Athenahealth Lets Patients Connect Medical Records to Claude, Raising Privacy Questions
Summary
athenahealth launched a connector allowing patients to share medical records with Claude. Experts say HIPAA may not cover patient-directed transfers to consumer AI services, raising questions about privacy protections and applicable laws.
Key points
- AthenaPatient MCP lets eligible U.S. Claude Pro and Max subscribers authorize access to specified information in their athenahealth medical records.
- athenahealth says patients control what information is shared, can revoke access, and Claude access is limited to the authenticated patient's records.
- The vendor says shared information is encrypted in transit and retained in Anthropic's systems only for the session.
- Legal experts say HIPAA generally may not apply when an AI service receives records at the patient's direction, but may apply when the provider acts for a regulated healthcare organization.
- Experts note that the FTC Health Breach Notification Rule and state privacy laws, including Texas HB 300, may also be relevant depending on the arrangement.
- Patients are advised to review AI providers' policies on data retention, model training, access, and deletion before sharing sensitive records.
Article Details
- Event Type
- Athenahealth announced AthenaPatient MCP, a patient-authorized connection allowing Claude to retrieve information from patients’ Athenahealth medical records.
- Impact
- Patients can share selected medical-record information with Claude and revoke access; Athenahealth says access is limited to the authenticated patient’s records, transmission is encrypted, and information is retained in Anthropic’s systems only for the session. Experts cautioned that HIPAA may generally not apply to patient-directed transfers to consumer AI services, leaving privacy protections dependent on provider policies and other applicable laws. They also raised concerns about sensitive data, AI inaccuracies, and potential harm.
People
Jordan CohenRegulatory attorney at Akerman LLP; discussed when HIPAA may apply to patient-directed health-data transfers to AI providers.Maggie HalesAttorney and CEO of ET&C Group LLC, a HIPAA compliance consulting firm; raised concerns about patient disclosure of health information and potential harm from AI inaccuracies, biases, and hallucinations.Rachel RoseRegulatory attorney; discussed circumstances in which HIPAA and state privacy laws may apply to arrangements between healthcare providers and AI services.Sam LambsonAthenahealth’s data and ecosystem leader; described the connector’s patient-controlled permissions, access controls, and data handling.
Vendors
Anthropichealth record vendor athenahealth is allowing patients to connect their medical records directly to Anthropic's Claude AI assistant to help them interpret their health information.Athenahealthturn to artificial intelligence chatbots for health-related matters, electronic health record vendor athenahealth is allowing patients to connect their medical records directly to Anthropic's Claude AI assistant to
Products
AthenaOneown medical records and governed by the same field-level access controls used by athenahealth's AthenaOne platform, Lambson said.AthenaPatient MCPThe Boston-based EHR vendor on Monday unveiled AthenaPatient MCP, a standards-based connection that lets patients authorize Claude to retrieve information from their Athenahealth medical records, including laboratoryClauderecord vendor athenahealth is allowing patients to connect their medical records directly to Anthropic's Claude AI assistant to help them interpret their health information.