Athenahealth just launched athenaPatient MCP for Claude so patients can question their health records! What could go wrong?
I mean that half as a joke. Patients getting real answers about their own health is a good thing, and I want it to work. But I have spent enough time around clinics, sponsors and auditors to know where things break, and it is rarely where the press release is looking.
What was announced
On November 2, 2026, Fierce Healthcare reported that athenahealth launched a tool to bring patient health records into Anthropic's Claude. According to the announcement, patients choose which types of data to share, such as lab results, medications and visit history, and they can revoke access. Paul Brient of athenahealth said the context an AI receives must be "accurate, permissioned, secure, and current." Once the patient shares, he said, "the rest is between Claude and the patient."
I agree with the first quote. The second one is where my questions start. The patient walks away with an answer. The clinic is the one that may have to explain it.
The answer looks complete when it isn't
This is the failure I worry about most, and it can be devastating for a clinician and their staff.
A chart is never the whole story. Some items are held back on purpose. Some live in another system. Some were never entered. When an AI reads what it was given, it does not know what it was not given. It writes a confident, well-organized answer from whatever arrived. Nothing in that answer says "there was more."
Now picture the answer a patient gets. The AI reads three visits, a lab result and a medication list, and concludes that a finding was missed, that a follow-up never happened, that the standard of care was not met. It reads like a malpractice finding. It may be built on a chart with a hole in it: a note held back, a referral documented somewhere else, a conversation that lives in a different record.
I am not saying this will happen every time. I am saying that a clinic with no record of that exchange cannot cheaply show it did not happen that way.
And that is where the cost lands. The patient brings the conclusion to the clinic, or to a lawyer, or to a board. The clinic goes into defense. The practice manager pulls the chart. Someone works out what it said on the day the AI read it, which may not be what it says today. Someone works out what was held back and why. Counsel gets involved. The clinician loses hours, then days, away from patients, re-reading their own notes and writing explanations. Every one of those hours is work that adds nothing to anyone's care. It exists only to survive the review.
And there is a third question nobody in that room can answer: what exactly was the AI shown? The clinic has the chart. It does not have the conversation. So the team rebuilds the story from fragments, slowly and expensively, and still cannot prove the one thing that matters. I call that digital archaeology, and a small practice does not have the staff for it.
Nobody can show what the patient was told
Think about where the pieces of that one exchange end up. Some record of the data request may sit on the health records side. The question and the answer sit on the AI side. Those are two different places, run by two different companies, under two different agreements. Do both records exist? What does each one hold? Can a clinic get either of them, and how fast? I do not know, and the announcement does not say. So you should ask.
Then add time. The chart is live. A result gets amended, a note gets signed late, a diagnosis gets corrected. The chart a patient's AI read in March is not the chart the clinician opens in June. If nobody kept what the AI was shown at the moment it was shown, the clinic is arguing about a document that no longer exists in that form. Stop right here, re-read this paragraph and take a deep breath.
The wrong person at the keyboard
The announcement's model is simple: the patient decides what to share. That works when the patient is the one typing.
Often they are not. An adult daughter manages her father's portal login. A parent signs in for a teenager. A spouse "just checks the labs." Each of them can now ask an AI anything about someone else's chart. For minors and sensitive care, such as reproductive health, mental health or substance use treatment, the rules about who may see what are deliberately narrow, and they differ by state.
So the questions are plain. Does the connector know who is actually at the keyboard? Does anything record it? If the answer reaches the wrong person, can anyone show how?
Rules the connector may not know about
Records already carry barriers that have nothing to do with which data types a patient ticks. Psychotherapy notes sit outside a patient's own right of access. A clinician can withhold an item from a patient’s own access when that access is reasonably likely to endanger the patient’s life or physical safety (other harm grounds apply in narrower cases, and some of those denials carry review rights). A research study that includes treatment can pause access to results while it runs, but only when the participant agreed to that pause at consent and was told access returns when the study ends; a blinded result alone is not enough.
I am not claiming the connector ignores these. I am saying a list of data types is a different thing from a guarantee that these barriers hold. If you are a clinician you might want to ask your vendor some questions: Can psychotherapy notes ever reach it? Does a clinician's harm-based decision travel with the record? Does a study's pause on results reach the AI, and does the connector know when that pause ends?
Revoking access does not un-ring the bell
The patient can revoke access. That is a good control, and it stops the next share. It does not unread the last one. The answer has already been given, maybe screenshotted, maybe forwarded, maybe acted on. What happens to what was already shared, and to anything kept on the AI side? If a dispute comes up a year later, can anyone show what was shared before the revoke and what was not? Those are questions, not accusations, and they deserve written answers.
The decision AI is forcing
Look back at every failure above. Silent absence, two logs in two places, the wrong person at the keyboard, rules that may not travel, a revoke that cannot reach the past. None of them is a model problem. A smarter model does not fix any of them. Every one is a record problem.
That is the architectural decision AI is forcing on clinics. They can keep doing what most do today: wait for the question, then dig. Or they can build an institutional brain: a connected memory of what the organization knows, where each piece came from, and who stood behind it. For every answer that matters, it holds who created the record and what created it, what the record said at that moment, what was held back and why, and who asked. The brain is what lets a clinic answer in minutes instead of weeks. Evidence is what makes that answer stand up when someone pushes back. You need both, and that is what we are building at ScientixAI.
The clinician walks in against a partner who never gets tired
Here is the human side, and it is where all of this lands.
A clinician has minutes with each patient. They do not have hours to pore over one person's record, and they certainly do not have a tireless, super-intelligent reader to help them. But the patient does. A patient with an AI can spend an evening, or a month, going through every line of their chart (or at least what they think its every line), asking follow-up after follow-up. Not to mention that depending on the patients AI system instructions (or lack of), their super-intelligent thought partner could very well be an eager sycophant.
And the patient does not see a chatbot. They see a partner that has passed the medical exams, one that has read their whole chart and never got impatient with them. So they walk into the exam room trusting what it told them, holding a printed conversation. Some of it will be real catches, and those are worth having. Some of it will be plausible guesses built on a partial chart. The clinician has minutes to tell the difference, with no view of what the AI read or what it missed.
In effect, every clinician now has a new auditor, one with far more time, far more confidence and far more reason to look than any regulator.
None of this is a reason to keep patients away from their own records. It is a reason to ask, before you turn the connector on: when the AI answers, who can show what it answered from?
Clinicians and staff, for your reference and counsel: psychotherapy notes, 45 CFR 164.524(a)(1); harm-based withholding, 164.524(a)(3); research-in-progress suspension, 164.524(a)(2)(iii). Also ask how your state's minor-consent rules apply.
Bo Lora: Founder of Scientix.ai Inc. Has spent the last 5 years deeply embedded across the healthcare & life sciences value chain engaging with clinical research sites, sponsors, CROs, tech vendors, start-ups, and regulators. He left AWS in 2025 after being asked to support non healthcare & life science related endeavors and after taking a well deserved break, began working on a product idea based on evidence infrastructure.