Epic In Basket Art

A generative feature inside an electronic health record. Message drafting produces 'automatically drafted potential responses' to patient messages inside Epic's In Basket, and Epic's May 2023 announcement with Microsoft introduced it as generative AI built on GPT-4; the draft does not exist without the model.

But it is one of more than thirty features Epic now groups under Art, 'Epic's AI for clinicians', inside a record system whose value stands without it, and it is available only to Epic customers. The AI is a feature layer on the record.

The oversight structure is simple and described: the feature drafts a potential reply and a clinician decides whether to use, edit or discard it, and nothing is sent without that clinician. Epic's Art page describes 'automatically drafted potential responses' for clinicians, and the Patient Message Insights feature shows medications, problems and results beside the message as they reply; the Stanford evaluation (Garcia and colleagues, JAMA Network Open, March 2024) found clinicians used a draft for about 20 percent of messages, which shows the choice is real.

A related feature translates incoming Spanish messages and shows a translated preview so a clinician can check 'whether the message requires urgent action'; the urgency judgment stays with the clinician. What is missing is the part after the draft is wrong: Epic publishes no message types excluded from drafting, no abstention behavior for a message it should not answer, and no rate at which drafts contain errors, so a clinician reviewing a draft is told nothing about where it tends to fail.

The model is named without the version and update discipline behind it. Epic's May 2023 announcement with Microsoft says the In Basket draft reply feature is generative AI built on GPT-4, and its Artificial Intelligence page describes a 'HIPAA-compliant pipeline' that 'incorporates state-of-the-art language models, like GPT-4'. The Stanford evaluation (Garcia and colleagues, JAMA Network Open, March 2024) adds that GPT-3.5 Turbo categorized messages and GPT-4 drafted replies at that site.

Epic publishes no model card, no statement of which model version drafts replies today, no description of the prompts and chart context sent with each message, and no update or change notice practice; that documentation sits behind the customer login. A buyer knows the model family, not when it changed.

The model provider is named and the terms that govern data once it arrives are not published. Epic's May 2023 announcement says the draft reply feature came from its work with Microsoft to bring GPT-4 into the record, and its Artificial Intelligence page describes a pipeline that incorporates language models 'like GPT-4', so a buyer can identify the model family and the cloud partner.

What is not public: a subprocessor list for the feature, which Microsoft service processes the request and in which region, whether message and chart content sent to the model is retained or logged, and whether it is excluded from training. Epic's Data Privacy Framework policy (effective 13 March 2026) says Epic passes personal data to third parties only for uses its healthcare customers authorize, and names Epic Hosting among its subsidiaries, but it does not address the model call.

Independent, prospective, peer reviewed evaluations at more than one health system, and they do not find the time saving the marketing leads with. Epic's Art page says clinicians 'can respond to patient messages faster', and its Mayo Clinic story reports initial pilots saving nurses about 30 seconds per message.

Garcia and colleagues (Stanford, JAMA Network Open, March 2024; no Epic authors) ran a five week prospective quality improvement study with 162 clinicians: drafts were used for 20 percent of messages, reply, write and read times did not change, and task load (61.3 to 47.3) and work exhaustion (1.95 to 1.62) scores fell.

Tai-Seale and colleagues (UC San Diego, JAMA Network Open, April 2024; no Epic authors) compared 52 physicians with 70 controls across 10,679 replies: read time rose 21.8 percent, reply time did not change significantly (minus 5.9 percent), and replies were 17.9 percent longer. Each study is single site, at an academic center, with that site's own prompts, so results may not carry to a differently configured organization. The published evidence points to lower burden rather than time saved.

General assurances that do not answer the questions a model call raises. Epic's Artificial Intelligence page describes a 'HIPAA-compliant pipeline' for language models like GPT-4, and its Data Privacy Framework policy (effective 13 March 2026) says Epic processes patient data as a processor for its healthcare customers, that staff access customer data only with permission, and that data passes to third parties only for uses customers authorize.

Nothing public states whether patient messages and chart context sent to the model are retained or logged by Epic or Microsoft, for how long, whether they are excluded from training, or whether anything is de-identified. Safety engineering, meaning guardrails on drafted replies, hallucination mitigation and how a safety event is handled, is not published. Epic's other public privacy policies cover its websites and apps.

A privacy document reaches the service, with no business associate statement. Epic's Data Privacy Framework policy (effective 13 March 2026) describes Epic as a data processor or service provider to its healthcare customers and says staff access patient data only with the customer's permission, and the Artificial Intelligence page calls the generative pipeline 'HIPAA-compliant'. No public statement of business associate status, agreement terms, or how those terms cover the model call to Microsoft exists; those sit in each customer's Epic contract.

Controls are asserted with nothing independent published. Epic's public pages describe a 'HIPAA-compliant pipeline' for its generative features and link privacy policies, but name no SOC 2 report, ISO/IEC 27001 or HITRUST certification, penetration testing cadence or trust center; compliance documentation reaches customers through Epic's login-only UserWeb.

For self hosted customers much of the security picture belongs to the health system's own environment, but the drafting model comes through Epic's partnership with Microsoft, and Epic does not say where it runs or which certifications cover that path.

No clearance, and no regulatory position published. The feature drafts replies to patients' medical advice messages, which is clinical content, but the draft goes to a clinician who sees the patient's message and the chart beside it and decides what to send, so the basis of every output is in front of the person accountable for it. Epic has not said publicly how it classifies the feature.

Nothing Epic publishes says how the drafting model's behavior is governed or tested. The Art for Clinicians and Artificial Intelligence pages, the AI announcements and the privacy policies carry no responsible AI policy for generative features, no evaluation of draft accuracy, and no results by patient group, language, reading level or message type; the Generative AI documentation listed on the Art page is behind the customer login.

The Stanford and UC San Diego evaluations measured use, time and burden, not how drafts differ across groups of patients. Prompts are configured by each health system, so part of the governance falls to the customer.

Review before commit is the mechanism, and nothing stands behind the output. Every draft is a proposal a clinician uses, edits or discards before anything reaches the patient, with the patient's message and chart context beside it, so an error can be caught at the point of use. Epic publishes no error rate for drafts, no limitations list, and no warranty, indemnity or remediation commitment for the feature, and no route is described for a patient harmed by a reply that began as a draft.

The feature is part of Epic's own record system: it reads the patient's message and chart inside Epic and places the draft in the clinician's In Basket, with no interface to build. What matters beyond that is how the record system exchanges data with systems outside it.

Epic's interoperability page says Care Everywhere exchanges more than 30 million patient records a day, about half with organizations on a different record system, with a published list of live organizations, alongside FHIR APIs for patient-directed exchange and more than 1,000 public API and interface specifications on open.epic. The chart a draft draws on can therefore include records received from other systems. On the other side, the feature runs only inside Epic and cannot be bought or evaluated by an organization on another record system.

The record system runs where the customer's Epic runs, on its own infrastructure or with Epic Hosting (named in Epic's Data Privacy Framework policy), but the drafting model comes through Epic's partnership with Microsoft, and Epic publishes nothing on where the model runs, in which region, or how one customer's requests are separated from another's. For the part of the feature that matters to residency, location is implied rather than committed.

No price, and the buying route can be established. The feature is available only to Epic customers, switched on inside their Epic installation, and Epic's Artificial Intelligence page directs community members to their Epic representatives to learn more. Whether it carries a charge beyond the existing Epic license, whether any charge scales with draft volume, and whether prompt configuration needs paid services are not published. The comparison a buyer faces is between a feature inside a system already licensed and a separately contracted product with its own price.

Coverage is named with validation behind part of it. The feature serves ambulatory patient medical advice messages in the In Basket, used by physicians, advanced practice providers and nurses. Validation comes from academic centers: Stanford Health Care (Garcia and colleagues, JAMA Network Open, March 2024, 162 clinicians) and UC San Diego Health (Tai-Seale and colleagues, JAMA Network Open, April 2024, 52 physicians), with Epic's own Mayo Clinic story describing ambulatory nurses.

Epic publishes nothing that shows which specialties, community settings and nurse versus physician uses have results behind them. Results release, refills and document handling are separate Epic functions outside this feature.