HIPAA compliant AI coding assistants and bank security reviews for MCP servers

The hospital engineering team wants to use Claude Code or Cursor. The bank wants to do the same, plus use a couple of MCP servers to integrate the agent with Jira, database, and docs. What does the security review look like? Is HIPAA or bank vendor guidance relevant to a coding tool? What needs to be in the proof file?

To answer those questions, the reviewer must determine the data exposure and contract status for each vendor. The coding agent exchanges data (prompts, files, tool output) with the model provider. MCP servers are additional vendors, not covered by the model vendor's contract.

Are AI coding agents HIPAA compliant if they never see patient data?

Yes, as long as the agent and every tool it calls never receive protected health information (PHI). HIPAA makes a vendor a business associate only when it creates, receives, maintains or transmits PHI for a covered entity, so a coding tool that never gets PHI needs no business associate agreement (BAA).

The hard part is proving "never". A cloud provider is a business associate even when it stores only encrypted PHI and has no key. So a vendor's promise not to look at the data does not help once PHI reaches its servers.

PHI also has a narrow meaning, and that works in your favor. A name in a phone book is not PHI. The same name next to a clinic visit is PHI, because the identifier now links to health data. Most source code holds no PHI at all. The risk sits in the data around the code.

Each path out of the laptop has its own contract question:

Where PHI gets into a coding session

A developer using a coding agent on a health codebase won't usually be asking about a patient. Instead, PHI will enter the context via:

• Seed data and test fixtures copied from production tables.
• Logs, stack traces, and error payloads that the developer pastes into the chat window or the agent reads from the terminal.
• Database connections and MCP servers configured to use production (or a copy of production). If the developer or the agent runs a query tool, the rows come back into the model’s context.
• Tickets, screenshots, and support threads the agent fetches via an issue tracker MCP server.
• Local session files and agent memory stored on the developer’s laptop. (OpenAI’s BAA does not cover the Codex client running on your own machines.)

The easiest way to use test data safely is to de-identify it. HHS supports two methods of de-identification: Safe Harbor, which requires stripping 18 types of identifiers (including names, dates, and record numbers), and Expert Determination, which requires a qualified expert to confirm the re-identification risk is low. Once data is de-identified using either method, it is no longer restricted by the Privacy Rule. Or even simpler: generate fake records that don't correspond to any real person.

If you cannot de-identify, then your HIPAA posture with a coding agent is an engineering question: Is there any path for PHI to reach the repo, the terminal, or the agent's tools? If the answer is yes, then every vendor on that path must sign a BAA. If the answer is no, then write down how you know.

Which AI coding tools sign a BAA

Three of the four big coding agents now offer a BAA, but only on enterprise tiers and only with specific settings turned on. GitHub Copilot is the exception. Here is where each one stands:

When it comes to coverage limits, all three BAAs have the same boundary. Anthropic, OpenAI and Cursor all omit MCP servers and other third-party services from their BAA. If an MCP server can return PHI, that server's operator must have its own BAA.

Anthropic adds surface-level exclusions to Claude Code. If a user connects Claude Code directly to Anthropic, the terminal and the Code tab in Claude Desktop are covered. If they run the same agent inside the VS Code extension, it is not covered, even with the HIPAA configuration applied.

The surface-level exclusions on Claude Code have the potential to confuse users, as a developer can easily transition between covered and uncovered surfaces without being aware.

Claude Code BAA coverage by surface

What security review do banks need for AI coding tools and MCP servers?

US banks review AI coding tools and MCP servers as third-party relationships under the 2023 interagency third-party risk guidance, and the code they produce under the FFIEC rules for system development. EU financial entities add the ICT third-party rules in DORA. Model risk guidance does not cover these tools.

The interagency guidance on third-party relationships from the Fed, FDIC and OCC sets a life cycle for every vendor: planning, due diligence and selection, contract negotiation, ongoing monitoring, and termination. Due diligence on information security includes the vendor's access controls, encryption, secure source code management, development life cycle, and penetration test results. A coding tool's model providers count as subcontractors, and the guidance has a section on them too.

The FFIEC Development, Acquisition, and Maintenance booklet, issued in August 2024, covers the system development life cycle and supply chain risk. Examiners use it to check how a bank builds and changes its systems. Code that an agent writes goes through the same change control as code a person writes.

Model risk is the surprise. In April 2026 the agencies replaced the 2011 model risk guidance with new guidance, and OCC Bulletin 2026-13 says generative AI and agentic AI models are not within its scope. The agencies plan a request for information on model risk that covers generative and agentic AI. Until then, a coding agent's review sits with third-party risk and information security, not with model validation. The scope line sits in the bulletin's highlights:

OCC Bulletin 2026-13 highlights

EU financial entities also fall under DORA, which has applied since 17 January 2025. Article 28 makes them keep a register of information on every contract for ICT services. Article 30 makes the contract name the regions where data is processed and the conditions for subcontracting. A coding tool that routes prompts to several model providers in several regions has to say so in writing.

MCP servers get the same treatment, with a few extra checks. The NSA's MCP security guidance from June 2026 asks organizations to keep an inventory of every MCP agent and tool with versions, log every tool call with its parameters and identities, run servers with least privilege, and scan the network for unauthenticated MCP servers. The MCP security checklist covers the protocol-level risks in more depth.

A review checklist for coding tools and MCP servers

Both the health and banking reviews follow the same initial data mapping, which can be done as a single checklist:

For the coding tool vendor:

1. Map the data flow: what leaves the laptop, what model providers receive it and where they process it. DORA Article 30 and the US guidance on subcontractors both ask for this.
2. Put the right contract in place: either a BAA for a health system (if PHI can reach the vendor), or the right bank protections on data use, audit rights and data return or deletion at termination.
3. Lock down settings in the admin console, such as Cursor's org-wide Privacy Mode, Anthropic's HIPAA configuration or zero data retention, or OpenAI's Modified Retention. Do not rely on individual developers configuring settings that can be disabled.
4. Restrict use to the permitted surfaces. If the BAA covers the terminal but not the IDE extension, block the extension or restrict PHI from that repo.
5. Collect the required assurance evidence: SOC 2 Type II report, penetration test results and vendor's development life cycle.
6. Enforce human review on code changes: treat agent-written changes the same as other code changes, with the same pull request review, tests and change control.
7. Record the tool on the third-party inventory (and DORA register of information for EU entities).

For each MCP server:

1. Determine the operator. Is the server running as a local process, hosted by a vendor, or self-hosted? Know who owns it and the version.
2. Restrict access. Use read-only credentials where possible. Never expose production PHI or customer data to the server.
3. Verify server output. Data returned by the tool goes directly into the context and may contain PHI or injected instructions.
4. Implement access controls. Use an MCP gateway to provide SSO and a centralized approval flow for MCP servers.
5. Log everything. Record tool invocations with user, tool name, and parameters.
6. Ensure contract coverage. Model vendor BAAs don’t cover the MCP server; either the operator of the server must also sign a BAA, or the server must never have access to PHI.
7. Verify maintenance. Many popular MCP servers are no longer maintained; the NSA recommends the most stringent code review profile for new ones.

Where Context7 fits in a regulated review

Context7 is an MCP server that provides up-to-date documentation for public libraries to coding agents, so it will appear on the MCP list in most of these reviews. Context7 uses a narrow data flow: the agent sends a search query it writes and a library name. Your prompts, source code and conversation history are not sent and tool descriptions direct the agent to remove credentials and personal data from the search query.

This setup puts Context7 on the "never receives PHI" side of a health review. Context7 lists SOC 2 Type II, GDPR and ISO 27001 (in progress) via Upstash; HIPAA is not on the list, so the review file should note that Context7 receives only library questions, and that PHI is excluded from queries by design and policy.

For bank reviews, the Enterprise plan adds the ingredients a third-party review asks for:

• Cloud service uses 30-day retention and offers US or EU data residency.
• SSO via Entra ID or any OIDC provider, with library access rules by SSO group.
• The MCP server is open source for team audit, matching the NSA's advice to review MCP server code.
• Queries from Enterprise teamspaces are never stored for benchmarking.

Where no outside service is permitted, Context7 On-Premise provides a Docker or Kubernetes deployment. This option keeps repositories, generated docs, the database, the vector store, and the MCP server within your network, while offloading parsing and reranking to your choice of AI provider—including AWS Bedrock or any OpenAI-compatible endpoint. On-prem installs can turn off public documentation entirely, or import library bundles into an air-gapped network.

The following guides address the rest of an enterprise rollout:

• Self-hosted AI coding assistants - options for self hosting the agent stack
• Air-gapped AI coding - for air-gapped networks
• AI coding assistant data privacy - privacy implications of Cursor, Copilot, and Claude Code (they all send data to the cloud)