Care AI Agent Gateways: EHR Connectors vs Guardrails vs MCP
The agent control layer is getting productized
For the past two years the conversation about AI in practices has been about capability: can the agent verify eligibility, draft the appeal, triage the inbox? This batch of launches suggests the market has moved to control. Epic’s Connectors is a way to link Epic’s AI tools with outside applications. Rhapsody’s Guardian is explicitly pitched as governance for AI agent and API access. Notable’s Flow Compass gives operators oversight of the agents already running in their workflows. Different companies, same bet: agents are proliferating faster than anyone’s ability to answer “who authorized that, and what did it touch?” Each vendor’s press page is the place to verify what actually shipped and when.
I’d read that as a signal rather than a product recommendation. These are largely enterprise-scale tools, and most independent practices aren’t on Epic. But the question they’re all answering applies to a six-operatory dental office exactly as much as to a health system.
What an agent gateway actually does
Strip away the branding and a gateway does four things. It authenticates the agent as itself (not as a borrowed human account). It scopes what the agent can reach — this patient, this date range, these fields, read-only or write. It logs every call in a form a human can review later. And it brakes — rate limits, approval steps, kill switches.
None of that is new. It’s the same access control and audit-control thinking the HIPAA Security Rule’s technical safeguards already expect of covered entities (see 45 CFR §164.312 and current HHS Office for Civil Rights guidance; OCR has also proposed updates to the Security Rule published in the Federal Register, so confirm current requirements with the primary source rather than a vendor summary). What’s new is that an AI agent can fire hundreds of requests in a minute, compose data across systems, and act on what it finds. Old controls designed for human-paced access get stress-tested.
An agent without a gateway isn’t a faster employee. It’s an employee with your admin password and no calendar of what they did Tuesday.
Be clear with yourself about what a gateway doesn’t fix: accuracy. A perfectly scoped agent can still read a payer portal response and report “active coverage” when the plan terminated last month, because it summarized a cached or stale record confidently. It can misread a date argument and hand your front desk Thursday’s schedule labeled as Friday’s — or pull the right date for the wrong provider. It can draft an eligibility note that sounds authoritative and is simply wrong about the copay tier. The gate bounds how much damage that error can do and leaves a trail to find it. It does not make the agent right, which is why read-only starts and sampled human review matter.
Option one: let the EHR or PM vendor be the gate
Your EHR, practice management, or dental software vendor controls the data, so the simplest control point is theirs. Vendor connector frameworks, app marketplaces, and native AI features all route agent access through permissions you already manage.
Where it wins: no new BAA to negotiate, no new infrastructure, and the vendor’s permission model is already mapped to roles your staff understands. If you’re on a platform shipping its own agent framework, this is usually the lowest-friction start.
Where it breaks: you only get the connectors the vendor builds, on the vendor’s timeline. Logging may be designed for support troubleshooting rather than your compliance review. And it ties your automation roadmap to one vendor’s — which is the core tension covered in switching platforms versus layering agents on top.
Option two: buy a governance layer that sits in front of everything
A dedicated governance or integration-gateway product sits between agents and your systems — one place to define identity, scope, and audit across every AI tool you run. That’s the Rhapsody Guardian and Flow Compass shape of the market.
Where it wins: when you’re running more than one or two agents from different vendors, a shared control plane beats reconciling four vendor dashboards. It also gives you a single export when an auditor or your malpractice carrier asks what the AI touched.
Where it breaks: cost and fit. Read how these products are positioned on their own sites — the case studies, the buyer language, the “request a demo” forms — and you’ll notice they’re marketed largely to health systems, HIEs, and large groups rather than to a three-provider practice. That’s an observation you can check in an afternoon, not a pricing claim. A solo or small group practice may be buying a control plane for two agents. Ask for small-practice pricing and a real BAA before you get excited; if neither exists, this tier isn’t for you yet.
Option three: make your own MCP server the gate
The Model Context Protocol (MCP) is an open standard for exposing your tools and data to an AI assistant through a defined set of callable functions. A custom MCP server is, in practice, a gateway you own: you decide the tool list, and anything you don’t expose doesn’t exist as far as the agent is concerned.
A realistic small-practice example: instead of giving an assistant general database access, you expose exactly four tools — get_todays_schedule(date), get_coverage_status(patient_id), draft_eligibility_note(patient_id), and flag_for_human(reason). Nothing writes to the chart. Every call is logged with a timestamp and arguments. The agent can prep tomorrow’s eligibility worklist and cannot touch a clinical note, a payment, or a patient outside tomorrow’s schedule. The build mechanics are covered in connecting Claude to your EHR via MCP.
Where it wins: scope is exact and enforced in code rather than in policy language — minimum-necessary becomes a short list of functions you can read in one sitting. The tool definitions are portable, so you can change AI assistants without renegotiating access. And the log format is yours, shaped for your compliance review rather than someone’s support queue.
Where it breaks: someone has to own it. A custom server needs a developer or partner under a BAA, patching, and secret rotation. If nobody at the practice will own the on-call, choose option one.
Where to start if you’re using AI in your practice today
For most independent practices the honest sequence is unglamorous.
-
Inventory what's already running
List every AI tool touching practice data, including the ones staff adopted without asking. Note which has a signed BAA. Tools without one should not see PHI — verify the BAA status directly with the vendor, in writing. -
Give agents their own identity
Stop sharing human logins with automations. Service accounts or OAuth-scoped credentials make logs meaningful; the trade-offs are laid out in shared vs service account vs OAuth for agent logins. -
Start read-only on one workflow
Pick eligibility prep, claim scrubbing, or recall lists. Read-only agents can be wrong without being expensive. Expand to write access only after a few weeks of clean output. -
Set a review cadence before you scale
Decide now who reads the agent log, how often, and what sample size — then hold it. Oversight you schedule survives; oversight you intend doesn’t.
What a gateway changes about vendor choice
Somewhat less than you’d think. “AI for a medical practice” covers scribes, phone agents, coding assistants, and clinical reference tools that share almost nothing. General assistants like Claude and ChatGPT are strong at administrative reasoning and drafting; clinically oriented tools like OpenEvidence or Glass Health are built for literature-grounded clinical questions; voice agent companies target the phones. Critically, none of the consumer tiers of these products are appropriate for PHI by default — BAA availability differs by product and by plan, which is exactly the check in step one above, and it’s a question for the vendor in writing, not for a marketing page. What a gateway changes is the order of operations: decide what an agent may reach before you decide whose agent it is, and you can swap vendors later without re-litigating access.
As for which front-office jobs survive: the pattern so far favors judgment over keystrokes. Agents are good at gathering, drafting, and flagging. Deciding, exception-handling, and anything a patient will be upset about still need a person — which is why permission models that keep a human in the approval loop matter more than raw agent capability.
Modeling the payoff without inventing numbers
Don’t take anyone’s published ROI percentage, including a vendor’s. Build your own from inputs you can observe in your own practice.
The full picture isn’t just hours saved; it’s what those hours get reallocated to (treatment presentation, AR follow-up, answering the phone before it rolls to voicemail), plus revenue captured that previously leaked. Run the arithmetic with your own numbers, and include the governance cost and the review time the accuracy problem demands. A gateway you never built is cheaper on the spreadsheet and more expensive in the breach notification.
Not sure where to start?
Get a free automation audit: we map your scheduling, intake, insurance, billing, and patient communication and show you what's worth automating — before you spend a dollar.
Get a free automation auditRelated guides
AI Agents Booking Appointments: Open, Gate, or Block
Patient-side AI agents are starting to book visits. Compare opening your schedule, running a gated agent front door via MCP, or staying human-only.
Read guide →
Healthcare AI Vendor Consolidation: Buy, Build, or Wait?
Medical practice AI automation companies are consolidating fast. How to weigh a suite, a point tool, or your own MCP layer — plus contract terms to lock down now.
Read guide →
Agentic Practice Management: Switch or Layer AI on Top?
Vendors are raising big rounds for agentic practice management. Here's how switching platforms compares to layering AI agents on the PM system you already run.
Read guide →