Connecting AI to the records you are responsible for

You have an assistant that writes well and a pile of records it cannot see. Client history sits in one system, invoices in another, intake notes in a shared drive with a naming convention only you understand. So you paste. Every useful answer starts with 10 minutes of assembling context by hand, and the answer is only as good as the fragment you remembered to include. The tempting conclusion is that you need a better model. Almost always you need a connection.

This guide is for a solo operator or a small team holding records that belong to other people, which is most trades once you look: clients, patients, candidates, tenants, employees. It covers how those records reach an assistant, what a connection actually grants, and which protections travel with the data after it moves. It is not for anyone building a product on model APIs, and it is not legal advice. Where it uses US health rules as the worked example, that is because health is the sharpest version of a problem every regulated trade has in a milder form.

The model was ready long before the data was

OpenAI introduced Health in ChatGPT on 7 January 2026, and the centre of that announcement was not a model. It was plumbing. “To enable access to trusted U.S. healthcare providers, we partner with b.well, the largest and most secure network of live, connected health data for U.S. consumers” [1]. The general rollout to US users on the Free, Go, Plus and Pro plans, on web and iOS, was announced on 23 July 2026 [2]. More than 6 months separated the two, and the second announcement was about reaching people, not about reasoning better.

Models were named in July, GPT-5.5 Instant for free users and GPT-5.6 Sol for paid plans [2], but those are the part that changes every few months without you lifting a finger. A company that could afford to build anything chose to partner for the work of pulling records out of thousands of provider systems and normalising them. Your version of that decision is smaller and exactly the same shape. The thing standing between your assistant and a specific, useful answer is rarely the model, and the work you are underestimating is the connection.

That reframing has a budget consequence. If the choice is between a higher subscription tier and a weekend spent making your records reachable, the weekend usually wins, and it keeps winning after the next model release.

Protections follow the data, not the tool

The rule that surprises people is that the safeguards on a record are a property of who holds it, not of the record itself. The US Department of Health and Human Services says it plainly: “Once health information is received from a covered entity, at the individual’s direction, by an app that is neither a covered entity nor a business associate under HIPAA, the information is no longer subject to the protections of the HIPAA Rules” [8]. The provider that released it “would not be liable under the HIPAA Rules for any subsequent use or disclosure of the requested ePHI received by the app” [8].

That is not a criticism of any product. It is the design. And the vendor says the same thing from its side: “Health in ChatGPT is not intended for clinical or covered-entity use and does not offer a Business Associate Agreement” [3]. What you get instead is a set of commitments, and they are real ones. Connected medical records and Apple Health information, and conversations that use them, “are not used to train our foundation models or target ads, regardless of the model-training setting you choose” [2][3].

Hold those two facts next to each other, because the gap between them is the whole subject. A commitment published on a help page is a policy the vendor administers. A business associate agreement is a contract the vendor signs. Both can be honoured. Only one of them is the thing a regulator, an insurer or a client’s lawyer will ask you to produce. When you move someone else’s records into a tool, the protections that applied where they came from do not come along. The only protections you have are the ones written into your agreement with the vendor, on the specific plan you pay for.

A connector is a standing grant, not a paste

The plumbing has a standard now. The Model Context Protocol is an open protocol for connecting assistants to external data and tools, and its current specification revision is dated 2026-07-28 [7]. That matters mostly because it means the connection you build has a chance of outliving the assistant you built it for.

Read the specification’s own security section before the tutorials, because it is unusually blunt about where the risk sits. Hosts “must obtain explicit user consent before exposing user data to servers” and “must not transmit resource data elsewhere without user consent” [7]. Tools “represent arbitrary code execution and must be treated with appropriate caution”, and descriptions of what a tool does “should be considered untrusted, unless obtained from a trusted server” [7]. The protocol cannot enforce any of that. It says so.

Vendors repeat the warning in plainer words. Anthropic tells you to “only connect Claude to servers built and hosted by organizations and applications you trust”, and warns that “malicious MCP servers may include hidden instructions that try to make Claude perform unintended actions” [6]. Custom connectors are available on the Free, Pro, Max, Team and Enterprise plans, with free accounts limited to one [6].

The practical difference is the one the word “connect” hides. A paste is one document, once, chosen by you. A connector is a door held open with your credentials, and whatever it can reach, the assistant can reach on any future turn, including turns where you are not watching.

Climb the ladder only as far as the work requires

There are four rungs, and most operators should stop on the second or third.

The first is pasting. It costs you minutes and grants nothing. It is correct for work you do twice a month, and it stays correct longer than people expect. The second is exporting a file and uploading it, which is still a deliberate act with a boundary you drew, and it handles the case where the same 40 pages answer 20 questions.

The third is a vendor connector, the ones that appear in a directory and take an OAuth grant. This is where standing access begins and where the review discipline in the last section becomes the price of admission. The fourth is a custom connector over MCP, which you should reach only when the data lives somewhere no directory covers and you can name the recurring hours it returns.

Move up a rung when you can point at the time it gives back, never because the connector exists. The paste tax is the number to measure first, because it is the only honest input to the decision.

For regulated records, the plan is the decision

If you hold other people’s regulated records, the choice that matters is not which assistant is smarter. It is which contract sits underneath the seat you are paying for, and the answer is written on the vendors’ own pages.

OpenAI makes a specific list of products HIPAA-eligible with a business associate agreement, including ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT for Clinicians, and the API with Modified Retention [4]. The condition is worth reading twice: “HIPAA eligibility for the OpenAI API is contingent on Customer’s account being provisioned with Modified Retention, unless otherwise specified by OpenAI” [4]. Several features sit outside that perimeter, including cloud-based Codex usage and event-triggered scheduled tasks [4].

Anthropic provides a BAA covering “our HIPAA-ready services, such as use of our first-party API or Enterprise plans” [5], and on Enterprise it is not automatic. “For Claude Enterprise features to be covered under a Business Associate Agreement (BAA), the Primary Owner of the organization must activate HIPAA compliance in the HIPAA-ready Claude Enterprise organization settings” [5], and standard Enterprise plans “do not include BAA coverage without action from a Primary Owner” [5]. The retention rules then run in both directions, which catches people out. “Covered Models require 30-day data retention and aren’t available with zero data retention (ZDR) enabled”, while Claude Code is “Only covered under the BAA with ZDR enabled”, and “ZDR is available for qualified accounts only” [5]. The consumer tiers, Free, Pro and Max, are not on the covered list at all; the page routes them to a separate consumer article [5].

So the same model can be the same model and the arrangement completely different. If you need a signed agreement, you need a plan that offers one, plus the step that turns coverage on, plus a check on whether the particular feature you were excited about is inside the perimeter. Do that before you connect anything, because a connection made on the wrong plan is not fixed retroactively by upgrading.

Write every grant down and re-read it on a schedule

Keep one list. For each connection: what is connected, to which account, with which permissions, what task justified it, and what would break if you revoked it. This is 10 lines in the same place you keep everything else, and it is the only artefact that survives you forgetting why you clicked allow in March.

Then test revocation rather than trusting it. Disconnecting is not the same event as deletion, and the vendors are explicit about the gap. In ChatGPT Health, disconnecting an account stops access, and “data synced from that source is deleted from OpenAI’s systems within 30 days” [3]. Read the sentence after it, because that is the one that matters when a client asks how fast you can pull their material back out: “Information already included in your ChatGPT conversation history remains until you delete those conversations” [3]. Cutting the pipe does not empty the bucket.

Re-read the list quarterly, and treat a connection nobody used since the last review as a grant to cancel. Access you are not using is pure exposure. Budget 15 minutes for the review, which is the closest thing to insurance available to a business with no compliance department.

What still goes wrong

Product boundaries move faster than your notes. The January announcement now carries its own amendment: “Update on July 23, 2026: Health in ChatGPT is launching to U.S. users 18 and older on web and iOS” [1][2]. Every figure and quote above was read from the vendors’ and the regulator’s own pages on 5 September 2026. Treat all of it as a snapshot to re-check at the next review, particularly the lists of which features sit inside a business associate agreement, which are the fastest-moving pages either vendor publishes [4][5].

A signed agreement does not make the answer correct. It governs handling, not accuracy, and grounding an assistant in real records makes its mistakes more persuasive rather than less, because a wrong answer stuffed with your actual client’s actual details reads like it was checked. OpenAI draws the same line around its own health product, which “is designed to support, not replace, medical care” and “is not intended for diagnosis or treatment” [1]. The failure mode of a well-connected assistant is not a generic hallucination you catch instantly. It is a confident, specific, subtly wrong summary of a record you did not reopen.

The last one is structural and has no clean fix. Everything a connector reaches is both data and potential instruction, which is the reason both the protocol and the vendors warn about hidden instructions and untrusted tool descriptions [6][7]. A connector also inherits your permissions, so an assistant with access to your drive has access to everything in your drive, including the folder you forgot was shared with you. Connect narrowly, prefer read-only where the task allows it, and assume that anything reachable will eventually be read.