The code is not the calendar
Teams estimate the integration as an engineering task and get the estimate roughly right — then miss the ship date by three quarters. The code was never the constraint. Access was.
Federated access is the critical path
There is no central Epic endpoint. Each customer runs its own Epic instance with its own FHIR base URL, its own credentials, its own security posture, and its own change windows. "Epic integration" is therefore not one integration; it is one build plus N approvals.
Where the months go
- Finding and holding an executive sponsor inside the health system.
- The hospital security review: a long questionnaire, an evidence packet, and follow-up cycles. Weeks at best, longer when your posture has gaps.
- Legal and the BAA, in parallel and rarely fast.
- IT provisioning and the hospital's release calendar.
- Showroom, if you pursue it: intake typically weeks 1–3, Epic review commonly weeks 2–8.
These are ranges on purpose. Anyone who collapses them into one number is describing one stage.
Showroom is not the long pole — and not a required pole
A listing makes you discoverable and is how multi-hospital third-party distribution works in practice. It is optional after you have a live customer connection, and it does not shorten the first hospital's security queue. See Showroom vs a runtime.
The wrong-path trap
The "48 hours to every Epic hospital" claim describes patient-facing USCDI read-only distribution, not a clinician in-chart launch with write-back under a BAA. Teams that plan against it discover the mismatch after the security questionnaire arrives. The two paths are separated in how to get your app into Epic.
What actually compresses
- Have the evidence packet ready before the questionnaire arrives — SOC 2 Type II, pen-test summary, sub-processors, data flows, incident response.
- Don't over-scope. Fewer FHIR scopes and a narrower write surface means a shorter review.
- Run on a runtime that has already been through this, so hospital ten is not a rerun of hospital one.
Frequently asked questions
How long does Epic integration really take?
The SMART code against a sandbox is usually weeks. The calendar is access: an executive sponsor, the hospital security review, the BAA, and the IT provisioning queue. Epic's own Showroom review commonly runs weeks 2–8 after intake, and per-hospital work repeats at each new customer. Anyone quoting a single number is quoting one stage, not the path.
Why isn't the sandbox enough?
A sandbox proves your app works against synthetic data. It proves nothing about the hospital's risk posture, so every hospital still runs its own review before giving you production credentials.
Does a Showroom listing speed up the first hospital?
Rarely. The listing helps discovery and multi-hospital distribution. Your first hospital usually already knows you — the slow part is their security review and IT queue, which the listing does not shorten.
Why is the tenth hospital still slow if FHIR is standard?
Because access is federated, not the standard. Each Epic customer runs its own instance, its own credentials, its own security questionnaire, and its own change window. FHIR being standard means your code is reusable; it does not mean the approvals are.
Can a runtime make Epic's IT queue faster?
No. A runtime removes your repeat compliance grind — hosting, BAA, SOC 2 evidence, launch plumbing, quarterly Epic maintenance. It does not move the hospital's queue.
Do I need ONC certification to integrate with Epic?
No. ONC Health IT certification applies to the EHR, not to third-party SMART apps. Hospitals ask for HIPAA posture, a BAA, and security evidence — not an ONC certificate for your app.
Have a deal stuck on Epic?
SoFaaS™ is the compliant runtime that ships SMART on FHIR apps into Epic in weeks, not quarters.
Talk to us