What happened
athenahealth opened its patient records to Anthropic's Claude on 2 November, launching a connector called athenaPatient MCP that links the company's athenaOne platform to a consumer AI assistant. Claude Pro and Max subscribers in the United States can add it from their Claude settings.
The access model is deliberately patient led. A patient signs in with their own athenahealth portal credentials, which are not passed to Claude, then chooses which categories of information the assistant may reach. Once connected, Claude can reference lab results, vitals, medications, health conditions, immunizations, visit history, diagnostic reports, allergies, procedures and care plans, and answer questions about them in ordinary language.
athenahealth says the traffic is encrypted in transit, that the connector is limited to assistants that do not train models on patient information, and that its agreement with Anthropic bars use of the data for model training. Paul Brient, the company's chief product and operations officer, framed the split plainly: once a patient approves what to share, the rest is between Claude and the patient.
Demand is there. athenahealth cites an August 2026 Pew Research Center survey in which 34 percent of US adults said they had used an AI assistant for a health question, and its software sits behind practices serving more than a fifth of the US population. A settings toggle is also a compliance event.
Why this is a GRC story
The covered entity is no longer in the room. HIPAA governs providers, health plans and their business associates. Records a patient pulls into a consumer assistant leave that perimeter and land under a vendor's consumer health data terms, plus whichever state law applies. The control that matters becomes consent design, and consent design is now a product decision made by an EHR vendor.
A business associate agreement does not travel with the patient. A contract between athenahealth and Anthropic governs the corporate relationship. It does not turn Claude into a covered entity, and it does not follow the data into a chat window. That is the design, and also the exposure.
Verify the no training promise. A press release is not a control. Ask for the data use terms, retention periods and subprocessor list in writing, and read them against the interface a patient sees.
The audit trail is the weak point. When a chart is read through a connector, does the health system's access log record it? Patients ask who read their record, and clinicians get asked in exam rooms. Telemetry in a third party server may never reach the EHR log.
Clinical judgement now sits on a disclaimer. athenahealth says the tool does not replace professional judgement. If the assistant misreads a lab value, the division of responsibility lives in an interface notice and a contract clause rather than in a rule.
What to watch
Watch for guidance from the HHS Office for Civil Rights on patient directed exchange with consumer AI, and for state consumer health privacy laws reaching tools that HIPAA never covered. Watch whether other EHR vendors publish comparable terms, since the first one sets the questions buyers ask the rest.
The practical step costs an afternoon. Put patient facing AI connectors on the third party inventory, name an owner, and write down what the connector can reach and how access is logged.
Attribution: Analysis based on DataBreachToday and related public reporting. This article is original commentary, not a repost of the source material.