Read access and write access serve different purposes, yet EHR integration often creates early friction when clinics assess outreach tools. Vendors may cite "deep EHR integration" or "bidirectional data sync" without defining either term. Clinics must also consider security, workflow disruption, and technical demands their staff may not be equipped to manage.
Most outreach tools do not require the degree of EHR integration vendors may suggest. The issue becomes clearer once you identify which data must move and in what direction. That is what we have learned while building and deploying integrations with the EHRs already used by our early-access clinics.
Read access versus write access
For outreach, EHR integration is mainly a read-access task. The tool needs to identify patients with visits, the visit dates, and ordered follow-up actions. Correctly timed messages require encounter details: who was seen, when, by whom, and what was ordered or referred.
Write access allows a tool to add notes, update records, or create EHR documentation. It is a higher bar and is often unnecessary for effective outreach. Some coordinators reasonably want response data returned to the patient record. For a clinic beginning automated follow-up, however, read access to patient and encounter data is the functional requirement. Write access can follow later.
The distinction matters because write access brings considerably greater security review, administrative work, and implementation complexity. A vendor that requires bidirectional EHR integration before outreach can begin is requesting more than the workflow needs.
FHIR and small practices
Fast Healthcare Interoperability Resources (FHIR), published by HL7, is now the dominant framework for healthcare data exchange in the United States. The 21st Century Cures Act required EHR vendors to support FHIR-based application programming interfaces. As a result, most modern EHRs, including Epic, athenahealth, eClinicalWorks, and several others, provide patient and encounter data through standardized FHIR endpoints.
For a small clinic, this is good news. With FHIR-based integration, an outreach tool built for the standard can request needed data in a common format instead of requiring a custom point-to-point connection for every EHR. The clinic still must authorize the connection and review the shared data, but an EHR IT team may not be needed to build a custom API. The EHR's FHIR interface is the on-ramp.
The practical constraint is that FHIR API availability and scope differ by EHR vendor and contract tier. Smaller EHRs and older legacy systems may offer limited or no FHIR support. In those cases, integration may use HL7 v2 messaging, CSV exports, or vendor-specific APIs where available.
Webhooks versus polling
Once data access is settled, another technical choice remains: does the EHR push updates to the outreach tool through webhooks, or does the tool request updates periodically through polling?
Webhooks suit real-time triggers. To start outreach within minutes of discharge, use a webhook that fires when the EHR encounter is finalized. When exact timing matters less and nightly or twice-daily syncs are acceptable, polling is simpler and needs fewer EHR-side configurations.
For most care coordination outreach, polling once or twice daily is sufficient. The first automated follow-up message after a visit typically goes out at 24 hours, not within minutes of discharge. Hourly polling meets the timing needs of virtually all follow-up sequence designs. Webhooks are more useful for high-volume practices where daily batch syncs create meaningful workflow bottlenecks.
What we actually do at CTPathways
We designed our integration layer around FHIR read access first to reduce the implementation burden for small practices. For EHRs with strong FHIR support, we use OAuth 2.0 SMART on FHIR authorization to request patient demographics and encounter data with explicit scope limits. Authorization runs through the EHR's existing app marketplace or integration approval process, so the clinic's EHR administrator, not us, manages connection setup.
For practices whose EHR lacks FHIR API support, we use secure CSV exports via SFTP as a fallback. This approach is less elegant, but it works when staff can schedule a daily export from the EHR system. It is not our preferred method, though it lets clinics begin outreach automation without waiting for their EHR vendor to modernize.
We request a deliberately limited data set: patient name, patient contact information, encounter date, ordering provider, and a basic encounter type flag for routing the appropriate outreach template. We do not request full clinical notes, diagnosis codes, or medication records unless a specific coordination workflow requires them. Minimum necessary access is both a HIPAA principle and sound operational hygiene.
Questions to ask before choosing an EHR integration
Ask any outreach tool vendor which EHRs it supports natively and how each connection works. FHIR API, HL7, CSV export, and EHR-specific API are distinct methods. The answer should address your EHR specifically, not offer a generic "we integrate with most major EHRs" response.
Next, ask for the minimum EHR data scope needed for core outreach. Requiring full chart access for post-visit follow-up is a scope mismatch worth challenging. Also ask how authorization works and who manages it. Ideally, your EHR administrator handles a documented process under the vendor agreement, rather than using a shared credential.
Ask what happens to EHR-sourced data when the relationship ends. Your BAA should address portability and deletion at contract termination.
The integration floor that works
For a 4 to 8 provider outpatient practice adding follow-up automation, the minimum viable integration is read access to encounter data daily or twice daily, through whatever method the EHR vendor supports. That can trigger sequenced outreach after visits, identify non-responders for coordinator action, and track referral follow-up status.
If the EHR offers no programmatic export and staff must manually enter patient information into a separate outreach tool, the workflow burden is worth avoiding. If it offers any export or API access, including a scheduled CSV download, that is likely enough to begin. Outreach integration is usually less complex than clinics expect once the specific options are clear.
Ready to close care gaps at your practice?
Join our early-access program. Setup takes one afternoon.