AI applications can call clinical lookup services through an MCP gateway. This guide explains the access path and the controls available for client identity, responses, limits and auditing.
# -*- coding: utf-8 -*-
# Zato
from zato.server.service import Service
# #####################################################################
# #####################################################################
class PatientMessageStatus(Service):
""" Returns whether HL7 messages for a given
patient MRN arrived, with the control ID,
event type and arrival time of each.
"""
name = 'patient.message-status'
input = 'patient_mrn'
output = 'has_arrived', 'messages'
def handle(self) -> 'None':
# The docstring and declared fields above
# are the complete MCP tool definition.
...
Through an MCP gateway - an authenticated endpoint that exposes selected Python services. A service docstring and its declared fields become the tool definition. Gateway configuration selects which services and clients are allowed, while response controls, rate limits and MCP auditing are enabled separately.
The client can be Claude Code, Cursor, ChatGPT or another MCP implementation configured with the gateway address and an accepted credential. The same services can continue serving their existing interfaces.
Healthcare AI projects need controlled access to clinical data. The HIMSS and Medscape AI adoption report (2024) found 86% of health systems already using AI, with 72% naming data privacy as a significant risk, and HIMSS Market Insights found 86% of healthcare leaders agreeing that interoperability without data preparation provides limited value for analytics or AI.
HL7 v2 messages require parsing before use in model context, FHIR profiles vary by vendor, and external model access requires the corresponding data agreement. Each agent integration also needs identity, response controls, rate limits and auditing.
The Model Context Protocol is the open protocol AI agents use to discover and call external tools, and healthcare is adopting it as the access layer for clinical data - AWS open-sourced a HealthLake MCP server (2025), Innovaccer published HMCP (2025) layering OAuth2, audit and rate limiting on top of it, and industry press has described MCP as "FHIR for AI" (2025).
In Zato, MCP is built into the same platform that runs the HL7 v2 and FHIR traffic - the MCP gateway is a first-class object next to the MLLP channel and the FHIR client. The gateway routes authenticated tool calls to selected Zato services.
A gateway centralizes the controls between MCP clients and Zato services.
| Concern | Hand-wired agent access | Through an MCP gateway |
|---|---|---|
| Identity | Defined by each integration | Mandatory gateway authentication through an API key, Basic Auth or bearer token |
| PII removal | Defined by each integration | Enabled detectors replace the findings they match in tool responses |
| Rate limits | Defined by each integration | Optional rules attached to security definitions and enforced before gateway handling |
| Audit | Defined by each integration | Optional payload-free MCP events with identities, outcomes and sizes |
Three documented scenarios provide the service, exact tool JSON and client response for each question - did a message arrive for this patient?, which interfaces had failures overnight? and has a feed gone silent?.
AI in clinical interfaces links to the remaining MCP and model-invocation documentation.
Gateway authentication is mandatory, and the resolved security definition becomes the client identity. Optional response controls include PII detectors, content safeguards and size caps. Rate limits are configured on security definitions. When enabled, the MCP audit log records payload-free events with the caller, outcome and message sizes.
The MCP client receives the tool result after any enabled response controls run. Those controls remove only findings matched by their configured detectors. Whether the result reaches an external model depends on the MCP client and model deployment.
A running Zato, one Python service and one MCP gateway - the tutorial walks the whole path on fabricated static data before connecting the service to an HL7 audit log.
Agents connect to the gateway, and the gateway calls selected services. Those services can read an interface database, an audit log or a FHIR server through their existing connections.
MCP is an open protocol from the AI ecosystem and is unrelated to the HL7 v2 MCP segment. It provides tool access for AI applications, while MLLP transports HL7 v2 messages.
When MCP auditing is enabled, handled gateway requests record the client, method, outcome and data sizes. MCP audit events use payload-free metadata. Rate-limit enforcement runs before gateway audit handling.
Get started with Zato and put an authenticated MCP gateway in front of selected clinical services.