OpenAI announced on September 1, 2026 that healthcare organizations can connect authorized Epic electronic health record (EHR) context to ChatGPT for Healthcare. It also introduced a Healthcare Public Data plugin that brings nine official sources, including PubMed, DailyMed, RxNorm, ClinicalTrials.gov, and CMS Coverage, into one governed workspace.
For QA engineers, this is a significant connector-testing story. The assistant is no longer working only from a prompt: its answer may depend on user identity, patient authorization, source versions, structured identifiers, retrieval quality, and citations across several systems.
What OpenAI announced
- Epic integration: supported organizations can bring authorized appointment notes, lab results, medications, and specialist documentation into ChatGPT, or embed ChatGPT in a supported EHR layout.
- Nine public sources: the new plugin provides structured access to official research, medication, trial, coverage, and provider data.
- Traceability: OpenAI says answers can point back to supporting chart information and work with specific records, fields, identifiers, and versions.
- Enterprise controls: ChatGPT for Healthcare includes role-based access, single sign-on, and audit logs. OpenAI says eligible deployments can support HIPAA-compliant workflows under an applicable Business Associate Agreement.
- Limited availability: workspace administrators must enable the EHR integration and plugin. The EHR integration is not available to individual accounts.
What the published evaluations show
OpenAI reports that physicians evaluated connected EHR responses across 27 clinical use cases. Across 4,363 ratings, 99.1% of responses were rated safe. In a separate two-round evaluation using large U.S. healthcare datasets, more than 93% of responses for each of five tested sources received a rating of good or better for accuracy.
These are OpenAI-reported aggregate results, not a guarantee for every hospital configuration, record, query, connector state, or downstream workflow. Local acceptance testing still needs representative data, roles, integration settings, and failure conditions.
Why this matters for QA engineers
Connected AI changes the quality contract from “is the answer plausible?” to “did the right user receive a grounded answer from the right records and versions, with no unintended disclosure?” A fluent summary can still be wrong if retrieval omitted a recent medication change, joined the wrong identifier, used stale coverage guidance, or exposed data after access should have been revoked.
- Authorization: test patient, clinician, department, and administrator roles; cross-tenant isolation; expired sessions; and revoked access.
- Provenance: verify that cited chart entries and public records support each material claim and open to the expected record and version.
- Freshness: change a lab result, medication, trial status, or coverage version and measure how quickly the answer and citation update.
- Identity matching: exercise duplicate names, merged records, missing identifiers, unusual units, and conflicting data across sources.
- Safe failure: simulate unavailable connectors, timeouts, partial records, schema changes, and permission errors; require visible uncertainty instead of silent completion.
- Auditability: confirm that prompts, connector calls, access decisions, citations, and administrative changes produce useful logs without leaking unnecessary sensitive data.
A practical connector test
- Create a synthetic patient timeline with known medication, laboratory, referral, and follow-up changes. Do not use real patient data in a non-production test environment.
- Ask the same pre-visit question under authorized, unauthorized, expired, and recently revoked identities.
- Compare every returned fact and citation with the fixture and record the connector version, source timestamp, user role, and response time.
- Remove one source and introduce one conflicting update. The assistant should expose missing or conflicting evidence rather than inventing a clean narrative.
- Repeat after connector, model, permission, or source-schema changes and keep deterministic access-control checks as release gates.
Bottom line
ChatGPT’s Epic and public-health-data connections can reduce fragmented searching, but they also make retrieval, permissions, provenance, and version handling part of product correctness. QA teams should treat each connector as a security-sensitive API dependency and validate grounded answers against synthetic records before trusting production workflows.
Source: OpenAI: Healthcare organizations can now connect EHR and additional industry data to ChatGPT (September 1, 2026), accessed September 3, 2026.