# Health Gorilla (slim)

> Health Gorilla is a designated TEFCA QHIN whose FHIR R4 API retrieves patient records from national networks (Patient360), places lab orders and returns results, and sends ADT and clinical alerts, for organisations it onboards.

- Full: https://www.anchorterminal.com/tools/health-gorilla.md (~5,800 tokens) · this version ~1,430 tokens · JSON https://www.anchorterminal.com/tools/health-gorilla.json · canonical https://www.anchorterminal.com/tools/health-gorilla
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · Updated: 2026-10-14

**C · 59.3/100 · rank #583 of 1076 · #4 in Health records & wellness data · not agent-ready · confidence medium**


Assessment: A TEFCA QHIN with a FHIR R4 API, OpenAPI fragments on every reference page, idempotency keys on POST and dated weekly release notes. Access is sales-led, with case-by-case fees, a sandbox by request and no published rate limit numbers, and the API terms allow access to be cut at any time.

## Facts

- Kind: HTTP API · vendor: Health Gorilla, Inc. · category: Health records & wellness data · legal entity: Health Gorilla, Inc. · provenance 83/100
- Local only (HTTP)
- Auth: OAuth · pricing: Paid · x402: no · licence: Proprietary service under Health Gorilla's API Terms of Use (updated 22 January 2026), with a signed licence agreement required before production
- Probe metrics: not measured yet (probes haven't run)
- Endpoints: FHIR R4 at https://api.healthgorilla.com/fhir/R4/ and sandbox https://sandbox.healthgorilla.com/fhir/R4/, plus STU3
- Products: Patient360 record retrieval ($p360-retrieve, HIN document query, structured retrieval), Clinical Alerts and ADT, Lab Network orders and results, Individual Access Services, Patient Chart viewer and iFrames
- Credentials: OAuth 2.0 client ID and secret per environment, JWT bearer (HS256), authorisation code and optional implicit grants, scopes assigned at registration
- Pagination: FHIR Bundles with `link.relation=next`, `_count` and `_offset`, also on $everything
- Async: Long operations return 202 with `Retry-After` and `X-Progress`, and 454 once a result expires
- Errors: HTTP status table, FHIR OperationOutcome bodies, `X-HG-Request-Id` for correlation and a page of common error scenarios
- Rate limits: Enforced, with advice to avoid bursts and back off, but no numbers published
- OpenAPI: OpenAPI 3.1 fragments on each reference page (spec fhir-r4-api-sandbox 1.1.0), with no single specification file found
- Status: status.healthgorilla.com on Statuspage, 11 components including API Server and the P360 gateways
- Certifications: HIPAA, TEFCA QHIN, HITRUST CSF r2 and SOC 2 Type II per the security page

- Scores: Reliability 58, Performance pending, Schema & documentation 80, Agent ergonomics 72, Security & auth 66, Payments & pricing 5, Task success pending, Maintenance & community 63, Transparency & trust 61 · total over the 7 assessed categories
- Why: Reliability, Read with the hosted lines. · Schema & documentation, Each reference page carries an OpenAPI 3.1 fragment, with no single specification file found (18 of 25). · Agent ergonomics, `_count` and `_offset` size searches and $everything, and C-CDA export condenses a record (15 of 25). · Security & auth, OAuth 2.0 with scopes assigned per client at registration, tenant context and short-lived tokens. · Payments & pricing, Read with the hosted rubric. · Maintenance & community, Release 2637_6 went to production on 14 October 2026 (30). · Transparency & trust, Closed service under API terms updated 22 January 2026, which allow termination at any time and amendment without notice (15 of 30).
- Sources: 12, open questions: 3, both in the full twin
- Capabilities: health.records, health.fhir, health.consent
- JSON: https://www.anchorterminal.com/api/v1/tools/health-gorilla.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/health-gorilla.svg` or a link to https://www.anchorterminal.com/tools/health-gorilla from a page on healthgorilla.com or one of its subdomains, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Send a fresh UUID in `HG-Idempotency-Key` on every POST and reuse it only when retrying the same payload
2. Poll async operations no sooner than the `Retry-After` value and treat 454 as an expired result
3. Follow `link.relation=next` in Bundles rather than building offsets yourself
4. Expect mocked Patient360 data in sandbox unless network connectivity is enabled for the tenant
5. Log `X-HG-Request-Id` from each response for support cases

## Connect

```bash
GET https://sandbox.healthgorilla.com/fhir/R4/Patient?_count=50
Authorization: Bearer <access-token>
Accept: application/fhir+json
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/health-gorilla

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| Aidbox | B | 64.2 | health.fhir, health.records, health.consent | https://www.anchorterminal.com/tools/aidbox.min.md |
| Zus Health | C | 56.6 | health.records, health.fhir, health.consent | https://www.anchorterminal.com/tools/zus-health.min.md |
| Medblocks | D | 52.7 | health.records, health.consent, health.fhir | https://www.anchorterminal.com/tools/medblocks.min.md |
| Metriport Medical API | D | 50.1 | health.records, health.fhir, health.consent | https://www.anchorterminal.com/tools/metriport.min.md |
| 1upHealth | D | 46.8 | health.records, health.fhir, health.consent | https://www.anchorterminal.com/tools/1uphealth.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)