Blog Digital Health
athenaPatient MCP Brings Patient Health Records to Claude
On this page· 7 sections
athenahealth, a US provider of electronic health record software, launched athenaPatient MCP on 2 November 2026. The service lets patients connect their official health records to Claude, Anthropic’s AI assistant, and ask questions about them in plain language. At launch it is open only to Claude Pro and Max subscribers in the United States.
The launch drew attention because it touches two issues at once: helping patients make sense of their own health data, and the question of who protects that data once it leaves a provider’s system. This piece explains how the connector works, the debate it has started in the US, and what it means for healthcare providers in Indonesia.
How athenaPatient MCP works
athenahealth sells electronic health record and practice management systems for outpatient care. According to the company’s press release on Business Wire, a patient turns on the athenaPatient MCP connector in Claude’s settings and signs in with their athenahealth patient portal account. The patient then chooses which information Claude may read and can start asking questions, such as what a recent lab result means.
MCP stands for Model Context Protocol, an open standard that connects AI models with outside data sources and tools. HIT Consultant reports that the athenaPatient MCP server acts as a governed middle layer that structures record data before the model sees it. Records are fetched only when a patient asks a question that needs their history, so they are not loaded into the conversation in advance.
Sign-in happens directly with the patient’s own athenahealth account, and access can be revoked at any time. Claude can reach only that patient’s own records.
What patients can share
The press release lists ten categories of data that can be shared: lab results, vitals, medications, health conditions, immunizations, visit history, diagnostic reports, allergies, procedures, and care plans. Patients can review and change permissions for each category, including records classed as sensitive.
On privacy, athenahealth says data is encrypted in transit and kept within Anthropic’s systems only for the duration of the session. The original record stays in athenahealth’s systems. HIT Consultant also reports that Anthropic has committed not to use the data to train its models. These are company claims that have not been independently tested.
The release cites an August 2026 Pew Research Center survey which found that 34% of US adults have used AI assistants for health purposes. It does not say how many patients can use the connector or have already done so.
Paul Brient, athenahealth’s chief product and operations officer, called the launch an important milestone in bringing AI into the patient experience responsibly. Syed Mohiuddin, head of healthcare at Anthropic, said patients often have questions about their records between visits.
The HIPAA debate and who is accountable
In the US, health data is protected by HIPAA, the law that binds healthcare providers, insurers, and the business associates that process data on their behalf. The open question is whether that protection follows the data when a patient sends it to an AI assistant.
Sam Lambson, data and ecosystem leader at athenahealth, gave a direct answer to GovInfoSecurity: “This is patient-directed, and the AI assistant is not a covered entity or business associate.” Because the patient directs the transfer, Claude is not a party regulated by HIPAA in this setup. Lambson added that this does not mean the data is unprotected.
Lawyers interviewed by the same outlet added caveats. Jordan Cohen, a regulatory attorney at Akerman LLP, likened the connector to a digital courier and said HIPAA is unlikely to apply when a health system is simply fulfilling a patient’s request. He advised patients to ask how long data is kept, whether it trains models, who can access it, and how to revoke access and delete it.
Rachel Rose, another regulatory attorney, said HIPAA could apply if athenahealth contracted directly with an AI provider to process data for a regulated healthcare organization. She also pointed to rules beyond HIPAA, such as the FTC Act and the FTC’s Health Breach Notification Rule. In her view, psychotherapy notes and substance use treatment records should stay out of such systems.
Maggie Hales, an attorney and CEO of ET&C Group, raised a different risk. Patients may not understand what they are agreeing to, including the chance of harm from an incorrect AI answer. She also said AI development has moved faster than the policy frameworks meant to govern it, which leaves accountability for a wrong interpretation unclear.
athenahealth is not alone. TechTarget notes that OpenAI offers ChatGPT Health and Anthropic offers Claude for Healthcare for consumers. Epic, another health record vendor, is working with OpenAI to bring ChatGPT into the systems clinicians use.
The Indonesian context: SATUSEHAT Mobile and the PDP Law
athenaPatient MCP is available only in the US, but the questions it raises apply in Indonesia too. Patients there can already view part of their own records. According to the Ministry of Health, the Resume Medis feature in the SATUSEHAT Mobile app has been available since November 2023 and shows visit history, diagnoses, and lab results. It is open only to users whose profiles have been verified at a health facility, and it is protected by a six-digit PIN.
The ministry also plans to add an AI-based personal health assistant to SATUSEHAT Mobile from 2026. GovInsider reports that Setiaji, the health minister’s expert staff for health technology, described the plan in December 2025, covering notifications, reminders, and healthy living recommendations. A firm launch date has not been announced.
On the legal side, Indonesia’s Personal Data Protection Law (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi) classifies health data and information as specific personal data (Article 4(2)). Processing can rest on explicit, valid consent for a stated purpose (Article 20(2)), and data subjects have the right to withdraw consent (Article 9). These three principles line up with what athenaPatient MCP offers: permission by category, a clear purpose, and access that can be revoked.
Facilities whose records already connect to SATUSEHAT have a head start on similar services. Our piece on SATUSEHAT EMR and JKN claims covers hospital readiness for the national electronic record.
What this means for hospitals and clinics
Sooner or later, patients will ask for easier access to their data, including through apps or AI assistants of their choosing. Hospitals, clinics, and health app developers can prepare with a few steps.
- Offer access by data category. Patients should be able to choose what they share, for example lab results without their diagnosis history. This design also makes it easier to meet the PDP Law’s purpose-specific consent principle.
- Make revoking access easy to find. The right to withdraw consent only works if patients can use it themselves without calling staff.
- Log every access by a third-party app. A record of the app, the time, and the data category helps answer patient questions and supports audits.
- Handle sensitive data separately. Mental health, reproductive health, and genetic records need separate consent, in line with the warnings from US lawyers.
- Explain the limits of responsibility in plain language. Patients need to know that once data leaves the facility, its protection depends on the recipient’s policies.
Clinicians should also expect patients to arrive with an AI’s reading of their test results. A simple procedure for correcting a mistaken interpretation will help doctors and nurses.
Designing safe patient data access takes clinical, legal, and technical teams working together. Merakit’s digital healthcare solutions team can help design consent flows and access logging, and our artificial intelligence services can help test AI assistants before patients use them.
Frequently asked questions
Can athenaPatient MCP be used in Indonesia?
Not yet. At launch, it is available only to Claude Pro and Max subscribers in the United States who have an athenahealth patient portal account. No plans for other countries have been announced.
Is shared health data used to train AI?
athenahealth says the data is kept within Anthropic’s systems only for the session, and HIT Consultant reports that Anthropic has committed not to use it for model training. Lawyers still advise patients to read the retention and deletion policies before connecting an account.
What is the Model Context Protocol?
The Model Context Protocol (MCP) is an open standard that lets AI assistants pull data and use tools from other systems through a governed connection. Here, MCP is the channel Claude uses to read the patient records a patient has approved.
Closing thoughts
athenaPatient MCP points to where digital health is heading: patients want to understand their own data with help from AI. The benefit is real, but data protection and accountability for AI answers need to be designed in from the start. If your facility is preparing patient access to health records, we would be glad to help you build it safely.
Sources
- athenahealth launches new solution to let patients connect their health records to Anthropic’s Claude (Business Wire, 2 November 2026)
- athenahealth Launches athenaPatient MCP to Bridge Official Patient Records into Anthropic’s Claude (HIT Consultant, 2 November 2026)
- Athenahealth’s Claude AI Connection Raises HIPAA Questions (GovInfoSecurity, 3 November 2026)
- Athenahealth, Claude team up to let patients query their EHR data (TechTarget, 3 November 2026)
- SATUSEHAT Mobile Versi 6.0.1 Hadirkan Cara Login Baru dan Akses Hasil Tes Laboratorium (Indonesian Ministry of Health, 14 March 2024)
- SATUSEHAT Mobile akan didukung fitur asisten kesehatan berbasis AI (GovInsider, coverage of HAI-Fest on 8 December 2025)
- Law No. 27 of 2022 on Personal Data Protection (Pasal.id)
