EHR API and medical records API
How apps read and write health records over FHIR: hospital EHR APIs vs a patient-controlled records API, what each covers, GDPR and EU hosting, and HIPAA (planned, not yet available).
An EHR API (electronic health record API, also called an EMR API or medical records API) lets software read and write a patient's health record — demographics, diagnoses, medications, allergies, results, documents — over the internet, usually as HL7 FHIR R4 resources behind OAuth. Hospital EHR vendors such as Epic and Oracle Health expose FHIR APIs to their own records, and in the US certified EHRs must offer patient access through such APIs. Anpheros is a different piece: a patient-controlled medical records API that any app can build on, where clinics, laboratories, apps and devices write into one FHIR R4 record per person and access needs that person's consent.
- Your app or AI agentPatient app, clinic tool, analytics, assistant
- Hospital EHR APIsEpic, Oracle Health and others expose FHIR APIs for their own records
- Patient-controlled record (Anpheros)One FHIR R4 record per person, written by clinics, labs, apps and devices
- Consent and auditOAuth 2.1 grants chosen by the patient; every access logged
- Storage in the EUGoogle Cloud europe-west4; HIPAA support is planned, not available yet
Two kinds of medical records API
| Hospital EHR API (e.g. Epic, Oracle Health) | Patient-controlled records API (Anpheros) | |
|---|---|---|
| Whose records | One hospital or health system | One person, from every source that writes to it |
| How you get access | App registration with the vendor, often per health system | Self-service sandbox key; production after a data processing agreement |
| Who authorises | The health system, and the patient for patient-access apps | The patient (OAuth consent) or your organisation for the patients it creates |
| Writing data | Limited, depends on the vendor | Create, update and delete your own resources; provenance on every write |
| Standard | FHIR R4 (US Core in the US) | FHIR R4 plus a simpler REST API |
| Best for | Reading what a hospital recorded | Building a product on a record people carry with them |
They work together: an app can read a hospital EHR through its API and keep the person's own record in Anpheros, with the hospital as the recorded source.
What the Anpheros records API covers
| Part of the record | FHIR resource | REST v1 |
|---|---|---|
| Demographics | Patient |
/v1/patients |
| Diagnoses | Condition (ICD-10) |
/v1/patients/{id}/conditions |
| Medications | MedicationStatement (ATC) |
/v1/patients/{id}/medications |
| Results and vital signs | Observation (LOINC) |
/v1/patients/{id}/observations, lab import |
| Documents | DocumentReference |
/v1/patients/{id}/documents |
| Everything, in order | Patient/$everything |
/v1/patients/{id}/timeline |
| A shareable summary | Patient/$summary (IPS) |
— |
# one patient's active problems, as FHIR
curl "https://platform.anpheros.com/fhir/R4/Condition?patient=$PID&clinical-status=active" \
-H "Authorization: Bearer $KEY"
Compliance and data location
- GDPR and the EU: data is stored and processed in the European Union (Google Cloud
europe-west4, Netherlands); every read and write is logged and visible to the patient; access by other applications requires the patient's consent. - HIPAA: support for HIPAA, including a business associate agreement (BAA), is planned for the US market and not available yet. Until then, do not store protected health information that falls under HIPAA in Anpheros.
Frequently asked questions
What is an EHR API?
An interface through which software reads and writes electronic health records, usually HL7 FHIR R4 resources such as Patient, Condition, MedicationStatement and Observation, authorised with OAuth and SMART on FHIR.
What is the difference between an EHR API and an EMR API?
In practice the terms are used interchangeably. EMR traditionally means one practice's record; EHR, a record meant to be shared across providers. Both are usually exposed as FHIR APIs today.
Can I access a hospital's EHR through Anpheros?
No. Anpheros does not connect to hospital EHRs on its own. Your app can read a hospital's FHIR API separately and store what the person allows in their Anpheros record.
Is there a free medical records API for developers?
Yes. The Anpheros sandbox is free, with 30 synthetic patients over FHIR R4 and REST; production starts at €49 a month.
Is Anpheros HIPAA compliant?
Not yet. Anpheros is built for GDPR and EU data residency; HIPAA support with a business associate agreement is planned for the US market and not available today.