What athenahealth's AI Patient Records Tool Means for Your Home Health Agency — and What HIPAA Still Doesn't Cover

On November 2, 2026, athenahealth — one of the most widely used EHR platforms in ambulatory and home-based care — launched a tool called athenaPatient MCP. It allows patients to connect their athenahealth health records directly to Anthropic's Claude AI assistant and ask questions about their own medical information in plain English.

A patient can now open Claude, authenticate with their athenahealth credentials, and ask: "What were my last three lab results?" or "Do I have any medication interactions?" — and Claude will retrieve and respond using data pulled from their athenahealth record. Records covered include lab results, vitals, medications, health conditions, immunizations, visit history, allergies, procedures, and care plans.

This is a notable development for any practice running on athenahealth — including home health agencies, hospices, and FQHCs. It is not an emergency. But it does require you to make a few decisions now, before your patients arrive with AI-generated summaries of their own chart and start asking questions your staff aren't prepared for.

This article explains what the tool actually does, what HIPAA says about it, and the specific questions home health and hospice administrators need to answer in the next 30 days.

What athenaPatient MCP Actually Does

"MCP" stands for Model Context Protocol — a technical standard that allows AI systems like Claude to pull structured data from external sources, in this case a patient's athenahealth record. Think of it as a secure connector: the patient logs in, grants permission, and Claude can then read specific fields from their record on demand.

Key facts about the tool as launched:

•       Patient-directed: the patient initiates the connection, chooses what to share, and can revoke access at any time

•       Available to U.S. Claude Pro ($20/month) and Claude Max ($100/month) subscribers — not all athenahealth patients are eligible

•       Athenahealth's agreement with Anthropic reportedly bars Anthropic from using patient data accessed through this connection for model training or product improvement

•       Records covered: labs, vitals, medications, conditions, immunizations, visit history, diagnostic reports, allergies, procedures, care plans

•       This is the first time an EHR vendor has built this type of connection directly — prior options required third-party aggregators

A 2024 Pew survey cited by athenahealth found that 34% of U.S. adults have already used an AI assistant for health purposes. This tool formalises what many patients are already doing informally: copying their portal records and asking ChatGPT or Claude to explain them.

How This Compares to Other Patient-Facing AI Health Tools

The key difference between athenaPatient MCP and the HealthEx connector launched in January 2026 is who builds the connection. With athenaPatient, athenahealth built it directly — which means the data relationship is between athenahealth and Claude, not routed through a third party. Whether that matters practically depends on how your practice interprets its BAA with athenahealth and what questions you send them.

What HIPAA Says — and Where It Stops

This is the part most home health administrators will not have seen explained clearly. The answer may be surprising.

Under HHS guidance implementing the HIPAA right of access (45 CFR § 164.524), when a patient requests that their health records be sent to a third-party app or platform of their choosing, the covered entity — in this case, athenahealth as the EHR vendor, or your agency as the covered entity — generally must comply. Once the patient's records reach that third-party app, HIPAA's protections generally stop applying to the data in that app.

What this means in practice:

•       Anthropic is not a covered entity under HIPAA — it is not a healthcare provider, health plan, or clearinghouse

•       If Anthropic receives patient data through a patient-directed connection, it is not bound by HIPAA in the same way your agency is

•       HHS has stated that a covered entity is generally not liable for what an app does with patient data, provided the covered entity did not provide or endorse the app

•       However: if athenahealth built this connector and made it available through the athenahealth platform, there is a reasonable question about whether athenahealth's role changes that liability picture — and by extension whether your agency's promotion of the tool matters

The short version: HIPAA's protections follow the covered entity, not the data. Once patient records leave your system at the patient's direction into a consumer AI tool, the patient's data is governed by that tool's terms of service — not by your Notice of Privacy Practices.

This is not a new legal gap. It is the same gap that exists when a patient copies their portal records into Google Docs or emails them to a family member. What is new is that EHR vendors are now building direct connectors to AI systems that make this dramatically easier to do at scale.

The Five Questions Home Health and Hospice Agencies Need to Answer Now

You don't need to take a position on AI in healthcare today. You do need to make a few decisions before patients start asking questions at the point of care.

The last question is the one most home health and hospice agencies are not ready for. The 2026 HIPAA Security Rule updates require documented policies for technology asset inventory and access management. An AI tool that connects to patient records — whether used by patients or staff — is a technology asset that belongs in that inventory.

What This Means for FQHCs Specifically

Federally Qualified Health Centers have an additional layer of complexity here. HRSA-funded health centers operate under both HIPAA and federal substance use confidentiality regulations (42 CFR Part 2 for programs with substance use disorder treatment components). Patient-directed data sharing to consumer AI platforms raises questions about whether those protections follow the data even when the patient initiates the request.

FQHCs in New York, California, and Massachusetts also operate under state privacy laws that are stricter than federal HIPAA minimums in certain areas — particularly around mental health records and substance use data. A patient-directed AI connection does not automatically import those stricter state protections into the consumer AI environment.

If you run an FQHC, add this to the list of questions for your legal counsel — ideally before patients start using these tools and asking you to help them interpret the results.

The Broader Trend — and Why Home Health Agencies Need a Policy Now

The athenahealth launch is one data point in a pattern that is accelerating. ChatGPT Health launched a similar patient record integration in 2026. HealthEx built a cross-provider connector to Claude in January 2026. Apple Health has been aggregating records for years. Every major EHR vendor is under pressure to build patient-facing AI integrations because that is what patients are starting to expect.

For home health and hospice agencies, the operational question is not whether this trend is good or bad for healthcare. The question is: when your patients start using these tools — and they will — is your agency prepared for what happens next? Do your staff know how to respond? Do your clinical workflows account for the possibility that patients arrive with AI-generated interpretations of their own records? Do you have a documented policy you could show an auditor?

The agencies that will handle this well are the ones that get ahead of it with a written policy, a staff script, and a clear line between patient-facing AI tools (which patients control) and workforce AI tools (which the agency controls and is responsible for under HIPAA).

The agencies that will handle it poorly are the ones that decide to wait and see — and find out during a patient complaint or an OCR inquiry that "we didn't know patients were doing that" is not a defensible position.

What to Do This Week

•       If you use athenahealth: contact your account representative and ask for written clarification on athenaPatient MCP — specifically, which patients are eligible, whether your practice has visibility into connections patients have made, whether any record types are excluded, and what athenahealth's HIPAA role is in the context of this connector.

•       If you use a different EHR: check your vendor's communications for similar announcements. This trend is not unique to athenahealth.

•       Draft a one-paragraph staff-facing policy on patient AI use: what staff should say when a patient references AI-generated health information, and who to escalate to.

•       Review your workforce AI tools separately — any AI tool that your staff use to access or document patient information requires its own vendor security review and, in most cases, a Business Associate Agreement.

•       Schedule a HIPAA risk assessment if you haven't done one in the last 12 months. The 2026 Security Rule updates added mandatory requirements that most home health agencies are not yet fully compliant with.

ShieldForce works with home health agencies, hospice providers, and FQHCs across the country to manage exactly this kind of compliance complexity — including AI governance policies, HIPAA documentation, and the ongoing security monitoring that keeps you covered when the landscape shifts. If you want to know where your agency stands, start with a free HIPAA risk assessment.

→ Schedule Your Free HIPAA Risk Assessment — shieldforce.io/hipaa-assessment

This article is for informational purposes only and does not constitute legal advice. Consult qualified HIPAA counsel for guidance specific to your organization.