Athenahealth Connects Patient EHR Data to Claude AI, Sparking HIPAA Debate
Athenahealth's new feature allowing patients to link their EHR data to Anthropic's Claude AI raises significant HIPAA compliance questions, despite the vendor's claims of patient-directed use.
Electronic health record (EHR) vendor athenahealth has introduced a new feature, AthenaPatient MCP, that enables patients to authorize Anthropic's Claude AI chatbot to access and interpret their medical information. This integration, which uses the Model Context Protocol (MCP), allows patients to retrieve details such as lab results, diagnoses, and medication lists directly into their Claude Pro or Max accounts.
Athenahealth states that this connection aims to empower patients by helping them understand their health data, formulate questions for their doctors, and become more actively involved in their care. The move comes as a Pew Research Center survey indicates a growing trend of individuals using AI chatbots for health-related queries, with 34% of U.S. adults reporting such usage in August 2026.
However, the integration immediately brings to the forefront complex questions regarding the privacy and security of sensitive health information when it transitions from a HIPAA-regulated environment to consumer-facing AI services. Experts are raising concerns about potential privacy breaches and the accountability of third-party AI providers handling Protected Health Information (PHI).
Athenahealth officials, including data and ecosystem leader Sam Lambson, argue that HIPAA regulations do not apply to this specific use case. They assert that the AI assistant is neither a covered entity nor a business associate, as the data exchange is patient-directed. Lambson emphasized that while HIPAA may not be directly applicable, the data remains protected through controls implemented by athenahealth, ensuring patients have full authority over what information is shared and can revoke access at any time.
Regulatory attorney Jordan Cohen of Akerman LLP supports this view, explaining that HIPAA's applicability hinges on who the AI provider is acting on behalf of. In this scenario, where the AI provider is acting on behalf of the patient requesting the data, HIPAA typically falls away once the data is transferred. Cohen likened the MCP connector to a 'digital courier,' facilitating record retrieval without direct involvement from a HIPAA-regulated entity or business associate.
Despite athenahealth's assurances and legal interpretations, the move highlights a growing tension between technological innovation in healthcare and the stringent privacy requirements mandated by HIPAA. The potential for sensitive patient data to be processed and potentially stored by third-party AI services, even temporarily, continues to be a significant concern for privacy advocates and cybersecurity professionals.
Athenahealth has implemented controls to manage patient data access, restricting Claude's access to authenticated patient records and adhering to the same field-level controls used within their AthenaOne platform. Medical information transmitted via the MCP connection is encrypted, and athenahealth states it is retained by Anthropic only for the duration of the active session, with the patient record itself remaining within athenahealth's secure systems.
This development follows similar integrations, such as OpenAI's capabilities that bring authorized patient information from Epic EHRs into ChatGPT. As more healthcare providers explore AI integrations, the industry faces an ongoing challenge in balancing the benefits of AI-driven insights with the critical need to safeguard patient privacy and maintain HIPAA compliance.