Patients do not get their care in one place. Someone who has lived in two cities and switched jobs once can easily have records at five different Epic health systems. Until now, pulling those records meant five separate sign-ins: find the right MyChart, remember which email you used, reset the password, approve the scopes, repeat.
Epic already solved the account half of this problem with MyChart Central, which lets a patient link their MyChart accounts across organizations under a single login. Today we're announcing support for the data half: Epic MyChart Central community authorization. A patient signs in with their Epic ID once, sees the organizations they have already linked, picks the ones they want to share, and Flexpa retrieves records from all of them in a single pass.
How it works
When a patient authorizes an Epic organization through Flexpa, we request Epic's community scope alongside the usual patient scopes. If the organization supports it, Epic returns the list of other organizations linked to that patient's MyChart Central account and presents a picker. The patient chooses, and Epic returns one subject token per organization. Flexpa redeems each of those for that organization's access token using RFC 8693 token exchange, then uses the access token to retrieve the records.
From the patient's side it is one sign-in instead of five. From the developer's side nothing changes: the additional organizations arrive as ordinary FHIR resources through the same Flexpa API, and each one is recorded as its own authorization so you can see exactly where a given record came from.
Where it works today
Unfortunately, community authorization is not yet uniformly available across Epic's install base.
An organization has to clear three gates. The first is whether it offers an Epic ID at all. Not every Epic organization uses MyChart Central, and one that does not cannot be linked there, so a patient signs in to it on its own no matter what else is true. The second is its Epic version: the August 2026 release and later have the feature on automatically, the May 2026 release can have it switched on but does not by default, and anything earlier cannot offer it at all. The third is TEFCA participation.
There is no way to tell in advance which release a given organization is running, so the behavior a patient sees depends on where they happen to sign in. If their organization qualifies and they sign in with their Epic ID rather than that facility's own MyChart username, the picker appears. If either of those is missing, the flow proceeds exactly as it does today: they authorize that one organization, and anything else has to be connected separately.
What this does not replace
Community authorization covers Epic organizations a patient has already linked in MyChart Central. It does not discover organizations the patient has never connected, and it does not reach outside Epic.
That remains the job of the rest of the network. Flexpa's TEFCA national network searches for a patient's records across participating organizations regardless of which EHR they run, and our payer connections cover claims and coverage history from more than 350 health plans. Community authorization is a shortcut within Epic for records a patient already knows about, layered on top of that.
"Collecting a health record has always meant proving who you are to organizations that already know you. Community authorization lets a patient do that once and bring back records from every Epic organization they've linked. Flexpa is already working on many exciting new features and this unlocks more for us," said Andrew Arruda, Co-Founder and CEO of Flexpa.
About Flexpa
Flexpa helps patients share health records from insurers, medical record systems, and nationwide exchanges. Developers use Flexpa to build agents for clinical trials, benefits navigation, and healthcare services. Powered by a 3-in-1 network: CMS-9115, ONC (g)(10), TEFCA IAS. With patient consent, IAL2 identity proofing, SMART Health Links, and FHIR® API. Learn more at flexpa.com.
