How Phlux Works
Phlux connects your software to the EMR systems your customers use. This page explains how the connection works, what data you can access, and what's required to get started.
What Phlux does
Medical practices store patient records, appointments, and clinical data in Electronic Medical Record (EMR) systems like ModMed, DrChrono, and Nextech. Every EMR stores this data differently and has its own way of sharing it with outside software.
Phlux sits in the middle. Instead of your software team building a separate integration for each EMR — a process that typically takes 3-6 months per system — you build one integration with Phlux. Phlux handles the translation and authentication for every connected EMR, and returns data to your software in a consistent, normalized format every time.
What data you can access
Once a practice connects their EMR to Phlux and authorizes your software, you can query:
Patient records
Search for patients by name or medical record number. Returns normalized patient data including name,
date of birth, contact information, and next appointment — same structure regardless of which EMR the
practice uses. The search term is sent in the request body
(POST /practices/:id/patients/search), never in the URL.
Appointments
Query upcoming and past appointments for a specific patient. Returns appointment date, time, provider,
and status in a consistent format across all supported EMRs. The patient identifier is sent in the
request body (POST /practices/:id/appointments/search), never in the URL.
Practice information
Retrieve provider and location data for the connected practice. Useful for routing queries to the right provider or location within a multi-location group.
How a connection works
Connecting a practice to Phlux takes three steps:
- Your organization registers with Phlux and receives an API key. This key identifies your software and is required for every request.
- The practice enters their EMR credentials into the Phlux portal. These credentials are encrypted and stored securely — your software never sees them directly.
- Your software calls the Phlux API using your API key and the practice's ID. Phlux authenticates with the EMR on your behalf and returns the requested data.
Supported EMR systems
The EMR systems Phlux has built are listed below. The status column reflects the real state of each connector: only those marked Live have been verified against a real practice. EMRs Phlux has not built are not listed here.
Compliance and security
What is actually in place today:
- All traffic is encrypted in transit (TLS); stored EMR credentials are encrypted at rest with AES-256-GCM
- Every access to patient data is recorded in an append-only audit log, which never records patient data itself
- Your organization must review and sign a Business Associate Agreement before accessing any patient data. Signature, timestamp, and the exact document version are recorded.
- Tenant isolation: each organization can reach only its own practices and credentials, enforced on every request
- A practice connection can be disconnected at any time, which deletes its stored credentials
- Phlux does not store patient data. It retrieves it from the EMR on demand and returns it directly to your software.
- Patient identifiers are sent in request bodies, never in URLs, so they do not reach platform request logs
Ready to get started?
Create a Phlux organization, get your API key, and connect your first practice.