Six Layers for Integrating AI Agents with EHRs: Why FHIR Is Not Enough

Details

While many health systems are piloting agentic AI, few have successfully deployed agents into live workflows. This gap is attributed not to poor models but to missing architecture. FHIR API provides the structured data 'door,' but an autonomous agent requires a full stack of six layers. These include: 1) Identity (who the agent acts for), 2) Authorization (what it can touch), 3) Live Data Access (real-time FHIR reads, not nightly exports), 4) Write-back (output landing in the EHR), 5) Audit Trail (logging every action), and 6) Human Review (clinical approval for consequential actions). Agents operate differently from traditional apps; they act system-to-system without a human user logged in. Therefore, while SMART on FHIR remains relevant, it must be used with backend services flow, narrow scopes, per-action checks, and short-lived tokens. The article advises starting implementation not with clinical care, but with the revenue cycle (e.g., eligibility checks or prior authorization tracking) because errors are financially correctable, providing a faster path to production.