Athenahealth Enables Patients to Query Their Health Records via Anthropic’s Claude AI
What Happened — Athenahealth, a U.S. health‑tech platform that serves more than 20 % of the population, launched the AthenaPatient Model Context Protocol (MCP) server. The server lets patients who opt‑in give their Athenahealth credentials to Anthropic’s Claude (Claude Pro or Claude Max) so the large‑language model can retrieve and answer questions about their own medical records—lab results, medications, visit history, etc. Athenahealth says the integration is “secure,” that patients control which data Claude can see, and that Anthropic is contractually barred from using the accessed data to train or improve its models. The service is optional for both patients and Claude subscribers; access can be revoked at any time.
Why It Matters for Trust & Control Assurance — This partnership tests an organization’s AI governance controls: ensuring third‑party AI models only process data under explicit consent and that data use restrictions are enforceable and auditable.
Who Is Affected — Health‑care providers, EHR vendors, and any organization that exposes patient data to external AI services.
Recommended Actions —
- Review and document AI‑model data‑handling policies against the NIST AI RMF governance objectives.
- Capture evidence of consent flows, access revocation logs, and contractual clauses that prohibit model training on patient data.
- Incorporate AI‑specific controls into your continuous monitoring program to demonstrate audit‑ready evidence.
Technical Notes — The integration uses a dedicated MCP‑compatible API endpoint that authenticates patients via Athenahealth credentials. No new CVEs are disclosed; the risk vector is the third‑party AI dependency and the potential for inadvertent data leakage if contractual safeguards fail. Source: ZDNet Security