What Makes an MCP Server HIPAA-Safe: The 2026 Checklist

An MCP server is HIPAA-safe only when every system that sees its answers (the server, the AI app that calls it and the model vendor) has a signed BAA or never receives PHI, and the server itself enforces that. That takes least-privilege access, de-identified outputs, fixed inputs, read-only tools, expiring tokens, a log of every call and a fail-closed egress check, and the twelve items below turn each into a vendor question. Curve built Curve MCP, its connector for clinic campaign data, around all twelve, and the section after the checklist shows how.

Why the server alone cannot be HIPAA-safe

A "HIPAA-compliant MCP" claim usually describes one box. An MCP answer passes through three: the server that fetches the data, the host app (Claude, ChatGPT, Cursor, an in-house agent) that calls the tool, and the model vendor whose model reads the result.

Running the server locally changes where the code runs, not where the answer goes. Google's Ads MCP repository: "The MCP Server will expose your data to the Agent or LLM that you connect to it." The specification lists user consent, data privacy and tool safety among its principles, then says MCP "cannot enforce these security principles at the protocol level." Every control below is something a given server built, or did not.

The checklist, part 1: what the server sends out

1. A BAA, or a documented reason none is needed, for every hop

Under 45 CFR 160.103, a vendor that "creates, receives, maintains, or transmits" PHI on your behalf is a business associate, and 164.502(e) requires a written contract. For MCP that is three answers, not one. Google lists no advertising product under its Cloud BAA and offers no BAA for Google Analytics.

• Ask: draw the path from database to model and name the BAA at each hop, or show why that hop gets no PHI.
• Red flag: one vendor's BAA offered as proof the whole chain is covered.

2. Minimum necessary, enforced at the credential

The minimum necessary standard (164.502(b)) asks for "reasonable efforts" to limit PHI to what a task needs. An assistant asking "how did last month go?" needs counts, not contact records, and that limit belongs in the credential, because a prompt cannot revoke a permission. HubSpot enforces a server-side version: with Sensitive Data on, its MCP server blocks activity and conversation data.

• Ask: what could this server's credential read if a tool had a bug?
• Red flag: the application's main database user, or an all-scopes API key.

3. De-identified answers under a named HIPAA method

HIPAA recognizes two methods in 164.514(b). Safe Harbor removes 18 identifiers, including dates more specific than the year, geography smaller than a state, URLs and IP addresses. Expert Determination has a qualified expert find the risk "very small" and document the methods and results; HHS sets no universal number for it.

Aggregates are not safe by default. Two new patients from one campaign in one week can point at people, and two totals can be subtracted to expose a small one. CMS's cell-size policy for its research data, a common benchmark, bars reporting any cell from 1 to 10, or any figure that lets one be derived. More in our guide to small-group rules for MCP answers.

• Ask: which method, who did the analysis, and what stops one answer being subtracted from another?
• Red flag: "we mask names."

4. Only approved strings leave, and no visitor writes one

Strings are where PHI and attacks ride. Any site visitor can set UTM values, page paths and referrers, and a search-terms report is text typed by strangers seeking care. OWASP warns that attackers "encode instructions within tool return values," and Invariant Labs showed a planted GitHub issue steering an agent into leaking private repository data.

• Ask: list every string a tool can return, and who can set each one.
• Red flag: raw URLs, search terms or campaign names passed through as stored.

The checklist, part 2: what the server accepts and can do

5. Allowlisted inputs, not a query language

A tool that accepts a query string makes the rest of the tool list decorative. Google's Ads MCP server runs any GAQL query the account can answer, and GoHighLevel's current server routes operations through execute_operation, bounded by the OAuth scopes granted. Free text lets an injected instruction steer the query, and a pasted patient name lands in logs. Safe inputs are enums, booleans and bounded integers.

• Ask: show the input schema for every tool. Which fields take free text?
• Red flag: a "query," "filter" or "search" string near patient data.

6. Read-only by default, with write tools removed rather than labelled

The specification calls every tool annotation a hint, defaults readOnlyHint to false, and tells clients not to trust annotations from untrusted servers. Meta's ads MCP server has write tools: it creates entities paused, the AI client asks for confirmation before ads_activate_entity starts spend, and Meta lets you restrict an agent to read-only per asset. GoHighLevel's v1 server can message a contact.

• Ask: which tools can change anything, and can they be removed on the server?
• Red flag: "the assistant always asks before it acts."

7. Scoped tokens that expire and bind to one account

Authorization is "OPTIONAL" in the MCP specification. Where a remote server adopts it, the rules are built on OAuth 2.1: PKCE, no tokens in URL query strings, a server that confirms each token was issued for it, no passing a client's token through, and short-lived tokens recommended.

Local stdio servers skip it and read credentials from the environment, such as a google-ads.yaml file on a laptop. Some remote servers take static tokens too: GoHighLevel's v1 server accepts a Private Integration Token as a bearer header. More in our guide to MCP token scopes and expiry.

• Ask: how long does a token live, what can it reach, and who is told when one is issued?
• Red flag: a remote server with no token check at all, or a key that never expires pasted into a team chat.

8. Off by default, switched on by the covered entity

The clinic, as the covered entity, should decide whether an assistant can query its data, and which users can. A server that switches on at install, or that an agency can enable, hands that decision to someone else. Per-user grants keep minimum necessary honest.

• Ask: who can enable this for our organization, and can anyone outside it?
• Red flag: access inherited from whoever installed the connector.

The checklist, part 3: proof, containment and cleanup

9. A record of every tool call, or no answer

The audit controls standard (164.312(b)) requires mechanisms that "record and examine activity" in systems that contain or use ePHI. The MCP spec's logging advice targets clients, whose logs live on a laptop or with the AI vendor. The server needs its own record of who called, which tool and arguments, exactly what left, and every denial. The strong version is "no log, no answer" (see what to keep in MCP audit logs).

• Ask: if a leak surfaces next year, can you show exactly what left, and to whom?
• Red flag: sampled request logs in a general-purpose monitoring tool.

10. An egress check that fails closed

A final, independent check should read each response before it leaves for anything shaped like an email, phone number, long ID, date or name. On a hit it should block, not scrub: redaction passes whatever patterns miss and hides that a tool misbehaved. If the check errors or times out, nothing goes out.

• Ask: what inspects the final response, and what happens when that inspection fails?
• Red flag: "we redact PHI automatically."

11. Retention you can state for every hop

Three clocks run at once: the server's audit records, the AI app's conversation history, and the model vendor's retention. HIPAA requires documentation to be kept six years from creation or last effective date (164.316(b)(2)(i)), so a 30-day log rotation fails if your policies count tool-call records as documentation. OpenAI's API docs say data sent to a remote MCP server follows that server's retention policies, and Anthropic's API MCP connector is not eligible for zero data retention.

• Ask: for each hop, how long does an answer live, and who can delete it?
• Red flag: nobody can answer for the AI side.

12. A safe exit for person-level questions

Someone will ask the assistant whether Tuesday's caller booked her consult. A HIPAA-safe server declines in chat and hands off to a system with its own access controls and BAA, through a link that carries no data, requires a login and expires. Without that exit, users paste records into the chat instead, which is worse (see why you cannot paste a patient funnel into ChatGPT).

• Ask: what happens when a user asks about one patient?
• Red flag: the tool returns the record because the user "already has CRM access."

How Curve MCP handles each item

Curve MCP returns organization-level numbers to any MCP client, including Claude (desktop, web and Claude Code), ChatGPT and Cursor: visitors, sessions, goal completions and funnel steps. It also reconciles your server-side campaigns, putting each campaign's platform-reported spend, clicks and impressions next to the conversions Curve's server-side tracking recorded, with cost per conversion by completed week, and one link opens the full sent, accepted and matched view inside Curve. Item by item:

1. BAA per hop. The signed BAA covers Curve's side. The AI vendor is your choice, not a Curve subprocessor, so the design assumes that hop has no BAA and sends it only aggregate figures, with small groups withheld, whichever client you connect.
2. Minimum necessary. The service runs under its own database role, which cannot read contact details, form answers or journeys, and it checks that every time it starts.
3. De-identified answers. It counts people, not visits, across the whole window, withholds small groups entirely, and rounds every people and activity count and all spend. Clicks and impressions pass through as the ad platform reports them. Cost per conversion comes from the rounded figures, and a number is withheld when subtraction would expose a small group. The rules are written to be assessed under Expert Determination, so ask in the demo who performs that analysis and where it stands.
4. Approved strings. A goal, funnel or campaign name appears only if the organization approved it; otherwise it reads "(label hidden)". No UTM, page path or referrer is ever returned.
5. Fixed inputs. The data tool takes one choice: last week, or the last 4, 13 or 52 completed weeks. No custom dates, filters, or breakdowns by channel, device, region or page. Only the hand-off tool also takes an optional short question and an optional email or phone for the person asked about. Neither reaches a query or an answer, and the email or phone is stored only as a hash.
6. Read-only. Tools only, no write actions.
7. Tokens. Access tokens are scoped and expire. Issuing one needs a confirmation code, and admins are notified.
8. Off by default. A per-user switch starts off, and only the clinic's primary user can turn MCP on for the organization.
9. Audit. Every call is logged. If the log cannot be written, no data is returned.
10. Egress. A final guard checks every response for anything that looks like an email, phone number, ID, date or name. A hit, or a guard that cannot run, blocks the answer.
11. Retention. Records of calls that returned data are kept for years, so a late question can be checked against exactly what left.
12. Person-level exit. Deeper questions get an "open in Curve" link into Curve Analyst. It requires a login, works once, expires quickly and carries no data.

Figures cover completed weeks only, so they can trail the dashboard by up to a week. There is no revenue, no ROAS, and no channel or device breakdown. Those limits exist because the model vendor on the other end may have no BAA with you.

Frequently asked questions

Which items can a clinic check itself, without trusting the vendor?

Three. Read the tool list and input schemas your AI client shows (items 5 and 6), ask about a made-up patient (item 12), and note when an issued token stops working (item 7). The rest need vendor evidence in writing: the credential's grants, the audit record, the egress check and the de-identification analysis.

Which checklist items still apply to a server that runs locally?

All twelve, because a local server still hands every answer to the AI app and the model vendor. What shifts is ownership. Items 7, 8 and 9 fall to your team: the credential is a key file on that machine, anyone who can launch the server can query it, and no server-side log exists unless you build one. The MCP security guidance adds that a local server runs with the same privileges as the client.

How often should an approved MCP server be checked again?

Whenever its tool list changes, not only at renewal. Invariant Labs warns that a server can change a tool description after the client approved it, and OWASP recommends pinning tool definitions with cryptographic hashes so the change is caught. When a hash changes, recheck items 5 and 6 before the next call.

If an MCP answer is truly de-identified, does the model vendor still need a BAA?

Information that meets 164.514(b) is not PHI, so the BAA requirement does not attach to it. The catch is "truly." The method has to hold up under Safe Harbor or an Expert Determination, and a patient name a user types into the chat is still PHI. Ask any vendor, Curve included, which method it uses and who did the analysis.

Can a redaction proxy in front of an existing MCP server make it safe?

It lowers risk but cannot fix a server that returns rows. A proxy removes only what its patterns recognize, so a nickname, rare procedure or small count passes through. Release only values built to be safe, and keep pattern checks as a blocking backstop.

If I can only check three items, which ones?

Start with 1, 5 and 9. Item 1 shows where PHI could go and what covers it, item 5 whether anyone can steer data out, item 9 whether you would know. Fail any of them and the server fails.

Where to start

List every MCP connection your team uses or plans, and score each against the twelve items, starting with item 1, then file the results in a compliance officer's approval record. If your website still sends pixel data to ad platforms, run the free compliance scanner first, because no MCP design fixes a leak upstream of it.

To test Curve MCP against the twelve items, book a demo. Curve includes a signed BAA on every plan, and the demo shows what the connector returns, what it withholds and why.

Reviewed September 2026. Sources: MCP specification revision 2026-07-28, 45 CFR Parts 160 and 164, HHS de-identification guidance, and vendor documentation.