MCP Tool Calls and PHI: Where Health Data Leaks

Protected health information (PHI) can leak at six points in an MCP round trip: the tool arguments the assistant sends, the tool results that come back, the model vendor's context and logs, the AI app's chat history, other connectors running in the same session, and the screenshots and exports people make afterward. Only the first two belong to the MCP server. Curve built Curve MCP to close its side of those two, with fixed-choice query inputs and rounded aggregate answers that withhold small groups. The other four are yours to control, and the signed BAA included on every Curve plan covers Curve, not your AI vendor.

The map: one question, six places it lands

Picture a practice manager asking an AI assistant: "How did the Botox campaign do last month, and did Maria Alvarez book after she called on Tuesday?" That one prompt can leave PHI at six stops.

1. Tool arguments. The model turns the prompt into a tool call. If a tool takes free text, "Maria Alvarez" goes in, then on to the server and its logs.
2. Tool results. A CRM connector can return her contact record, message thread and appointment notes.
3. The model vendor. The client sends that result to the model, under whatever contract and retention terms apply.
4. Chat history. The AI app saves the prompt, the tool calls and the results.
5. Chained connectors. Anything in the model's context can flow into another tool.
6. Screenshots and exports. The answer leaves the app by paste, screenshot or share link.

Running the server on your own machine changes none of this. Google's Ads MCP repository says it plainly: "The MCP Server will expose your data to the Agent or LLM that you connect to it."

Hop 1: tool arguments carry what the user typed

The first leak happens before any tool runs. The prompt, patient name included, reaches the model vendor the moment the user presses enter, and no server design can recall it. That is the uncomfortable fact under every MCP privacy claim, Curve's included: a server governs what it accepts and returns, not what people type.

Tool arguments then copy the name further. A CRM search tool such as HubSpot's search_crm_objects exists to find records, and the model finds a person by putting that person in the arguments. Google's Ads MCP server builds its GAQL query from fields and free-text conditions the model supplies, and its search tool writes the assembled query, conditions included, to its info-level log. Each argument lands in at least three places:

• The model vendor's context, because the model wrote it.
• The client's tool log. The MCP specification says clients SHOULD "Log tool usage for audit purposes."
• The server's logs, plus any error tracker or tracing tool that captures request bodies.

Even a yes-or-no question can put PHI in play. HIPAA's definition of individually identifiable health information covers information about "the provision of health care to an individual" that identifies the person (45 CFR 160.103). A "yes" to "Is Maria Alvarez a patient?" is exactly that, and the question alone tells the vendor she has some connection to your clinic.

Controls for tool arguments

• Prefer tools whose inputs are enums, booleans and bounded numbers. A tool with no text field has nowhere for a name to land.
• Keep arguments out of application logs, error trackers and tracing unless each of those vendors is under a BAA.
• Give staff a rule: no patient identifiers in any assistant without a BAA covering that exact plan and feature, and a named place for person-level questions (why pasting a patient funnel into ChatGPT fails).

Hop 2: tool results bring records back

Tool results are the biggest leak by volume: one call can return many records. HighLevel's v1 MCP server exposes contacts_get-contact, conversations_get-messages and calendars_get-appointment-notes, and message threads and appointment notes are where symptoms, medications and procedures often get written down. Its v2 server is limited by the OAuth scopes you grant. HubSpot blocks activity and conversation data from its MCP server only when Sensitive Data, an Enterprise-only setting, is turned on.

Ad and analytics connectors leak through strings. Google's Ads MCP server can reach search terms, which are text typed by people looking for care. A GA4 report can return page URLs, UTM values and referrers, all of which any visitor can set.

Small numbers leak too. "Two conversions from the fertility-over-40 campaign last Tuesday" can point at two people the front desk knows by name. CMS's cell-size policy bars reporting any cell from 1 to 10, or any figure from which one can be derived, and our guide to small-group rules for MCP answers covers the mechanics.

The model reads the full result, not the one-line summary it shows the user.

Controls for tool results

• Minimum necessary at the credential. HIPAA asks for "reasonable efforts to limit protected health information to the minimum necessary" (164.502(b)). A reporting question needs counts, so the credential should be unable to read contact records at all. Our GoHighLevel lockdown guide does this for a CRM, down to one sub-account and the fewest scopes.
• Answers built for release, and a guard behind them. Ask the connector's vendor three things. Are counts taken over people, with small groups withheld and figures rounded? Can a website visitor set any returned string? Does a final check block, rather than scrub, any response that looks like it contains a name, email, phone, ID or date? Curve MCP is built to answer yes, no and yes.

Hops 3 and 4: where the data stays

The model vendor's context and logs

Whatever reached the model now sits with the model vendor, so the question is which contract covers it. Only Claude Enterprise plans can enable HIPAA readiness, and Anthropic says data sent to third parties through MCP connectors is not covered by its BAA. On the Claude API, the MCP connector is not HIPAA-eligible. Treat Claude Code as uncovered until your contract names it.

OpenAI offers a BAA for ChatGPT only on sales-managed Enterprise or Edu accounts, and none for ChatGPT Business. Either way, retention runs on the vendor's clock. Anthropic's standard retention for commercial Claude Code use is 30 days, and OpenAI's API keeps abuse-monitoring logs for up to 30 days unless zero data retention (ZDR) applies (more in whether Claude is HIPAA compliant).

Where no BAA covers this hop, send the model only data that is not PHI.

The AI app's chat history

The conversation outlives the question. Claude Code keeps session transcripts "locally in plaintext under ~/.claude/projects/ for 30 days by default," and each holds "every message, tool call, and tool result." Hosted apps keep history in the account, and memory or past-chat search can surface an old detail in a new conversation.

Deleting a chat later cleans up the history, not the disclosure.

• Shorten local retention with Claude Code's cleanupPeriodDays setting.
• Use managed work accounts, never personal plans, with full-disk encryption on every laptop that runs a local client.
• Turn memory off in any workspace that handles clinic data.

Hops 5 and 6: where the data spreads

Other connectors in the same session

An AI session is one context window with many tools attached. Anything one tool returned, the model can pass as arguments to another: a web search on a patient's condition, a Slack post, an email draft. HighLevel's v1 server even includes conversations_send-a-new-message, which messages a contact directly.

Web search is the quiet one. Microsoft says "HIPAA compliance doesn't apply to web search queries," and OpenAI's API documentation calls web search with live internet access "not HIPAA eligible." A model that searches to add context can carry a CRM detail onto the open web.

Hostile content makes chaining worse. Invariant Labs showed that a malicious server can "poison tool descriptions to exfiltrate data accessible through other trusted servers." Our piece on prompt injection in ad data covers the clinic version.

• One session, one data class. Never attach a patient-data connector to a session that also has web search, messaging or email tools.
• Keep a human able to deny each tool call, as the MCP specification recommends, and pin approved tool definitions with hashes, as OWASP advises, so a server cannot change a tool after approval.
• Treat every tool result as untrusted data, never as instructions.

Screenshots, shares and exports

The last hop leaves every technical control behind. A pasted answer in a weekly deck, a screenshot in the agency's Slack, a CSV export: each reaches an audience nobody reviewed. Claude's public chat links show a snapshot of the conversation, and "Anyone with the link can open it. No Claude account is required."

Feedback tools are exports too. Claude Code's /feedback command sends a copy of the conversation history to Anthropic, and reports sent through it, /bug or /share, are kept for five years. Answering Yes to the in-session survey's transcript request uploads the raw session log.

• Write a sharing rule: which answers may leave the AI app, to whom, in what form. Revoke old share links.
• Switch off what you do not need. DISABLE_FEEDBACK_COMMAND=1 and CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY=1 close both paths in Claude Code.
• Make answers safe to screenshot by design. If an answer would be a breach in a screenshot, it was already a problem when it reached the model.

How Curve MCP closes the two server hops

Curve MCP answers questions about a clinic's website and campaigns: visitors, sessions, goal completions and funnel steps. It also reconciles your server-side campaigns, putting each campaign's platform-reported spend, clicks and impressions next to the conversions Curve's server-side tracking recorded, with cost per conversion by completed week, and one link opens the full sent, accepted and matched view inside Curve. It works with any MCP-capable client, including Claude, ChatGPT and Cursor, and it assumes the model vendor on the other end has no BAA.

• Arguments. The data tool takes one input: last week, or the last 4, 13 or 52 completed weeks. It has no text field, filter or custom date, so a name cannot reach a query. The one tool that accepts words is the hand-off below. It takes a short question and an optional email or phone. None of that ever reaches a query or an answer. An email or phone is masked or kept only as a keyed hash, and the question stays in Curve's own audit record, under Curve's BAA.
• Results. Answers count people, not visits, across the whole window. Small groups are withheld, counts and spend are rounded, and a number is withheld when subtraction would expose a small group. A campaign, goal or funnel name appears only if the clinic approved it; otherwise it reads "(label hidden)". No UTM value, page path or referrer ever comes back.
• A guard on the wire. A final check reads every response for anything that looks like an email, phone number, ID, date or name. A hit blocks the answer rather than scrubbing it, and so does a guard that cannot run.
• Least privilege. The service runs under its own database role, which cannot read contact details, form answers or journeys, and it checks that every time it starts.
• Logs. Every call is logged, and if the log cannot be written, no data is returned. Tool arguments and answers stay out of application logs and error tracking (what to keep in MCP audit logs).
• Chained tools. Every string in an answer is a fixed word or an approved label, tool descriptions state that returned values are data rather than instructions, and there are no write tools.

Person-level questions get a link, not data. Ask about Maria Alvarez and the connector returns a one-time link that opens Curve Analyst behind a login; it expires quickly and carries no data. The hand-off never looks her up, so its reply is identical whether or not she is a patient.

What it cannot do matters as much. It cannot stop a user typing a name into the chat, govern your other connectors, or make your AI vendor HIPAA compliant. It also returns no revenue, ROAS or breakdown by channel, device, region or page.

Frequently asked questions

Is it a HIPAA violation if staff type a patient's name into an AI assistant?

It can be. If no BAA covers that vendor's plan and feature, the name went to a party with no business associate agreement, and your privacy officer should assess it as a possible impermissible disclosure. If a BAA does cover it, the use still has to meet minimum necessary. Either way, no MCP server can undo it afterward.

Does running an MCP server locally keep PHI on my machine?

No. Local means the server's code runs on your machine. The client still sends every tool result to the model vendor on the next turn, and Claude Code also writes a plaintext transcript to disk.

Is sharing an AI chat that contains MCP results a disclosure?

It is when the chat holds PHI. A share link passes the whole conversation, tool results included, to whoever opens it, with no Claude account needed. Sending PHI to someone with no need to see it is a disclosure for your privacy officer to assess, as if you had emailed the record. Revoking the link cannot recall copies. If the results were only aggregates that identify no one, sharing discloses no PHI, which is why what a connector returns matters more than any sharing rule.

Does zero data retention make PHI in tool results safe?

No. ZDR limits what a vendor stores, not who receives the data, and it is not a BAA. Anthropic's ZDR does not extend to Team or Enterprise chat interfaces or third-party integrations, flagged content may be kept for up to two years, and Anthropic describes HIPAA readiness as an alternative to ZDR, not an add-on.

Which hop should a clinic fix first?

Tool results, because they carry the most data and the fix is structural: connectors whose credentials cannot read patient records. Next, session composition: no session mixes a patient-data connector with web search or messaging. Staff rules for prompts and sharing come third, since they rely on memory.

Where to start

List every AI app your team and agencies use, and every connector attached to each. Note which of the six hops can carry PHI and whether a BAA covers each one. Remove person-level and free-text tools from any session whose vendor has no BAA, then set history retention and a sharing rule. If your website still sends pixel data to ad platforms, run the free compliance scanner first, because that leak sits upstream of every MCP hop.

To see an MCP connector built to close both server hops, book a Curve MCP demo. Curve includes a signed BAA on every plan, and the demo shows what the connector returns, what it withholds and why.

Reviewed September 2026. Sources: MCP specification 2026-07-28, 45 CFR Parts 160 and 164, and Anthropic, OpenAI, Microsoft, Google, HubSpot and HighLevel documentation.