Athenahealth's new integration with Anthropic's Claude AI assistant is raising questions about how healthcare organizations should protect patient information when medical records are shared with consumer-facing artificial intelligence (AI) tools.

 

What happened

According to a report published by BankInfoSecurity, on November 2, 2026, electronic health record (EHR) provider athenahealth announced the launch of athenaPatient MCP, a new integration that allows patients to connect their medical records directly to Anthropic's Claude AI assistant. The integration uses the Model Context Protocol (MCP), an open standard that enables AI applications to connect with external data sources and retrieve information from authorized systems.

Through the connection, patients can authorize Claude to access information from their athenahealth medical records, including laboratory results, medications, diagnoses, allergies, immunizations, medical procedures, and care plans. This allows users to ask questions about their health information in natural language and receive responses informed by their individual medical records.

The service is initially available to patients in the United States with Claude Pro and Max subscriptions. Users can activate the athenaPatient MCP connector through their Claude settings and authenticate using their athenahealth patient portal credentials.

Athenahealth said patients remain in control of their information. They can decide whether to connect their records, choose which categories of information to share, and revoke access at any time. However, the integration has raised questions about whether HIPAA protections continue to apply when patients voluntarily transfer their medical information to a consumer AI service.

 

Going deeper

The concern surrounding the integration is the regulatory distinction between healthcare organizations that are subject to HIPAA and consumer technology companies that receive health information directly from individuals.

HIPAA establishes requirements for protecting protected health information (PHI) handled by covered entities, such as healthcare providers and health insurers, and their business associates. However, these protections do not automatically extend to consumer technology companies when individuals independently share their medical information with them.

Athenahealth maintains that the Claude integration is a patient-directed exchange rather than an arrangement in which Anthropic processes information on behalf of a HIPAA-regulated healthcare organization.

According to Sam Lambson, athenahealth's data and ecosystem leader, the company has implemented several controls to protect information shared through the connection. These include encryption during transmission, restrictions that limit Claude's access to the authenticated patient's records and permissions that allow patients to control which information is shared. The original patient records also remain within athenahealth's systems, while information made available to Claude is processed and stored within Anthropic's systems for the duration of the session.

Despite these measures, legal experts say the regulatory implications depend on the nature of the relationship between the healthcare organization and the AI provider.

Jordan Cohen, a regulatory attorney at Akerman LLP, explained that HIPAA generally does not apply to an AI provider when it receives medical information at the patient's direction rather than acting on behalf of a healthcare organization. He compared the arrangement to a patient downloading medical records from a healthcare portal and subsequently uploading them to a cloud storage service. In this situation, the cloud provider does not automatically become a HIPAA-regulated business associate. However, the legal considerations could change if a healthcare organization directly contracts with an AI provider to process patient information on its behalf. In that situation, the AI provider could be considered a business associate and become subject to HIPAA requirements.

Other privacy regulations may also apply. These include the Federal Trade Commission (FTC) Health Breach Notification Rule and state-level privacy laws, which may impose additional requirements on companies handling sensitive health information.

 

What was said

Athenahealth defended the integration, emphasizing that patients retain control over their medical information and that the connection was designed with privacy safeguards.

According to BankInfo Security, Sam Lambson explained that the arrangement is “patient-directed, and the AI assistant is not a covered entity or business associate.” He also clarified that the absence of HIPAA obligations in this particular arrangement “does not mean that the data is not protected.”

Paul Brient, chief product and operations officer at athenahealth, described the launch in the company’s official statement as “an important milestone in responsibly integrating AI into the patient experience.” He explained that the integration is intended to help patients make better use of their existing medical information rather than rely on generic health information.

“At its core, this is about helping patients get value from their own healthcare data,” Brient said.

Brient also highlighted Anthropic's approach to AI development and the potential for the partnership to simplify healthcare experiences. He said the companies aim to use AI to reduce complexity and help patients take a more active role in managing their care.

Syed Mohiuddin, head of healthcare at Anthropic, highlighted the questions patients often have after medical appointments, particularly when trying to understand laboratory results or prepare for follow-up consultations. “Patients often have questions about their health records between visits, from what a lab result means to what to ask at their next appointment,” Mohiuddin said.

He added that the integration gives patients the option to bring “their own records into Claude when they choose to, so they can explore those questions and feel more confident and prepared in conversations with their care team.”

Athenahealth also emphasised that patient authorisation is central to the integration. Patients must authenticate using their athenahealth credentials, select the information they want to make available to Claude, and can revoke access at any time.

The company described the Claude launch as the beginning of its broader approach to AI integration, stating that it intends to support patients in understanding their medical records, preparing for healthcare decisions and engaging more actively in their care.

 

Why it matters

Connecting AI assistants to electronic health records can help patients better understand laboratory results, medication instructions, and diagnoses. It can also help them prepare questions before medical appointments and participate more actively in their healthcare.

However, the convenience of these integrations introduces additional privacy and security considerations.

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQS

Does HIPAA apply when patients share their medical records with Claude?

HIPAA does not automatically apply to consumer AI services when patients independently authorize the transfer of their medical information. However, other privacy and consumer protection laws may apply. The regulatory requirements may also differ if an AI provider processes information on behalf of a HIPAA-covered healthcare organization.

 

Does Claude use patient medical records to train its AI models?

Patients should review Anthropic's applicable privacy policy and data-use terms to understand how information shared through Claude is handled. Healthcare organizations should also consider whether third-party AI providers retain or use sensitive information for model development.

 

What are the risks of connecting electronic health records to AI assistants?

Potential risks include unauthorized disclosure of sensitive medical information, inadequate data retention controls, privacy violations, and inaccurate AI-generated interpretations of medical records. Patients may also misunderstand AI-generated responses and make healthcare decisions without consulting qualified professionals.