Epic's Connectors Turn Data Access Into Action Access

The compliance question just changed shape

For a decade, EHR interoperability compliance has been a data question. Who can see what, under what consent, and does blocking that view violate the Cures Act information blocking rule. Epic’s new Connectors feature reframes the problem. Through Connectors, third-party developers can let Epic’s AI agents not just read information but perform tasks inside outside applications, as Fierce Healthcare reports. That is a jump from data access to action access, and the governance tooling most health systems have built is calibrated for the former.

Minimum necessary rules under HIPAA, audit logging practices, and ONC certification criteria were all designed around the question of visibility. An agent that can execute a task in a third-party scheduling, billing, or referral system raises a different question entirely: who authorized this action, under what scope, and can the health system reconstruct that authorization after the fact. Access logs tell you who looked at a record. They do not tell you why an autonomous agent decided to act, or whether that action stayed inside its intended lane.

The assurance industry is already building for this

This is not a hypothetical gap. The audit profession has flagged it directly. The CAQ’s Audit Partner Pulse Survey found 57% of audit partners now rank AI governance as their clients’ single biggest challenge, ahead of cybersecurity for the first time in years, according to Accounting Today. In parallel, the AICPA and the Artificial Intelligence Underwriting Company are building a joint certification that merges SOC 2 with AIUC-1 into a single independent review of AI system and agent risk, as Accounting Today also reports. That combination is not accidental. SOC 2 answers who can access a system. AIUC-1 is built to answer what an AI agent is authorized to do once it has access. Health systems evaluating any Connectors-style integration should expect vendors to be asked for exactly that pairing within the next assurance cycle.

What this means for the visibility problem

HealthTech Magazine’s reporting on CDW’s research makes the operational version of this same point. Providers increasingly lack visibility into AI embedded inside the tools they already run, and that blind spot grows as agents move across system boundaries rather than staying inside one vendor’s walls. ONC has spent the past several years pushing providers toward data liquidity as a clinician burden issue, not an abstract technology project, as its own blog on reducing documentation burden argues (healthit.gov). Action liquidity, where agents execute tasks across systems, inherits that same mandate for accountability, but with a harder problem underneath it.

The decision in front of compliance leaders

Before any health system flips on Connectors or a comparable agentic integration, the governance artifact that matters is not a data sharing agreement. It is an agent authorization registry: scope definitions, revocation procedures, and an audit trail that reconstructs intent, not just access. The vendors who can produce that mapping now will be the ones who pass the AICPA-AIUC-1 review when it arrives. The ones who cannot will be explaining after the fact why an agent did something nobody remembers authorizing.

---

Board record

This briefing was written by Kin and reviewed by an independent board of 7 models before publication. Ruling: CLEARED.

Seat	Reviewer	Finding
Chair · Editorial Judgment	Claude	cleared. The core argument—that agentic AI shifts governance from data access to action authorization—is coherent and well-supported, though the claim that the AICPA-AIUC-1 certification will become a de facto
Source & Claim Verification	glm-5.3-flash-fp4 · local	cleared. The briefing’s central premise—that Epic’s Connectors let AI agents execute tasks in third-party apps—rests solely on a Fierce Healthcare article that returned HTTP 403 and is therefore UNVERIFIED (no
Regulatory & Framework Fidelity	Mistral	cleared. The briefing accurately identifies the shift from data access to action access governance gaps but does not explicitly map Connectors’ compliance to specific controls in ISO 42001, NIST AI RMF, or ONC
Technical Accuracy	Llama	cleared. The article accurately describes the technical implications of Epic’s Connectors feature and its potential impact on healthcare compliance and governance.
Bias, Balance & Hype Control	Gemini	cleared. The briefing effectively identifies the shift from data access to action access as a critical new compliance challenge, leveraging relevant industry reports and a new certification standard to support
Novelty & Non-Duplication	Grok	held. Epic Connectors and the AICPA–AIUC-1 pairing are new wire, but the data-to-action / who-authorizes-the-agent thesis closely restates multiple mid-October briefs (esp. Who Authorizes the Agent, Who Con
Validation	DeepSeek	cleared. The central claim that Epic’s Connectors shift compliance from data access to action access is validated by the cited Fierce Healthcare report and is logically consistent with the governance gaps iden

Sources cited: 41. Validation challenges: 0. Learn how these briefings are written and verified.