Glossary

Model Context Protocol in health IT

The open standard that lets AI models plug into electronic health records through one interface instead of a hundred custom integrations — what it is, where it already touches FHIR data, and the security rules that come with connecting a model to a live record. As of September 2026.

By Jonas WeirReviewed by Jonas Weir · editorial reviewUpdated

The short version

  • The Model Context Protocol (MCP) is an open standard for secure, two-way connections between data sources and AI tools — one protocol in place of a custom connector per system.
  • Anthropic introduced and open-sourced MCP on 25 November 2024; on 9 December 2025 it moved to the Linux Foundation's Agentic AI Foundation for vendor-neutral governance.
  • In health IT, MCP-FHIR frameworks connect LLMs to HL7 FHIR data for reasoning over electronic health records without per-EHR hardcoded logic.
  • Connecting a model to a live record raises real security duties — the spec requires servers to accept only tokens intended for them, and connected data widens the prompt-injection surface.

The Model Context Protocol (MCP) is an open standard that gives an AI model one consistent way to connect to outside data and tools. Instead of a custom integration per system, a model speaks MCP to any compatible server — in health IT, often a server fronting an electronic health record. As of September 2026.

Anthropic introduced MCP as an open standard for building secure, two-way connections between data sources and AI-powered tools 1. The design goal is consolidation: rather than maintaining a separate connector for every data source, developers build against a single protocol 1. It is commonly described as a universal interface — one way for any model to reach any resource, with a client on the AI side and a server on the data side.

Why it matters in healthcare

Health IT is a landscape of separate systems that rarely speak the same language. Each electronic health record, lab system, and imaging archive has historically required its own custom integration to make its data usable by an AI application. That fragmentation is exactly what has kept clinical AI expensive to build and brittle to maintain. A shared protocol changes the economics: connect a system once as an MCP server, and any compatible model can reason over its data through a consistent interface.

How it works in practice

An MCP setup has two sides. The client lives inside the AI application. The server wraps a data source or tool and exposes it in a standard shape. When a model needs record data, its client asks the server, the server enforces access control and returns structured results, and the model reasons over them. In healthcare the server most often sits in front of a FHIR interface — the HL7 standard for health data — so the same protocol works across EHR vendors.

Where it appears today

MCP moved from launch to infrastructure quickly. Anthropic open-sourced it on 25 November 2024 1. By mid-2025 the specification had matured to a dated release with formal authorization and security rules 2. On 9 December 2025 the protocol was contributed to the newly formed Agentic AI Foundation under the Linux Foundation, giving it vendor-neutral governance alongside other agent-ecosystem projects 3. In health IT specifically, a peer-reviewed open-source MCP-FHIR framework integrates large language models with HL7 FHIR data for dynamic extraction and reasoning over electronic health records, delivering interoperable EHR applications without hardcoded retrieval logic 4. These are early systems, but they are real, dated, and published.

Common misunderstandings

The first misreading is treating MCP as a healthcare or interoperability standard in its own right; it is a general connection protocol that health IT adopts by wrapping clinical systems as servers, and it sits above FHIR rather than replacing it. The second is assuming that a standard connection is a safe one. Connecting a model to a live record raises specific duties. The specification requires an MCP server to validate access tokens and accept only tokens intended for itself — a guard against the confused deputy problem, where a server is tricked into using another service's credentials 2. And because a connected model now retrieves record content and can call tools, it inherits the prompt-injection surface: instructions hidden in external content the model ingests can alter its behavior 5. A protocol makes connection easy; it does not make it safe by default.

Related terms

MCP is the plumbing beneath most agentic AI in healthcare, because an agent needs tools and data to act, and MCP is how it reaches them. It also feeds retrieval-augmented generation by standardizing where retrieved context comes from — which is precisely why prompt injection in clinical systems becomes a first-order concern once MCP is in the loop. For the wider view of clinical AI deployment, see our AI in healthcare statistics.

We review this page yearly, and sooner when the Agentic AI Foundation ships a major specification revision or a regulator issues MCP guidance for health IT.

Questions & answers

  • What does the Model Context Protocol do in a healthcare setting?

    It gives an AI model one standard way to reach the systems where clinical data lives — most often an electronic health record exposed through a FHIR server. Rather than a bespoke integration for each EHR, the model speaks MCP to any compatible server, which handles the data access.

  • Is MCP a healthcare standard?

    No. MCP is a general open standard for connecting AI systems to data and tools, introduced by Anthropic in 2024 and now governed by the Linux Foundation's Agentic AI Foundation. Health IT uses it by wrapping clinical systems such as FHIR servers as MCP servers.

  • What are the main risks of using MCP with an EHR?

    Two stand out. Authorization: an MCP server must accept only access tokens issued specifically for it, or it can become a confused deputy for another service. And prompt injection: once a model can retrieve record content and call tools, hidden instructions in that content can steer its actions.

Sources

  1. Anthropic. Introducing the Model Context Protocol. 25 November 2024. www.anthropic.com/news/model-context-protocol
  2. Model Context Protocol. Specification, version 2025-06-18 (Authorization / Security Best Practices). modelcontextprotocol.io. modelcontextprotocol.io/specification/2025-06-18
  3. The Linux Foundation. Linux Foundation Announces the Formation of the Agentic AI Foundation (AAIF), Anchored by New Project Contributions Including Model Context Protocol (MCP), goose and AGENTS.md. 9 December 2025. www.linuxfoundation.org/press/linux-foundation-announces-the-formation-of-the-agentic-ai-foundation
  4. Enhancing Clinical Decision Support and EHR Insights through LLMs and the Model Context Protocol: An Open-Source MCP-FHIR Framework. arXiv:2506.13800. 2025. arxiv.org/abs/2506.13800
  5. OWASP GenAI Security Project. LLM01:2025 Prompt Injection. OWASP Top 10 for LLM Applications 2025. genai.owasp.org/llmrisk/llm01-prompt-injection/