A patient gets a message from the portal at 9 PM: new lab results are available. The potassium is flagged, the eGFR is a number they have never seen before, and the next appointment is three weeks away. In this illustrative scenario, the patient considers three familiar choices. Wait. Message the practice and hope someone answers. Or copy the numbers into a chatbot and get an answer that knows nothing about their medications, their history or why the test was ordered.
On November 2, athenahealth added a fourth choice. With athenaPatient MCP, a patient using Claude can let the assistant read the lab result alongside their medication list, conditions and visit history, and ask what it means. The patient decides what is shared and can switch it off at any time. athenahealth did not build a chatbot. It built a pipe, and handed the patient the tap. Below we look at what launched, why the architecture matters more than the brand names, who gains and who is exposed, and what would have to go right for this to become the normal way patients read their records.
The EHR used to be the place a patient's data was kept. athenahealth is betting it becomes the place a patient's data is sent from.
In This Deep Dive
- Why this matters now
- What actually happened
- The obvious read versus the deeper signal
- Category map and taxonomy
- Evidence Ladder
- Regulation, privacy and international divergence
- Capital flows and bottom-up economics
- The HealthTech Investor's Signal
- Implementation priorities
- Forward Intelligence
- The Bottom Line
Why this matters now
Patients are already using general AI assistants for health questions, with or without their records. Fierce Healthcare cites an August Pew Research Center survey in which 34% of US adults had used AI assistants for health-related purposes, from looking up symptoms to understanding a diagnosis. Most of that use happens without clinical context. A patient types in a number, or pastes a paragraph from a discharge letter, and the assistant answers in general terms. Record completeness remains important when interpreting an answer.
At the same time, the plumbing for moving health data to third-party apps has matured. In the US, patients have a legal right to access their records, and certified EHRs have had to support standardized patient access APIs for several years. What has been missing is a simple, consumer-grade way to connect that data to the AI tools people already use every day. The Model Context Protocol, an open standard introduced by Anthropic in late 2024 for connecting AI assistants to external data and tools, has quickly become a common way to build those connections. Brient describes it as "an industry norm for AI interoperability."
And the EHR vendors are moving. Fierce notes that OpenAI's ChatGPT for Healthcare now integrates with Epic so authorized clinicians can access and summarize patient information, and that Oracle's patient portal lets patients chat with their record through a conversational interface built on OpenAI models. athenahealth, which serves small and independent ambulatory practices, has spent the past year rebuilding athenaOne as what it calls an "AI-native" platform and this summer rolled out more than 80 AI features for revenue cycle operations. The patient-facing connector is the next step, and it takes a different route from its larger rivals.
Certainty: (A) the Pew figure as cited by Fierce, and athenahealth's product history as reported; (B) our summary of US patient access rules and the MCP's adoption is general; (B) the comparison with Epic and Oracle relies on Fierce's description.
What actually happened
athenahealth announced athenaPatient MCP on November 2 via Business Wire, and Heather Landi at Fierce Healthcare interviewed Paul Brient, athenahealth's chief product and operations officer, the same day.
The product
- What it is: a server, built on the Model Context Protocol, that connects Claude directly to the athenaOne platform.
- Who can use it: Claude Pro and Max users in the US, who add the athenaPatient MCP connector in their Claude settings.
- How patients sign in: with their athenahealth patient portal credentials. Credentials are not shared with Claude.
- What can be shared: with the patient's permission, lab results, medications, vitals, health conditions, diagnostic reports, immunizations, visit history, allergies, procedures and care plans.
- Controls: patients choose which types of data to share, information is encrypted in transit, and access can be revoked at any time.
- Training: athenahealth says it will limit athenaPatient MCP access to AI assistants that do not use patient information to train their models.
What the companies said
Brient on the handoff: "Once the connection is established and patients approve what types of data they would like to share, the rest is between Claude and the patient." On model choice: "Claude is the first connection we've enabled for athenaPatient MCP, but it's not intended to be the only one." And on strategy: "It's not our job to decide which AI assistant patients should use."
The launch positions patient-authorized record access as support for between-visit questions.
On the clinician side, Brient acknowledged the concern that patients reading their records with AI could drive more follow-up messages to physicians. His answer was that better-informed patients have more productive conversations, and that "we did not want to create additional work for clinicians." The company plans to expand access to other models, but Brient did not provide details about additional integrations.
Certainty: (A) product scope, controls and quotes as reported by athenahealth and Fierce Healthcare; (B) Brient's claim that the connector will not add clinician workload is a stated aim, not a measured result.
The obvious read versus the deeper signal
The obvious read: an EHR company has partnered with an AI lab, and patients can now chat with their records. Anthropic gets a healthcare showcase, athenahealth gets an AI headline, and patients get answers that know their history. All of that is true.
The deeper signal: look at what athenahealth chose not to build. The obvious move for an EHR vendor is to put a chatbot inside its own patient portal, as Oracle has done. That keeps the patient in the vendor's app, the conversation on the vendor's servers and the brand on the vendor's screen. athenahealth went the other way. It treats the assistant as something the patient brings, and treats itself as the trusted source the assistant draws on. As Fierce put it, the company built athenaPatient MCP to connect to general-purpose AI assistants rather than build those generative AI capabilities entirely within athenaPatient.
Three implications follow. First, the EHR becomes a data utility for consumer AI. Its value lies in the accuracy, permissions and freshness of the record. That is a defensible position because no assistant can replicate a patient's clinical history on its own. Second, the competition shifts to the assistants. If athenahealth adds more connectors, as it says it intends to, then Claude, ChatGPT and others will compete to be the assistant patients trust with their records. Third, the governance problem moves outside the practice. Once the data is in the assistant, the practice does not see what was asked, what was answered or what the patient decided to do. The practice remains the patient's clinician, but it no longer controls the first explanation of a result.
There is a fourth, subtler point. MCP is a standard for giving an AI assistant context. Brient makes the argument directly: "intelligence without context isn't particularly useful," and in healthcare context "must be accurate, permissioned, secure, and current." If that view holds, then the scarce asset in patient-facing AI is not the model. It is clean, permissioned context, and the companies that hold it.
Certainty: (A) the architectural choice as stated by athenahealth; (B) the data-utility interpretation and the shift of competition to assistants are our analysis; (C) how patients and practices will actually behave once the connector is in use.
