MCP for Healthcare: What It Can Do, Which Servers Exist and Where HIPAA Draws the Line

MCP lets an AI assistant look up coverage rules, diagnosis codes and provider records, and in some setups read or write data in a FHIR system. That makes it useful for prior authorization prep, coding checks, credentialing and health tech development. It does not make an AI a clinician, and it does not make a workflow HIPAA compliant on its own.

MCP (Model Context Protocol) is an open standard for connecting AI apps to other software through small programs called MCP servers. If you are new to it, start with What Is MCP?.

This guide covers what MCP can do in healthcare, which servers are documented today, where HIPAA and business associate agreements (BAAs) draw the line, and a starter stack. Facts were checked on 2 November 2026. This is not legal advice: talk to your privacy officer, compliance lead or counsel before any protected health information (PHI) touches an AI tool.

What MCP can do in healthcare

Most early healthcare uses are lookups and drafting, not decisions. Typical jobs:

• Coverage checks. Ask whether a Local or National Coverage Determination covers a procedure, then draft the documentation checklist for a prior authorization.
• Coding support. Look up ICD-10 codes and descriptions while reviewing a claim or a denial.
• Provider verification. Check a National Provider Identifier during credentialing or directory clean-up.
• Literature search. Pull study abstracts for a clinical question or a policy review.
• Health tech development. Let a developer query a FHIR test server while building an app, instead of hand-writing API calls.

Each of these saves look-up time. None of them replaces the clinician, coder or reviewer who signs off. For more cross-industry examples, see MCP Examples: 25 Real Business Uses.

Which healthcare MCP servers exist

Anthropic's healthcare connectors

In January 2026, Anthropic announced Claude for Healthcare with new connectors:

• CMS Coverage Database: Local and National Coverage Determinations, which Anthropic says support coverage checks, prior authorization and claims appeals.
• ICD-10: diagnosis and procedure code lookup, with data from CMS and the CDC.
• National Provider Identifier Registry: provider verification, credentialing and claims validation.
• PubMed: biomedical literature, which Anthropic says is available to HIPAA-compliant organizations on Claude for Enterprise.

These connectors serve public reference data. That is a sensible place to start, because a query like "Is this CPT code covered under LCD X?" does not need patient identifiers. Anthropic's page also lists personal health connectors for US Pro and Max subscribers and states, "We do not use users' health data to train models."

The same launch added life sciences connectors such as Medidata, ClinicalTrials.gov, bioRxiv and medRxiv, Open Targets and ChEMBL. Those matter more to research teams than to clinics.

Medplum (FHIR)

Medplum is an open-source healthcare platform built on FHIR, the standard format for exchanging health records. Its MCP documentation describes a hosted endpoint at https://api.medplum.com/mcp/stream.

Key points from the docs:

• The main tool is fhir-request, which takes an HTTP method, a FHIR path and an optional body. It supports create, read, update and delete.
• Two extra tools, search and fetch, exist for clients such as ChatGPT that expect them.
• Sign-in uses OAuth 2.0, so each user authorizes the AI app through Medplum.
• The tool annotation says "This tool can modify data."

One generic tool that can do anything the API allows is powerful. It also means scopes and access policies on the Medplum side do all the limiting. Use a test project first.

What we could not confirm

We found trade press about EHR vendors adding agent "connectors," but no EHR vendor MCP documentation we could open and check on 2 November 2026. Community FHIR servers exist for other platforms. Treat any server that is not published by the system's owner as untrusted until your security team reviews it. Our server risk checklist is a quick way to start that review.

HIPAA, BAAs and MCP

HIPAA rules apply to the data, not to the protocol. Three points matter most.

1. Connected vendors can become business associates

The HIPAA definition of a business associate in 45 CFR 160.103 covers a person who "creates, receives, maintains, or transmits protected health information" on behalf of a covered entity. Under 45 CFR 164.502(e), you need "satisfactory assurance" from a business associate, which in practice means a BAA.

Every MCP server that receives PHI is part of that chain. So is the AI app that hosts the conversation.

2. Your AI vendor's BAA may not cover connectors

Anthropic's BAA coverage page is explicit. For Claude Enterprise, "MCPs / Connectors" are "Available to use but sending data to 3rd parties via this feature isn't covered under Anthropic's BAA." For Claude Code and Cowork, it lists local MCP servers, desktop extensions and custom connectors as not covered.

In plain terms: if a conversation sends PHI to a third-party MCP server, that vendor needs its own agreement with you, and your admins own the configuration. The same logic applies to any AI client, not just Claude. Check your own vendor's BAA scope before you connect anything.

3. Minimum necessary still applies

The minimum necessary standard in 45 CFR 164.502(b) requires "reasonable efforts to limit protected health information to the minimum necessary." An MCP server that can read a whole patient chart, when the task needs one lab value, cuts against that. Scope tools and data narrowly, and prefer servers that let you restrict which resources are reachable.

For the general security picture, read MCP Security Risks and How to Reduce Them. Prompt injection is a real concern when an AI reads free-text notes or documents, because instructions can hide inside them.

Example prompts

These use only public reference data, so no patient identifiers are needed:

• "Is there a National or Local Coverage Determination for this procedure code, and what documentation does it require?"
• "Look up the ICD-10 codes for low back pain and explain how the more specific codes differ."
• "Verify this NPI and tell me the provider's listed specialty and practice location."
• "Find recent review articles on remote blood pressure monitoring and summarize the main findings."

Notice what is missing: names, dates of birth and chart details. Keep prompts in that shape until your compliance team approves a PHI workflow.

A starter stack

A careful first rollout for a clinic, payer team or health tech company:

Plan permissions before you connect anything. Our tool permission planner helps you sort each tool into allow, ask or block.

What to keep human

The MCP spec itself says that for trust and safety, "there SHOULD always be a human in the loop with the ability to deny tool invocations," per the tools section of the 2026-07-28 specification. In healthcare, keep these with licensed or accountable people:

• Diagnosis, treatment and medication decisions.
• Final coding and claim submission.
• Coverage and prior authorization determinations.
• Any write to a patient record.
• Messages to patients.
• Decisions about which vendors receive PHI.

Use the AI for the first draft and the look-up. Have a person approve every action that changes a record or reaches a patient.

Next step

If you want a second opinion on where MCP fits your organization, our MCP readiness audit reviews your systems, data flows and risks before you build. If you need a custom server, for example a read-only view over your own scheduling or billing data, see MCP development. For a wider comparison of options, read Best MCP Servers for Healthcare.

Frequently asked questions