Claude + Your EHR via MCP: A HIPAA-Aware Build Guide

By Jude Lee · · Custom

Practice manager and IT consultant reviewing a scheduling system on a monitor at a clinic front desk

Every week now brings another “agentic” launch aimed at practices — referral automation, patient engagement, phone triage. Treat those announcements as marketing until you’ve read the vendor’s own release and BAA terms; trade coverage rarely tells you what the integration actually touches. The question office managers keep asking is the one underneath all of it: can I just point an AI assistant at my own systems and have it do this work?

Sometimes yes. The plumbing is called MCP. Here is what it is and what it takes.

What MCP actually is, in one paragraph

MCP is an open protocol, originally published by Anthropic and documented at modelcontextprotocol.io, that standardizes how an AI assistant connects to external tools and data. Instead of writing a bespoke integration for every assistant you use, you stand up an “MCP server” that exposes a defined set of actions — get_open_slots, list_claims_with_status_denied, fetch_referral_document — and an MCP-capable client can call them. As of 2026 that includes Anthropic’s Claude apps, OpenAI’s agent tooling, Microsoft Copilot Studio, and developer editors like VS Code and Cursor; the ecosystem is moving fast, so check current client support before you commit to a design. Think of it as a menu with a bouncer: the AI can only order what’s on the menu, only with the credentials you give it, and every order is logged. That constraint is the whole reason it matters in healthcare. A general-purpose chatbot with a copy-pasted patient record is unbounded and unauditable. An MCP server is a place to put policy.

Where it fits a real front-office workflow

Start with a job that is high-volume, rule-heavy, and currently done by a human staring at two screens. Denial triage is a good candidate.

Today: a biller opens the clearinghouse, reads a rejection, opens the practice management system, finds the encounter, figures out whether it’s a demographic mismatch, a missing modifier, or a real coverage problem, and either fixes and resubmits or writes an appeal note.

With an MCP server over your billing data, an agent can do the first four steps and stop. It pulls the denial, pulls the matching encounter, classifies the reason, drafts the correction, and drops it in a queue with its reasoning attached. A human clicks approve, edit, or reject. Nothing is submitted to a payer autonomously in version one. The agent handles multi-step retrieval and pattern-matching — genuinely hard for rule engines, easy for a good model — while the person keeps the judgment and the signature. The same shape applies to eligibility exceptions, recall list triage, and referral packet assembly. For the wider map of what’s worth automating first, see our medical claims and billing automation guide and the practice automation audit.

Version one of any agent in a practice should be able to draft everything and send nothing.

Whether you can legally do this with ChatGPT or Claude

This is the question we’re asked most often, and the answer is genuinely nuanced. A general-purpose AI product is not “HIPAA compliant” or “not HIPAA compliant” as an inherent property. Under HHS rules, if a vendor creates, receives, maintains, or transmits protected health information on your behalf, they are a business associate and you need a business associate agreement — see the HHS guidance on business associate contracts and the minimum necessary standard.

Practically, that means three checks before any PHI touches a model:

  1. Is there a signed BAA covering the specific product tier you’re using? Consumer and free tiers are frequently excluded even when an enterprise or API tier is covered. Vendor terms change; verify in writing with the vendor’s current documentation rather than trusting a blog post — including this one.
  2. What happens to the data? Retention windows, subprocessors, and whether inputs are used for training.
  3. Who at your practice can invoke it, and is that logged?

Staff pasting a patient chart into a personal chatbot account is the failure mode to worry about, and it’s a policy and training problem more than a technology one. We go deeper in HIPAA-compliant AI workflows for practices. Confirm your specific arrangement with counsel or a qualified compliance professional before go-live.

General-purpose models versus purpose-built medical AI

ChatGPT is a general-purpose generative large language model — a text predictor with broad training, not a clinical system. Claude is the same class of tool. Neither is a medical device, and neither should be treated as one. The FDA’s final guidance “Clinical Decision Support Software”, issued in September 2022, describes how the agency draws the line between non-device decision support and regulated software; anything that starts influencing diagnosis or treatment selection warrants reading it closely with counsel.

The healthcare-specific alternatives fall into two buckets. Ambient documentation tools are the most mature — compared honestly in our AI medical scribe roundup. Then there are the agentic front-office platforms now flooding the market. Those are worth evaluating on integration depth, BAA terms, and escalation behavior, not demo polish.

The honest answer to “what’s the best AI for a medical practice” is that there isn’t one — it’s job-by-job, and the best tool for scribing is almost never the best tool for denial triage.

Skills: making the agent do it the same way every time

A model given a vague instruction produces varied output. A skill is a packaged, versioned set of instructions — the equivalent of your best biller’s checklist written down and handed to the agent every single time. “For a CO-16 denial: check demographics against the eligibility response first, then check for missing modifiers, then flag for human review if neither applies. Never draft an appeal letter without citing the specific policy language retrieved from the payer document tool.”

Skills are where institutional knowledge stops living in one person’s head. They’re also the cheapest thing to iterate: when the agent gets something wrong, you usually fix the skill, not the model.

Build it in this order

  1. Pick one workflow with a countable backlog

    Denials queue, unworked referrals, eligibility exceptions. If you can’t count the current backlog, you won’t be able to tell whether the agent helped.

  2. Confirm you can get API access at all

    This is the gate that kills most projects. Several PM/EHR vendors publish partner or developer API programs — athenahealth, Epic, and Oracle Health among them — while others make third-party access slow or costly. Our EHR integration primer covers what to ask before you scope anything.

  3. Write the minimum-necessary tool list

    Name every function the agent may call and every field it returns. Read-only for version one. If a field isn’t needed for the task, don’t expose it.

  4. Stand up the MCP server behind your own auth

    The server holds the credentials, not the assistant. Per-user identity, per-call audit logging, rate limits. Then name the owner: your HIPAA Security Officer (or whoever holds that role) reviews the agent’s call logs on a fixed cadence — monthly is a reasonable starting point — and documents the review. The HIPAA Security Rule’s administrative safeguards call for regular review of information system activity records; logs nobody reads are the most common gap we’d expect to find.

  5. Define the skill, then pilot in shadow mode

    Run it alongside your staff for a few weeks. Compare its drafts to what humans actually did. Fix the skill.

  6. Add write actions one at a time, each with approval

    Only after the shadow period shows the agent is boring and predictable.

Modeling the payoff without making numbers up

We have no benchmark for your practice, and you should distrust anyone who quotes one. Model it yourself:

(items per week × minutes each ÷ 60) × loaded hourly rate = weekly labor recovered. Then add the second-order effects that usually matter more: claims that get worked before timely-filing deadlines, referrals that convert to booked visits instead of aging out, and staff hours redirected to patient-facing work you currently can’t staff.

items/wk × min ÷ 60 × rate
Labor recovered — plug in your own numbers
2–6 weeks
Shadow-mode pilot length we'd recommend (opinion, not measured)
1 workflow
Scope of a sane version one

Build your own version of this alongside the vendor checklist in our automation ROI piece.

When buying beats building

Buy an off-the-shelf agent
Your workflow is standard (reminders, eligibility, inbound phone triage). A vendor already integrates with your PM system. You have no technical staff. You want a BAA from someone whose whole business depends on maintaining it. Time-to-value in weeks, not quarters. For most single-location practices, this is the right answer.
Build a custom MCP server
Your process is genuinely idiosyncratic, spans systems no vendor connects, or encodes a competitive advantage. You have API access and someone to own the system. You need the agent to touch data you’re unwilling to route through another party. Expect real ongoing maintenance, not a one-time project.

And a third option people skip: no AI at all. If the task is deterministic — send a reminder 48 hours out, flag claims over 90 days — a rule-based automation is cheaper, more auditable, and never hallucinates. Save the agent for work that requires reading unstructured documents and making judgment calls. More on that tradeoff in custom vs off-the-shelf healthcare automation.

What this means for your front-desk and billing staff

Our expectation — not a measured finding — is that purely transcriptional work shrinks first: moving data from a fax to a field. But the counter-case is real. Fax-to-field work often persists because referring offices and payers keep sending unstructured documents on their own timelines, and that behavior sits outside your control. What clearly gets more valuable is judgment: the person who catches that the agent misread a payer policy, who calls the anxious patient back, who decides an appeal is worth fighting. Practically, someone at your practice needs to own the skills and review the agent’s queue. That job didn’t exist three years ago, and it reads more like a promotion than a threat.

Start there. Pick one queue, keep a human on the send button, and let the agent earn write access.

Not sure where to start?

Get a free automation audit: we map your scheduling, intake, insurance, billing, and patient communication and show you what's worth automating — before you spend a dollar.

Get a free automation audit

Related guides