OpenAI's health records product relies on US privacy law, lacking equivalent in India

OpenAI has begun integrating its ChatGPT with Epic, the largest electronic health record system in the United States, allowing clinicians to query patient data. The feature enables healthcare providers to ask questions about patient history, such as changes since the last visit, with answers compiled from appointment notes, lab results, and medications.

The announcement, made on September 1, 2026, also included a Healthcare Public Data plugin, offering structured access to datasets like ClinicalTrials.gov and PubMed. This product's functionality is underpinned by the US Health Insurance Portability and Accountability Act (HIPAA). OpenAI provides a Business Associate Agreement, a contract necessary for vendors handling protected health information under HIPAA in the US.

In India, there is no equivalent legal framework. The country does not have a health-sector-specific privacy statute, nor a concept of a business associate with direct statutory obligations. Since 2023, medical records are not legally treated as distinct from other personal data. Consequently, a product built around HIPAA has no comparable legal structure to attach to in India.

Access to the OpenAI product is tiered. ChatGPT for Healthcare customers receive the Epic integration, while ChatGPT Enterprise customers can request it as part of a "Regulated Workspace." Individual clinicians in the US can only access the public data plugin. OpenAI states that data shared through ChatGPT for Healthcare is not used for model training.

OpenAI reports that physicians reviewed over 700,000 model responses, rating 99.1% as safe. However, "safe" is not synonymous with "accurate" or "clinically useful." This vendor-conducted evaluation's methodology has not been publicly detailed.