Fair questions, straight answers.

No. The product is read-only by construction — there is no code path that writes to Kipu. Your team asks questions; nothing is ever created, updated, or deleted.

MCP — the Model Context Protocol — is the open standard for connecting AI assistants like Claude to outside systems. An MCP server is the secure bridge in the middle: Claude asks it questions, and it translates them into signed, scoped requests against the system of record. EMR MCP is an MCP server for Kipu^® EMR — read-only, permission-mirrored, and private to your organization.

Not today. EMR MCP is built exclusively for Kipu — the tools, the permission mirroring, and the PHI minimization are all designed around Kipu's API V3 and data model. If you run a different EMR, we're not the right fit yet.

API V3 access on your instance and a set of API credentials (Settings → API management). If API access isn't enabled yet, your Kipu account manager can turn it on. We validate your credentials live during onboarding.

About 15 minutes once you have your API credentials: we provision your endpoint, you paste it into Claude, staff sign in, and the first question gets answered. No integration project, no changes to Kipu^®. The step-by-step is on how it works.

We sign a BAA with every customer. Requests default to minimum-necessary PHI, aggregate tools return counts instead of records, no patient data is stored, and every call is attributable to a signed-in staff member. On the Claude side, we recommend using Claude Enterprise only, with a BAA signed with Anthropic — EMR answers flow into your team's Claude conversations, so that agreement is a key part of keeping the full workflow HIPAA compliant. We walk you through it during onboarding.

We suggest Claude Enterprise only, with a BAA signed between your organization and Anthropic — that's the configuration we recommend for remaining HIPAA compliant, since EMR data appears in your staff's Claude conversations. An admin adds the connector once for the whole workspace; each user still signs in individually, so access and audit stay per-person.

Never patient data — answers pass through signed per request, and no patient records are cached or kept. We store three things: your staff directory (names, emails, roles, location assignments) to enforce permissions, audit records of who ran which tool and when (never arguments or results), and your Kipu^® API credentials, envelope-encrypted. The full inventory is on security.

Remove them in Kipu^®, as you already do. Your Kipu user directory is the access list, so their connector access is revoked at the next directory sync — it runs nightly. There's no separate account to remember to close.

Ask us. Every tool call is recorded — who ran it, which tool, when, with patient arguments and results deliberately excluded — and we'll provide an export on request.

$299/month up to 3 facilities, $999/month up to 15, $2,499/month beyond that — unlimited staff on every plan, and two months free if you pay annually. A single-facility pilot is free while you evaluate. Full detail in pricing.

Any time. Your connector keeps working through the period you've already paid for — and patient data was never stored to begin with.