EMR integration with AI medical assistants: a FHIR record, a context API and an MCP server

Connecting a language model to a medical record raises three questions before the first prompt: what does the model see, who allowed it, and what happens when it wants to write something back. Anpheros Platform answers all three in the API, so the assistant you build (or the one your users already have) can work on a record without inventing its own rules. This guide covers the context API, the MCP server and the proposal flow.

What the model sees: the context API

POST /v1/context builds an AI-ready summary of a patient within a token budget you set. Every item carries author_type (patient, practitioner, device, import, derived) and its source, so the model can tell a laboratory value from a self-reported symptom and a doctor's diagnosis from a guess. The budget decides what is included first: active problems, current medications, allergies, recent results, then the rest. You get labelled sections or, with format: "text", a rendered block ready for a prompt, plus an omitted list naming what did not fit.

curl -X POST "$BASE/v1/context" \
     -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
     -d '{"patient": "'$PID'", "budget_tokens": 2000, "task": "pre-visit summary", "format": "text"}'

The same provenance labels are what make the output defensible later: an assistant's summary can say where each statement came from.

Who allowed it: consent, not configuration

The token in the call above comes from the person, through OAuth 2.1 with PKCE, with the scopes and duration they chose. An AI application is registered like any other, asks like any other and is listed in the person's "Connections" like any other. Revocation stops it on the next request. A project key alone sees only the patients the project created; it never stands in for consent.

Writing back: proposals, not writes

A write made under a person's consent by an application registered as an AI agent is held. The platform validates it, answers 202 Accepted with a proposal id, and changes nothing. The person sees the proposal, what it is and which assistant sent it, and accepts or rejects it. An accepted proposal is written exactly as sent, marked as AI-written following HL7's AI transparency guidance. Projects that can see the record receive a thin proposal.created webhook.

This is the rule that lets an assistant be useful ("I noticed you mentioned a new medication, shall I add it?") without ever being the author of record.

The MCP server

Assistants that speak the Model Context Protocol connect directly to https://platform.anpheros.com/mcp (streamable HTTP). People connect with OAuth, on their own record; developers can connect with a sandbox key on the 30 synthetic patients. The tools are the ones you would expect from the API:

• list_patients, get_patient_context, get_patient_summary (the International Patient Summary), get_timeline
• get_health_patterns, get_pattern_evidence, get_series, compare_periods (what changed and what recurs, with evidence; not diagnoses)
• search_fhir, read_fhir_resource, get_provenance, lookup_code
• validate_fhir_resource, create_fhir_resource, create_patient, import_lab_report
• sandbox_status, reset_sandbox

The server is listed in the MCP registry as com.anpheros/fhir. Setup for Claude, ChatGPT and other clients is at developers.anpheros.com/guides/mcp.

Private models and EU residency

The platform does not call a model on your behalf; it serves context and accepts proposals. Which model reads the context is your decision: a hosted API, a private deployment, a model on a hospital's own hardware. The record itself stays in the EU, on Cloud Run in europe-west4, with provenance and audit on every access.

What it is not

The platform does not diagnose and does not recommend treatment, and the context API is not clinical decision support. It gives a model the facts, labelled, under consent. What the model says is the responsibility of whoever deploys it.

Frequently asked questions

Can I connect ChatGPT or Claude to a patient record?

Yes, through the MCP server, with the person's OAuth consent on their own record. For development, a sandbox key gives the assistant the 30 synthetic patients.

Does the AI write into the record?

Only as a proposal the person approves. Nothing an AI agent sends is applied without that approval, and accepted entries are marked as AI-written.

How do I keep the model from seeing too much?

Three ways: the scopes the person grants, the category filters on those scopes, and the token budget on the context call, which orders items by clinical relevance and stops at the budget.

Is there an API for a health chatbot in my own app?

Yes. Your app obtains the person's consent through OAuth, calls the context API, sends the result to the model you choose and, if the model suggests an entry, submits it as a write; the platform turns it into a proposal. The TypeScript and Dart SDKs cover the calls.

Where is the data processed?

The record is stored and served from the EU. Where the model runs is up to you; the platform never sends record data to a model itself.