Health Gorilla API
Documented FHIR R4 and STU3 REST APIs cover Patient360, lab ordering, ADT feeds, and referrals, with OAuth2, a free sandbox, and an open developer portal. Moving real PHI requires a paid contract, signed BAA, and vetting, and that vetting is now under scrutiny in the Epic lawsuit.
Frequently asked questions
Health Gorilla scores F on the API Report Card. Documented FHIR R4 and STU3 REST APIs cover Patient360, lab ordering, ADT feeds, and referrals, with OAuth2, a free sandbox, and an open developer portal. Moving real PHI requires a paid contract, signed BAA, and vetting, and that vetting is now under scrutiny in the Epic lawsuit.
Without a usable official API, teams fall back on manual exports, file drops, or one-off vendor integrations. The other option is an unofficial API layer like Supergood that automates the authenticated web app directly.
Health Gorilla is a healthcare data interoperability platform and federally-designated Qualified Health Information Network (QHIN) under TEFCA, the Trusted Exchange Framework and Common Agreement.
Vertical: Healthcare (national health data network / interoperability infrastructure). A digital health vendor's engineering team integrates once against Health Gorilla's FHIR API (OAuth 2.0 client-credentials or SMART-on-FHIR) and queries Patient360 for a new patient, Health Gorilla resolves identity via its master patient index, fans out queries across TEFCA / Carequality / eHealth Exchange and direct EHR / lab connections, normalizes the responses (HL7v2, CDA, FHIR STU3/R4), and returns a unified FHIR R4 bundle covering demographics, problems, medications, allergies, immunizations, encounters, labs, imaging, and clinical notes.
Health Gorilla is one of seven federally-designated TEFCA QHINs (alongside Epic Nexus, eHealth Exchange, CommonWell, Konza, Kno2, and MedAllies) and the first dual-designated QHIN + California QHIO.
Yes, by design. Health Gorilla is a federally-designated QHIN; it is the live wire carrying PHI between healthcare organizations, labs, payers, and digital-health vendors.
Founded in 2014 in Sunnyvale, California by Sergey Vasilenko and Steven Yaskin. Cloud-native from inception on AWS with a FHIR-first architecture (FHIR STU3 in early products, FHIR R4 across the modern stack).
Production API access requires a negotiated paid contract and a vetting / onboarding process that is not self-serve, sandbox is free but moving real PHI requires sales engagement and a signed BAA. API rate limits and per-call / per-record pricing are not transparently published; customers report having to negotiate quotas inside the master agreement. Full sourced list under Sources below.
Common alternatives include Particle Health, Zus Health, Redox, 1upHealth, Epic Nexus (QHIN), CommonWell Health Alliance. Graded alternatives appear under "More from the report card" below.
Grades measure one thing: can a customer's engineering team get their own data out programmatically? We check six things (whether a real API exists, how access is gated, data coverage, auth quality, docs and developer experience, and stability) and roll them into a letter grade. Grades get re-verified, and they only move on evidence.