Written and maintained by CASRAI Editorial Board
Last updated
What Is DrChrono? Platform Overview and Operator
DrChrono is a cloud-based ambulatory Electronic Health Record (EHR), practice management, and medical billing platform operated by DrChrono Inc. (an EverHealth company) designed for physician practices, specialty clinics, and telehealth organizations. For health informatics engineers and clinical research technology teams, DrChrono is notable for providing two complementary interoperability layers: a proprietary read/write JSON REST API with event-driven webhooks, and an ONC-certified HL7 FHIR Release 4 (R4) API compliant with the 21st Century Cures Act standardized API mandate (45 CFR § 170.315(g)(10)).
Who Runs DrChrono and What Its Interoperability Stack Covers
Developed originally as a native iPad and web ambulatory EHR and acquired by EverHealth (formerly integrative practice solutions group), DrChrono EHR is listed on the ASTP/ONC Certified Health IT Product List (CHPL). Its technical architecture spans four functional domains relevant to ambulatory care delivery and real-world data (RWD) extraction:
- Ambulatory Charting and Clinical Documentation: Customizable medical templates, SOAP notes, vitals capture, problem lists (ICD-10-CM / SNOMED CT), electronic prescribing (eRx mapped to RxNorm), and electronic laboratory ordering/resulting.
- Practice Management and Revenue Cycle: Patient scheduling, insurance eligibility verification, institutional/professional claim generation, and CPT/HCPCS line-item billing.
- Proprietary REST API and Webhooks: Bidirectional operational endpoints enabling third-party software to create appointments, update patient intake demographics, upload clinical PDFs, and read structured chart notes.
- Standardized FHIR R4 and EHI Export: Patient-access, clinician-launch, and bulk population services built to US Core Implementation Guide profiles, alongside § 170.315(b)(10) Electronic Health Information (EHI) export capabilities.
How Does the DrChrono REST API and Webhook Architecture Work?
Unlike read-only FHIR endpoints designed primarily for USCDI data retrieval, the native DrChrono REST API exposes operational read/write endpoints used by clinics and digital health platforms to automate scheduling, intake, and documentation.
1. OAuth 2.0 Authentication and Permission Scopes
All requests to the DrChrono REST API require an OAuth 2.0 Bearer token obtained through the standard authorization code grant workflow:
- Authorization Endpoint:
https://app.drchrono.com/o/authorize/ - Token Exchange Endpoint:
https://app.drchrono.com/o/token/ - Granular Scopes: Applications request explicit least-privilege scopes during user authorization, including
patients:read,patients:write,patients:summary:read,patients:summary:write,calendar:read,calendar:write,clinical:read,clinical:write,labs:read,labs:write,messages:read,messages:write, andbilling:read. - Access and Refresh Tokens: Access tokens expire after a short window (typically 48 hours), requiring automated refresh via the
refresh_tokengrant type without repeated clinician sign-in.
2. Core REST Endpoints and Pagination
REST resources return paginated JSON objects (defaulting to 250 records per page maximum, navigated via the next cursor URL) and support filtering by since timestamp or doctor / office identifiers. Frequently used endpoints include /api/patients, /api/appointments, /api/clinical_notes, /api/clinical_note_field_values, /api/medications, /api/allergies, /api/problems, /api/documents, and /api/lab_results.
3. Event-Driven Webhooks Verification and Delivery
To avoid hitting API rate limits through continuous polling, developers configure webhook callback URLs inside the DrChrono API application settings:
- Secret Token Verification Handshake: When verifying a webhook callback URL, DrChrono sends a
GETrequest with amsgquery parameter. The receiving server must compute an HMAC-SHA256 digest ofmsgusing the application’s webhooksecret_tokenas the key and return{"secret_token": "<hex_digest>"}in a 200 OK JSON response. - Event Subscriptions: Once verified, DrChrono dispatches HTTP
POSTpayloads containing anX-drchrono-eventheader (such asAPPOINTMENT_CREATE,APPOINTMENT_MODIFY,PATIENT_CREATE,PATIENT_MODIFY,CLINICAL_NOTE_LOCK, or lab status events) and the updated resource payload.
What FHIR R4 Resources Are Supported by DrChrono?
To satisfy the ONC 21st Century Cures Act criterion 45 CFR § 170.315(g)(10) (Standardized API for Patient and Population Services), DrChrono exposes an HL7 FHIR R4 (v4.0.1) server supporting the SMART App Launch Framework (OAuth 2.0 / OpenID Connect with launch/patient,standalone launch, and backend system Bulk Data $export).
| USCDI Clinical Domain | Supported FHIR R4 Resource Type | Standard Terminology / Code System | Typical Research or Clinical Informatics Use |
|---|---|---|---|
| Demographics & Identity | Patient, Practitioner, Organization, Location |
Administrative codes, NPI, HL7 v3 AdministrativeGender | Cohort matching, site attribution, and demographic stratification |
| Problems & Diagnoses | Condition |
SNOMED CT, ICD-10-CM | Inclusion/exclusion phenotyping and comorbidity indexing |
| Medications & Prescriptions | MedicationRequest, Medication |
RxNorm, NDC | Concomitant medication tracking and adherence studies |
| Allergies & Intolerances | AllergyIntolerance |
RxNorm, UNII, SNOMED CT | Safety screening and contraindication checking |
| Vitals & Laboratory Results | Observation, DiagnosticReport |
LOINC, UCUM units | Longitudinal biomarker extraction and vital-sign trending |
| Clinical Notes & Documents | DocumentReference |
LOINC document type codes | Retrieving consultation notes, discharge summaries, and pathology reports |
| Procedures & Immunizations | Procedure, Immunization |
CPT, HCPCS II, SNOMED CT, CVX | Surgical history verification and vaccine registry linkage |
| Care Coordination & Lineage | Encounter, CarePlan, CareTeam, Goal, Device, Provenance |
SNOMED CT, UDI (FDA GUDID) | Tracking visit context, implantable device UDIs, and data provenance |
How Do Digital Health Startups and Research Teams Build Custom Clinical Apps on DrChrono?
Integrating an external digital therapeutics platform, remote patient monitoring (RPM) service, or clinical data management pipeline with DrChrono follows a six-step workflow documented in the official developer portal:
- Register the API Application: Inside an authorized DrChrono provider account, navigate to Account > API, create a new application entry, and record the generated
client_idandclient_secret. - Configure Redirect URIs and Scopes: Specify the exact HTTPS OAuth 2.0
redirect_uriendpoints used by your application and select only the minimum required permission scopes (for example,patients:readandclinical:readfor observational registry abstraction). - Implement the OAuth 2.0 Handshake: Redirect the authorizing physician or practice administrator to
https://app.drchrono.com/o/authorize/withresponse_type=code,client_id,redirect_uri, andscope; exchange the returned authorizationcodevia HTTP POST tohttps://app.drchrono.com/o/token/and securely store the encryptedrefresh_token. - Register and Verify Webhooks: Configure an HTTPS webhook receiver URL, enter a shared
secret_token, and complete the HMAC-SHA256 verification handshake so your service receives event triggers (`PATIENT_MODIFY`, `APPOINTMENT_CREATE`, `CLINICAL_NOTE_LOCK`) in real time. - Map Custom Clinical Note Fields or FHIR Resources: For structured data capture into custom EHR templates, query
/api/clinical_note_templatesand/api/clinical_note_field_typesfirst to obtain the practice’s internal field IDs before reading or writing/api/clinical_note_field_values; for standardized cross-EHR queries, target the FHIR R4Observation,Condition, andMedicationRequestendpoints. - Enforce Rate-Limit and Audit Logging Controls: Respect DrChrono’s hourly and per-minute API rate limits (handling HTTP
429 Too Many Requestswith exponential backoff) and log all PHI access events to maintain HIPAA Security Rule (45 CFR § 164.312(b)) audit trail compliance.
Strengths, Limits, and Ambulatory EHR API Alternatives
- Strengths: Self-service OAuth 2.0 developer registration inside provider accounts, granular read/write REST endpoints for scheduling and custom chart fields, native webhook support, and ONC-certified FHIR R4 compliance.
- Limits: Custom clinical note templates vary by individual physician practice (requiring per-practice field ID mapping when using the proprietary REST API rather than standardized US Core FHIR resources), and primarily serves ambulatory/outpatient clinics rather than acute inpatient hospital settings.
| Platform / Standard | Primary Care Setting | API Architecture | Typical Integration Use Case |
|---|---|---|---|
| DrChrono (EverHealth) | Ambulatory clinics, specialty practices, telehealth | OAuth 2.0 JSON REST API + Webhooks + FHIR R4 | Custom intake, telehealth scheduling, and outpatient RWD capture |
| Epic (MyChart / Orchard) | Acute health systems & enterprise academic medical centers | SMART on FHIR R4, HL7 v2, Care Everywhere | Hospital-scale EHR apps and enterprise trial recruitment |
| Oracle Health (Cerner) | Acute hospitals & integrated delivery networks | Millennium SMART on FHIR R4, Ignite APIs | Inpatient and health-system clinical decision support |
| REDCap (CDIS / FHIR) | Academic clinical research sites | REDCap API tokens + Clinical Data Interoperability Services (CDIS) | Pulling EHR FHIR demographics/labs directly into research eCRFs |
Frequently Asked Questions
How does the DrChrono REST API and webhook architecture work?
The DrChrono REST API uses OAuth 2.0 authorization code grants with granular scopes across patients, appointments, clinical notes, labs, and billing. Its webhook system sends HTTP POST event notifications (verified via an HMAC-SHA256 secret token handshake) whenever records change, eliminating continuous API polling.
What FHIR R4 resources are supported by DrChrono?
Certified to ONC criterion 45 CFR § 170.315(g)(10), DrChrono supports HL7 FHIR R4 resources aligned with US Core and USCDI, including Patient, AllergyIntolerance, CarePlan, CareTeam, Condition, Device, DiagnosticReport, DocumentReference, Encounter, Goal, Immunization, Location, MedicationRequest, Observation, Organization, Practitioner, Procedure, and Provenance.
How do digital health startups build custom clinical apps on DrChrono?
Teams register an OAuth 2.0 application under Account > API in DrChrono, implement the authorization code and refresh-token flow, verify an HTTPS webhook listener using HMAC-SHA256, and query either the standardized FHIR R4 endpoints or the proprietary REST endpoints for scheduling, intake documents, and custom clinical note fields.
Sources
- DrChrono Inc. (EverHealth). DrChrono API Documentation. https://app.drchrono.com/api-docs/
- DrChrono Inc. (EverHealth). ONC Health IT Certification & Standardized FHIR R4 API Disclosures (45 CFR § 170.315(g)(10)). https://www.drchrono.com/onc-certification/
- Assistant Secretary for Technology Policy / Office of the National Coordinator for Health Information Technology (ASTP/ONC). Certified Health IT Product List (CHPL) — 45 CFR § 170.315(g)(10) Standardized API for Patient and Population Services. https://chpl.healthit.gov/
