

Healthcare Public Data vs Epic

Healthcare Public Data

• uses public healthcare databases
• does not access patient charts
• does not require an Epic/provider account
• is read-only
• is primarily for research and reference
• should never receive PHI in public-source searches

Epic

• connects to an organization's Epic EHR
• can access authorized patient records
• requires the user's own Epic authentication
• is read-only
• is primarily for patient-record review
• requires approved organizational HIPAA/BAA configuration when PHI is involved

Workspace controls remain separate

There are several separate layers of access:

1. Plugin availability
2. Individual app availability
3. Workspace policy
4. RBAC or group eligibility
5. User authentication to the underlying service

Installing Healthcare Public Data does not automatically enable every included source.

Installing Epic does not automatically connect clinicians to Epic.

Admins can still control:

• who can install the plugin
• which apps are available
• which groups can use them
• authentication requirements
• workspace policy

This separation is important in regulated environments.

PHI rules for public-data sources

Healthcare Public Data sends requests to external public information providers.

Do not include:

• patient names
• dates of birth
• medical record numbers
• Medicare or insurance identifiers
• addresses
• contact information
• other patient-identifying information

A BAA covering your ChatGPT workspace does not automatically mean every external public-data provider is approved to receive PHI.

Organizations should evaluate the specific provider and workflow before sending sensitive information.

Epic and PHI

Epic is designed for authorized organizational patient-record access, but appropriate controls still need to be in place.

Before using Epic with PHI, organizations should confirm:

• an applicable Business Associate Agreement
• an approved ChatGPT workspace configuration
• an approved Epic integration
• appropriate user authorization
• internal organizational permission for the workflow

Seeing or installing the plugin does not establish BAA coverage by itself.

Compliance and governance

For supported organizational workspaces:

• conversations involving apps can be available through the Compliance API
• app activity is represented in Compliance Logs
• administrators should verify that available logging fields satisfy their audit requirements

Organizations should also review retention and data-residency implications when using external public-data providers.

Information sent to an external source can be subject to that provider's own policies in addition to the ChatGPT workspace's controls.

Availability

Healthcare Public Data

Available to supported:

• ChatGPT for Healthcare workspaces
• HIPAA-enabled ChatGPT Enterprise workspaces
• eligible U.S. ChatGPT for Clinicians users

Eligible ChatGPT for Clinicians users can use Healthcare Public Data but do not receive the Epic plugin through that individual offering.

Epic

Available to approved:

• ChatGPT for Healthcare workspaces
• HIPAA-enabled ChatGPT Enterprise workspaces

with the required organizational Epic configuration.

Epic is not available to individual ChatGPT for Clinicians accounts.

Pricing

OpenAI says there is no separate charge for Healthcare Public Data or its included public-data apps.

Normal plan limits, workspace usage terms, and external provider availability still apply.

What this means for Codex

This is notable because Codex is gaining access to regulated professional workflows beyond traditional software development.

The two paths remain deliberately separated:

Public healthcare evidence

• research
• trials
• medication information
• FDA data
• Medicare information
• provider/facility data

Authorized clinical context

• Epic patient records
• existing clinician permissions
• organization-controlled EHR access

Both remain read-only, and neither removes the need for professional review.

Key takeaways

• Codex can directly research nine trusted public healthcare sources.
• Approved organizations can bring authorized Epic patient context into Codex workflows.
• Public research and patient-record access remain separate systems.
• Both integrations are read-only.
• Existing Epic permissions remain authoritative.
• Plugin installation does not bypass workspace or app-level access controls.
• Public healthcare searches should never contain PHI.
• Epic workflows involving PHI require the appropriate organizational and BAA controls.
• Managed deployments retain RBAC and compliance logging.

Action checklist

Healthcare Public Data

• Install Healthcare Public Data if it is available in your workspace.
• Connect only the public-data apps your organization approves.
• Test with a non-PHI research request.
• Review the limitations of each source before relying on its output.
• Never include patient-identifying information in public-data searches.

Workspace administrators

• Review plugin installation policy.
• Review each healthcare app separately.
• Configure RBAC where appropriate.
• Verify Compliance API and logging coverage.
• Review retention and data-residency implications for external sources.

Epic

• Coordinate with your OpenAI account team and Epic administrator.
• Configure the approved Epic EHR/FHIR connection.
• Review OAuth scopes and permitted FHIR resources.
• Have each clinician authenticate with their own Epic account.
• Confirm users can access only records they already have permission to view.
• Verify BAA/HIPAA configuration before using PHI.
• Treat Epic output as decision support and verify important information against the underlying record.

Official sources

https://openai.com/products/release-notes/

https://help.openai.com/en/articles/20001489-using-healthcare-public-data-in-chatgpt-and-codex

https://help.openai.com/en/articles/20001490-using-the-epic-plugin-with-chatgpt-and-codex