How do clinical AI models integrate into EHR workflows?

Clinical AI integrates via three primary patterns: (1) SMART-on-FHIR apps embedded in the EHR UI that call AI APIs on demand; (2) CDS Hooks that fire at specific workflow junctures (order entry, result review) and return AI recommendations; and (3) background FHIR subscription processors that trigger AI analysis when resource criteria are met, writing results back as DiagnosticReport or Observation resources.

What is the difference between edge and cloud inference for clinical AI?

Edge inference runs AI models on local hardware (on-prem servers, edge GPUs, or dedicated AI boxes within the hospital network). Cloud inference sends data to a third-party API. Edge keeps PHI on-premises (critical for HIPAA compliance) but requires hardware provisioning. Cloud offers scalability but introduces data egress, latency, and shared-tenant risk.

What audit trail requirements exist for clinical AI in EHRs?

HIPAA requires audit logs of all PHI access. For clinical AI, this means logging: (1) what data was sent to the AI model, (2) what model version processed it, (3) what output was generated, (4) what clinician reviewed/edited/accepted the result, and (5) any model retraining events. These logs must be immutable, time-stamped, and retained for 6+ years. FHIR AuditEvent resources are the standard mechanism.

← Technology in Medicine

Clinical AI Observatory

EHR / FHIR Integration Architecture for Clinical AI Reviewed 2026-10-24

BLUF: Clinical AI integrates into EHR workflows via three patterns — SMART-on-FHIR apps, CDS Hooks, and FHIR subscription processors. Edge inference keeps PHI on-prem but requires hardware; cloud offers scale but introduces data-egress and shared-tenant risk. Audit trails must cover data-in, model-version, output, clinician review, and retraining events — all immutable and FHIR AuditEvent-compliant.

The Three Integration Patterns

Pattern 1 — SMART-on-FHIR App: An AI-powered app embedded in the EHR UI (e.g., Epic's App Orchard or Cerner's Code). The clinician launches the app, which authenticates via OAuth2 and retrieves FHIR data (Patient, Observation, DiagnosticReport, etc.), sends it to an AI API, and renders the result. Best for:on-demand AI tasks like differential diagnosis assistants.

Pattern 2 — CDS Hooks: The EHR fires a hook at a workflow juncture (e.g., order-sign, patient-view, medication-prescribe). The AI service receives the hook payload, evaluates against FHIR context, and returns a card with recommendations. Best for:passive interventions like drug-interaction checks or sepsis risk alerts.

Pattern 3 — FHIR Subscription Processor: A background service subscribes to FHIR resources via Subscription (e.g., "notify when a new Observation of type 'lab-result' is created"). The processor triggers AI analysis automatically and writes results back as DiagnosticReport or Observation resources. Best for:continuous monitoring like image auto-analysis or vital-signs anomaly detection.

Edge vs. Cloud Inference — When to Use Each

Consideration	Edge Inference	Cloud Inference
PHI Control	Data never leaves hospital network. HIPAA-compliant by architecture.	Potential PHI exposure to third-party infrastructure. Requires BAA + encryption in transit/at rest.
Latency	10–50ms intra-hospital. Near-zero network round-trip.	100–500ms depending on proximity and payload size.
Scalability	Limited by on-prem GPU capacity. Requires procurement cycles.	Instantly elastic. Serverless scaling up to any load.
Model Updates	Manual or orchestrated push to edge nodes. 1–2 week cycle typical.	Real-time A/B testing. Instant rollback capability.
Total Cost	Hardware amortization + ops staff. Lower per-unit token cost.	Pay-per-use. No upfront capital, but higher per-token rate.
Best For	Radiology images, histopathology slides, genomics, any high-sensitivity data.	Text summarization, note generation, triage scoring on de-identified data.

Audit Trail Requirements (HIPAA)

Required FHIR AuditEvent Resources for Clinical AI

↓

1. Data Retrieval Event

AuditEvent.type=110100 (Application Activity) — logs which FHIR resources were fetched for AI input, by which user/app, at what timestamp.

2. Model Execution Event

AuditEvent.type=110105 (Privacy/Auth Export) — logs model name, version, input hash, and output summary. Supports both edge and cloud.

3. Result Write Event

AuditEvent.type=110106 (Privacy/Auth Import) — logs when AI output is written back to EMR as FHIR resources (Observation, DiagnosticReport).

4. Clinician Review Event

AuditEvent.type=110102 (User Authentication) — logs who reviewed, edited, accepted, or rejected the AI output, with timestamp and action.

Sample AuditEvent for a Chest X-Ray AI Result

{
  "resourceType": "AuditEvent",
  "type": { "code": "110106", "display": "Privacy/Auth Import" },
  "action": "C",
  "recorded": "2026-10-24T14:32:01Z",
  "outcome": { "code": "0" },
  "entity": [
    {
      "what": { "reference": "Device/ai-model/chest-xray-vision-2026-q3" },
      "role": { "code": "18" }
    },
    {
      "what": { "reference": "Observation/cxr-ai-result-20261024-1422" },
      "role": { "code": "8" }
    }
  ],
  "agent": [
    { "who": { "reference": "Practitioner/radiologist-123" }, "role": { "code": "110152" } }
  ]
}

All AuditEvent resources must be immutable, time-synchronized (NTP), and retained for minimum 6 years per HIPAA §164.312(b).

Common Integration Architecture Diagram

Reference Architecture: AI Triage via CDS Hooks + FHIR Subscription

EHR (Epic/Cerner) →

↕ CDS Hooks Service →

↕ FHIR Subscription Processor →

↕ AI Inference Engine (Edge/Cloud) →

↕ FHIR DiagnosticReport Writer →

↕ EHR UI (AI Card Display) →

Clinician Review & Acceptance

The CDS Hook fires at order-sign; the FHIR subscription watches for new image studies; the inference engine analyzes; results return as DiagnosticReport; the EHR UI surfaces it for clinician sign-off. Each step generates an AuditEvent.

Reviewer & Review Metadata

Metadata	Value
Reviewer Name	Arjun K. Mehra
Credentials	MS, Biomedical Informatics, HL7 FHIR Certified
Review Date	2026-10-24
Re-review By	2028-04-24
Review Cycle	24 months
Confidence Score	0.91 (System-1 JEV gate)
Sources Verified	3 HL7 implementation guides, 2 peer-reviewed, 1 Epic technical doc

View this note in the Obsidian-provenance vault: /evidence/ehr/fhir-integration-architecture.md