Artificial Intelligence & Machine Learning,
Data Privacy,
Data Security
Privacy Risks Emerge as Patients Share EHR Data With AI Chatbots
As the utilization of artificial intelligence (AI) chatbots expands within the healthcare sector, the Boston-based electronic health record vendor, Athenahealth, has introduced a new feature allowing patients to connect their medical records with Anthropic’s Claude AI assistant. This tool is designed to assist patients in interpreting their health information more effectively.
This initiative, launched recently, includes the unveiling of the AthenaPatient Model Context Protocol (MCP), which serves as a standards-based connection for patients. It enables them to authorize Claude to retrieve a range of relevant health data—such as laboratory results, medications, diagnoses, allergies, immunizations, medical procedures, and care plans—from their Athenahealth medical records. This innovative approach could significantly transform how patients interact with their health information.
The implementation of the AthenaPatient MCP connection employs an open standard mechanism, allowing AI applications to source data directly from external systems. Initially, this capability is limited to U.S. subscribers utilizing Anthropic’s Claude Pro and Max services. Patients can activate this connector through their settings in Claude, authenticating with their Athenahealth patient portal credentials.
Once connected, patients are empowered to engage in natural-language dialogues with Claude, thereby gaining a clearer understanding of their medical conditions. The feature enables users to formulate pertinent questions for their healthcare providers and enhances overall patient engagement in their individual healthcare journeys.
A recent survey conducted by the Pew Research Center indicated that over one-third of U.S. adults (34%) have employed AI chatbots to address health-related inquiries such as symptom research and medical diagnosis comprehension. This trend marks a significant shift in how individuals manage their health through technology.
Moreover, other EHR vendors have begun to introduce similar AI chatbot functionalities into their systems. For example, OpenAI recently announced capabilities that integrate authorized patient data from Epic EHRs into their ChatGPT model, demonstrating a broader industry movement towards AI involvement in healthcare data management.
However, the intersection of AI technologies and sensitive medical data presents pressing privacy and security concerns. Experts argue that the movement of sensitive personal health information from a HIPAA-regulated environment to a consumer-facing AI platform raises significant questions regarding its protection.
Athenahealth representatives assert that HIPAA regulations do not pertain to the patient-directed sharing of medical information with Claude. Sam Lambson, the organization’s leader in data and ecosystems, explained, “This process is patient-directed, and the AI assistant does not qualify as a covered entity or business associate.” He clarified that while the data shared is indeed protected, the specific situation being described does not invoke HIPAA standards.
The company has taken steps to ensure patient authority over the data shared with Claude, allowing patients to decide who accesses their information and how it is utilized. Lambson emphasized the granular control that patients have, including their ability to revoke access at any time and modify permissions regarding sensitive information categories.
Legal Implications Surrounding Privacy
Regulatory attorney Jordan Cohen elaborated on the legal complexities surrounding patient-directed health data transfers. He indicated that HIPAA’s applicability hinges upon the nature of the AI provider-client relationship. If the AI provider acts as an intermediary for a HIPAA-regulated organization or business associate, HIPAA protections may come into play. However, in cases where the AI assists patients directly without healthcare provider involvement, the provisions do not apply.
Cohen likened the MCP connector to a “digital courier,” facilitating patients’ access to their health records without requiring oversight from HIPAA-regulated entities. Additionally, he compared it to patients downloading their records from a secure portal and subsequently uploading that data to a personal cloud service, a situation that doesn’t typically invoke HIPAA regulations.
Nevertheless, nuanced legal circumstances could alter the interpretation of HIPAA in various arrangements. Regulatory attorney Rachel Rose mentioned that if a HIPAA business associate, such as Athenahealth, contracts directly with an AI provider to process information, the outcome may differ significantly from instances where patients independently facilitate data access.
These legal ambiguities signal a crucial need for patients to educate themselves about the terms of service and privacy policies of any AI tools they decide to employ, cautioned Cohen. Vital inquiries include the retention periods of shared information, its potential use for AI training, permission revocation protocols, and specifics surrounding access to the data.
In light of these concerns, Maggie Hales, an attorney and CEO of ET&C Group, underscored the necessity for practitioners and health organizations to tread cautiously when disclosing patient data to AI technologies. While Athenahealth enables patients to proactively share their personal health information, uncertainties surrounding the implications of such disclosures, along with potential inaccuracies and biases inherent to AI systems, demand thorough consideration. These factors could lead to claims of negligence and medical malpractice if mismanagement occurs.
Hales emphasized the pressing need for a strong governance framework to inform the responsible use of evolving AI technology in healthcare contexts. There remains a genuine concern over public comprehension of how to effectively utilize AI tools, especially given the complexities of medical and scientific data. In instances where patients misinterpret AI insights, accountability must be clearly established, she warned.