Before a connected summary can render a single line, it has to resolve which records this user may read, right now. The chat surface does not answer that. According to the dev.to write-up of OpenAI's announcement, clinical use, data access and the exact interface will be determined by the health system and the integration available to it [6]. Access follows from that clause: entitlement stays in the source system, so whatever your EHR grants a role today is the ceiling on what an assistant running in that context can pull tomorrow.
This is why the workspace posture stops being the interesting artifact. HIPAA-compliant workspaces are part of the existing ChatGPT for Healthcare offering [2], and a compliant workspace is a claim about the vendor relationship and the tenant boundary. It does not decide whether a covering clinician can summarise a chart they would not otherwise have opened. That decision lives in role definitions and break-glass rules you already own, and it now gets exercised by a text box instead of a human clicking through a chart.
The one hard number is retention. OpenAI says data synced from connected health sources is deleted from its systems within 30 days [5]. Synced means copied: connected record data exists outside the source system for a window bounded at 30 days [1]. Anything you do with breach scope, disclosure logging and retention policy now covers a store you do not operate, for up to a month per sync. Whether 30 days is a fixed TTL or a ceiling is not stated.
The training exclusion has the same shape. OpenAI says data connected to Health features can be configured so it is not used to train its foundation models [4]. Configurable means the setting has to be checked, per workspace, and checked again after anyone touches settings [2]. That is a verification task, not a property of the product.
The demo would need several things to hold true before it transfers to your shop, and none of them appear in the announcement: your EHR on a supported list, your region covered, entitlements resolved per user rather than per workspace, and a price. The initial communications do not exhaustively identify compatible EHR vendors, regional coverage, user permissions or commercial terms, and availability depends on deployment-specific arrangements and enterprise partnerships [3]. A compatibility claim with no vendor named is difficult to put in a change ticket.
Note also that the listed workflows, including note drafting and patient summarisation, are examples the high-level description points toward rather than guarantees for any given deployment [7]. dev.to's own advice is a narrow first use case for smaller providers and specialist practices [11], which happens to be the only kind of scope today's public information can support. The standing cost is review: the announcement positions the assistant as help inside the workflow, not a replacement for clinicians, which means someone reads every draft before it counts [8].
