AI Agents Breach MyChart: The Challenge of EHR Integration Beyond FHIR
The Scrapers At MyChart's Gate - by Brendan Keeler -
An open-source AI agent was observed logging into Epic's patient portal.
Summary
An open-source AI agent logged into Epic's patient portal, 'MyChart,' granting access to patient data. This capability surpasses traditional FHIR-based APIs and TEFCA services, highlighting the urgent need for broader EHR integration strategies.
Key Players
Details
An open-source tool, dubbed 'mychart-connector,' has demonstrated a method to connect to MyChart, Epic's primary web application. This connector uses patient credentials and automatically handles Two-Factor Authentication (TOTP) to log in. The concern is that it exposes over 35 tools capable of both reading and writing various types of patient data—including medications, lab results, messages, appointments, billing, and insurance—mirroring nearly every action a patient can perform through the user interface. The article notes that previous standardized APIs, such as FHIR-based or TEFCA Individual Access Services, were limited in scope (e.g., restricted to USCDI data elements) or read-only. In contrast, this AI agent tool can execute
Technology Note
FHIR（Fast Healthcare Interoperability Resources）は医療データ交換の国際標準。このエントリの関連技術: FHIR
Original content copyright by respective publishers