For the account owner’s personal use only. This is not a public patient service and is not affiliated with Kaiser Permanente or Epic.
Cloudflare processes this HTTPS callback, including the short-lived authorization code and state. The page displays the response for transfer to the local companion tool.
This hosted component does not exchange codes for access tokens, request clinical records, or store authorization responses in an application database. There are no advertising, analytics scripts, or third-party page resources. Hosting-provider operational processing may apply.
The local tool must validate state and use PKCE before exchanging a code. Downloaded records remain on the user’s computer unless separately shared by the user, who controls local retention and deletion.
This tool is under development for personal record access. It is not a substitute for medical care. API records may be incomplete; verify important details with the healthcare provider.
Updated October 18, 2026.