Every founder building anything clinician-facing eventually hits the same wall: Epic. With roughly 40% of the U.S. hospital EHR market, Epic is the integration your enterprise buyer will ask about before they ask about anything else. The documentation is sparse by design, and most teams underestimate the timeline by two to three times.

Start with SMART on FHIR, not a custom interface

The standard path in is Epic's FHIR APIs using SMART on FHIR for OAuth-based authorization. In practice this means you register on Epic's developer platform, build against their FHIR R4 endpoints, and authenticate through SMART's launch framework rather than negotiating a proprietary interface. Registration, sandbox access, building against the FHIR APIs, and the certification timeline are the four phases every team goes through, and each one has a realistic cost and duration most startups do not plan for.

The four phases and what they actually take

  1. Registration and sandbox access. Fast: days, not weeks. Epic's developer portal gives you sandbox credentials quickly. This is the part that makes integration feel easy at first.
  2. Building against the FHIR APIs. This is where teams get surprised. Not every FHIR resource is fully supported for every use case, and Epic's implementation has quirks versus the base FHIR spec that only show up once you are building against real (non-sandbox) data structures. Budget several sprints, not one.
  3. Showroom approval. This is the step nobody documents well. Getting your app listed and approved for production use, sometimes called Connection Hub placement now, requires a security review, a clinical workflow review, and Epic's own internal sign-off. The process nobody documents commonly runs 8 to 16 weeks depending on your app's data scope and whether you are read-only or writing back into the chart.
  4. Per-site go-live. Even after Showroom approval, each hospital system still has to enable your app in their own Epic instance, configure their side of the OAuth client, and often run their own security and clinical validation. Vendors quoting "2 to 4 weeks" go-lives are typically describing this last step alone, assuming Showroom approval and a signed contract are already done.

Build, buy, or partner: the real decision

Most early-stage teams should not build their own FHIR integration layer from scratch. The build, buy, or partner decision comes down to how core the integration is to your product's differentiation. If your product's value is entirely in what happens with the data once you have it, an integration engine or interoperability platform vendor gets you to a working pilot faster and lets your engineering team focus on the product. If deep, bidirectional, real-time EHR interaction is your actual moat, building it in-house is worth the time, but plan for a dedicated integration engineer, not a part-time assignment.

What it costs beyond engineering time

  • Epic's own fees: connection and per-site fees vary and are not always published up front. Ask early, not after your pricing model is locked.
  • Security review preparation: SOC 2, penetration testing, and a completed security questionnaire are prerequisites for Showroom, not a parallel track.
  • Clinical workflow validation: Epic and the hospital's own informatics team will want to see how your app behaves inside the actual clinical workflow, not just that the API calls succeed.
  • Per-site variability: no two Epic instances are configured identically. Budget for site-specific troubleshooting even after your first successful go-live.

Do not treat Epic as your only integration

Cerner (Oracle Health), MEDITECH, and athenahealth collectively cover a large share of the remaining market, and many payer-facing and interoperability workflows increasingly route through national networks and FHIR-based Connection Hub-style ecosystems that pre-configure payer and interoperability workflows. If your buyer base spans multiple health systems, plan your integration architecture around FHIR standards generally, not Epic's implementation specifically, so the second and third EHR are incremental work rather than a second full build.

Practical checklist before you start

  • Confirm which FHIR resources you actually need (Patient, Observation, MedicationRequest, etc.) before writing code.
  • Register for Epic's sandbox in parallel with your security prep, not after.
  • Get your SOC 2 process started at least two quarters before you expect to need Showroom approval.
  • Identify one design partner hospital willing to be your first live Epic site.
  • Budget go-live timeline in quarters, not weeks, for your first customer.

The takeaway

Epic integration is not a technical checkbox, it is a multi-quarter organizational project spanning engineering, security and clinical validation. Teams that plan for 6 to 9 months from first sandbox call to first live site are usually right. Teams that plan for 6 weeks are the ones renegotiating customer contracts in month four.