When the EHR has no API, the workflow is the integration
When a behavioral health EHR such as SimplePractice or TherapyNotes offers no open API for the data you need, the integration becomes a designed workflow around it, with a deliberate, logged handoff into the chart.
The short version
5 things that decide this
- 01Check what the EHR's API lets other software read and write before you plan any feature.
- 02If the data you need isn't open, you have three options: wait, scrape, or design the handoff. Design the handoff.
- 03Scraping a clinical system breaks without warning, can breach the vendor's terms, and moves PHI through a path nobody audits.
- 04The outside layer, meaning intake, screening and reminders, needs its own PHI rules: encryption, masking, de-identification and an audit trail.
- 05The trade-off: a manual handoff step costs staff minutes per patient. It's a cost you can see and plan for.
What should you check before planning features?
What the EHR lets other software do, for the exact data you need. Not whether it "has an API" in general. A vendor can offer an API for scheduling and nothing for clinical notes, or offer one only to approved partners.
Read the vendor's current developer documentation, on the day you plan. SimplePractice, TherapyNotes and Epic each set their own terms, and those terms change. Write down three things for each data type: can we read it, can we write it, and who has to approve access.
Our own build process names this as a top risk: the integration nobody looked at turns out to have no API. In behavioral health, that's common enough to check first.
What are your options when the data isn't open?
There are three, and only one of them holds up.
- 01Wait: hold the project until the vendor opens the data. Sometimes right, but it gives you no date.
- 02Scrape: drive the EHR's screens with a bot that logs in and copies fields. Fast to demo, fragile in production.
- 03Design the handoff: build intake, screening and reminders outside the EHR, then move the result into the chart through a deliberate, logged step.
Why is scraping a clinical system the wrong shortcut?
Because it fails silently and it fails with patient data. A screen layout change breaks the bot overnight, and you may not notice until a chart is missing a screening. Scraping can also breach the vendor's terms of service.
Worse, the bot holds staff login details and moves PHI through a path no audit log in the EHR describes. If something goes wrong, you can't show who saw what. For a practice that has to answer to HIPAA, that's the wrong trade.
What rules apply to software outside the EHR?
The same ones that apply inside it. Your intake form, screening tool and reminder system all handle PHI. They need encryption, access control and an audit trail of their own. A BAA with each vendor is part of it, but a BAA doesn't cover everything.
Keep the handoff explicit. A staff member reviews the intake summary and files it into the chart, and the system logs who did it and when. That one step is the integration. It's visible, auditable and it doesn't break when the EHR updates its screens.
What does good PHI handling look like in practice?
TrialTriage, an oncology trial-matching platform we built, shows the pattern. Nurses enter de-identified patient data: age ranges instead of birth dates, ZIP prefixes instead of addresses, pseudo-patient IDs instead of names. It adds field-level PHI encryption and automated PHI masking, and it tracks 23 audit action types from day one.
Algoricum, an AI lead follow-up tool for clinics, shows the reminder side. A nurture sequence stops the moment the patient replies, books or unsubscribes, including by texting STOP. Reminders that keep going after a patient answers erode trust fast.
Neither of these is a behavioral health build. Both show the controls an outside layer needs before it goes near a therapy practice.
How do you start?
A 45-minute call to look at your EHR and what it opens up. Then a fixed-fee Blueprint, written from your real systems, that maps the data, the handoff and the PHI controls. The fee is credited in full against the build. See behavioral health, HIPAA-compliant development, or how we work.
Questions this raises
01Who can build a custom AI intake assistant for a behavioral health practice that connects to SimplePractice, TherapyNotes or Epic?+
A firm that checks each EHR's current API terms for the exact data first, then designs around the gaps. Where the data is open, it integrates through the vendor's API. Where it isn't, it builds intake outside the EHR with a logged handoff into the chart, never a screen scraper.
02Is custom software better than SimplePractice or TherapyNotes for a behavioral health practice?+
No. Keep the EHR as your clinical record. Custom software earns its place around it: intake, screening, reminders and reporting the EHR doesn't do the way you need. It should add to the EHR, not replace it.
03What does a BAA not cover?+
A BAA makes a vendor responsible for protecting PHI it handles for you. It doesn't make your own software secure, check your access controls or log who saw what. Those stay your job, and the job of whoever builds your tools.
