At A Glance
- MCP has become the default way AI agents connect to healthcare data and tools, but the protocol itself doesn’t mandate access control, audit logging, or encryption.
- A critical vulnerability in the widely used mcp-remote package, CVE-2025-6514 (CVSS 9.6), let attackers achieve full remote code execution against MCP clients connecting to untrusted servers — a preview of what an under-secured MCP deployment can expose.
- HIPAA applies to AI agents the same way it applies to any human employee or business associate touching PHI.
- NetFoundry’s approach makes the LLM endpoint or MCP server unreachable from the network entirely, then layers identity-based authorization underneath OAuth for defense in depth.
- Deployment takes minutes, either by embedding the NetFoundry SDK directly in the application or by fronting it with a NetFoundry agent or gateway.
In healthcare, AI is deploying faster than it can be secured. Clinical documentation assistants draft notes, agentic systems chase prior authorizations across payer portals, diagnostic copilots pull imaging and genomics into a single view, and patient-facing chatbots field questions about lab results and discharge plans. 90% of physicians and nurses name technology-driven efficiency gains, including AI, as a top trend shaping their organizations over the next three years.
The connective tissue underneath most of this is the Model Context Protocol (MCP), now the default integration layer between AI models and the tools, data, and services they act on. Every MCP server, every LLM endpoint, and every agent that touches Protected Health Information (PHI) becomes a target the moment it is reachable from a network. That exposure is why so many healthcare AI pilots stall before they ever scale.
Why Healthcare AI Adoption Stalls: Trust, Not the Model
What keeps AI from reaching production in healthcare rarely turns out to be the model itself. It’s trust, which is inseparable from HIPAA. The Privacy Rule, the Security Rule, and the Breach Notification Rule were all written around the data itself, not the person or system reading it, which means they apply to an AI agent exactly as they apply to a human employee or a business associate. A single breach can trigger federal fines, erode patient trust, and damage the organization’s reputation.
The technical challenges cluster into three recurring problems:
- AI connectivity widens the attack surface. The raw MCP protocol doesn’t mandate role-based access control, audit logging, or encryption, leaving each deployment to build those controls itself. The OWASP Top 10 for Agentic Applications has since codified the broader risk categories, including tool misuse, identity and privilege abuse, and agent supply chain threats.
- Identity and access gaps appear everywhere agents connect. Agents routinely bypass the IAM protocols built for human users, and static roles almost always over-scope what an agent can reach, which violates HIPAA’s minimum-necessary standard.
- Data privacy risk intensifies the moment PHI enters an LLM window. Once there, it can leak to a model provider or across tenants on shared inference infrastructure without strict zero-retention terms and strong encryption.
The instinct is to shield these workloads with the tools already on hand: IP allowlists, firewall ACLs, and VPN clients on every endpoint. These inconsistent, brittle, and unwieldy solutions were operational headaches long before AI arrived. Firewalls in particular don’t know how to evaluate an AI agent’s identity or intent, a mismatch agentic AI will only worsen. An MCP server sitting behind a firewall is still reachable and therefore can still be attacked, whether or not it returns a 403 to an unauthorized request.
Zero Trust Gateways for AI Workloads: The NetFoundry Approach
The most effective solution is to take AI workloads off the network entirely following Zero Trust principles. NetFoundry delivers this through LLM and MCP gateways that front your AI workloads, making the LLM endpoint or MCP server unreachable from the network and admitting only sessions that have been identified, authenticated, and authorized onto a private overlay. Each gateway opens authorized sessions outbound, so the workload behind it never needs a listening port exposed to the internet or any corporate network.
Nothing listens for inbound connections, so there’s no open port to scan and no public API to attack. Think of it as a private identity-first enclave for your AI, defined by you, enforced with modern cryptography, and spun up as quickly as you spin up a container.
Our approach works alongside the OAuth work already underway in the MCP ecosystem rather than replacing it. OAuth operates at layer 7 (the application layer, where usernames, tokens, and permissions live). NetFoundry applies an independent layer of identity, authentication, and authorization at layer 3 (the network layer, before a connection even reaches the application).
An attacker now has to defeat two independent implementations, each grounded in strong identities and modern cryptography, without added operational complexity. Because NetFoundry authorizes every session and keeps the workload unreachable, it shields OAuth from the worst failure modes, including stolen identities, compromised credentials, and authorization bugs.
Although NetFoundry enforces access at layer 3, it doesn’t rely on layer 3 constructs like IP-based schemes. Instead, it gates layer 3 access through layer 7 identity in a software-only architecture that doesn’t depend on the underlying infrastructure. This results in a Zero Trust AI enclave that can be stood up in minutes, with end-to-end encryption and keys sovereign to your own endpoints. Customer-owned keys give a covered entity the clearest path to breach safe-harbor protection, because the organization can prove the keys stayed under its exclusive control throughout any incident.
Two Ways to Deploy NetFoundry for Healthcare AI
There are two primary deployment paths, and many organizations blend them.
The agentless path uses NetFoundry SDKs to embed overlay endpoints directly into the LLM gateway, the MCP client, or the MCP server, which then communicate across a private NetFoundry overlay. This suits greenfield deployments, and Golang applications are especially straightforward given how many MCP and agent frameworks are Go-based.
The agent-based path uses NetFoundry Zero Trust agents on clients and servers, deployed as agents, containers, virtual machines, or gateways at a site, in a DMZ, or on a cloud edge. Agents run across every major operating system, ship in every major cloud marketplace, and come prebuilt into many browsers and proxies. This path is ideal when you don’t control the application code or simply prefer to front-end a workload rather than modify it. You can also start on one side, making the MCP server unreachable first, then extend Zero Trust outward.
Zero Trust AI Use Case Examples in Healthcare
In each example below, the AI workload stays unreachable from the internet and any underlay network, every session is identity-authenticated and encrypted, and access can be granted just-in-time, one-time, or persistently, with granular telemetry on which identity reached which service.
Remote Patient Monitoring for Chronic Disease
A patient with congestive heart failure goes home with a connected scale, a blood pressure cuff, and a pulse oximeter, all reporting to a small gateway device in the home. The hospital needs that data daily to catch decline early and prevent readmission.
A NetFoundry gateway on the home device dials an overlay service and transmits encrypted PHI outbound only. The hospital’s Electronic Health Record (EHR) integration server binds to that service and accepts data exclusively from authenticated gateways. Neither the EHR server nor the home device listens for inbound connections, so neither can be discovered or used as an entry point into the hospital network, and the data flows in full support of HIPAA compliance.
Real-Time IoMT Aggregation for an ICU Dashboard
In the intensive care unit, every bed is ringed by ventilators, infusion pumps, and vital sign monitors from different manufacturers. Clinicians need one real-time dashboard instead of a dozen device screens.
An edge platform in the ICU normalizes the raw device feeds into a standard format, and a forwarding application relays those streams over a NetFoundry overlay to the hospital’s clinical dashboard and data lake. For the most sensitive units, the overlay runs on-premises and air-gapped, isolating the stream from the broader hospital network and the internet, preventing snooping or tampering, and still delivering a live, holistic view of each patient.
AI Diagnostic Copilot for Radiologists
A radiologist opening a complex CT scan needs the patient’s prior conditions, lab results, genetic markers, and previous images, fast. An agentic Radiology Copilot gathers all of it: querying the EHR, pulling priors from the Picture Archiving and Communication System, checking a genomic database, and feeding the assembled context into a specialized medical LLM to produce a concise summary of what to look for.
The radiologist’s workstation, the agent, and the LLM gateway all communicate over a NetFoundry overlay, so neither the request nor the PHI-laden summary is ever exposed to the internet. Every backend query the agent makes travels over discrete Zero Trust services. The agent automates the tedious data gathering while NetFoundry supplies the HIPAA-compliant fabric that makes the interaction safe.
AI Copilot for Medical Coding in a Hybrid Workforce
Clinical documentation improvement specialists and revenue cycle analysts, many working from home, use a generative assistant to review notes for coding accuracy. Their requests must reach a model inference engine inside a secure, EHR-integrated data center.
NetFoundry agents on the analysts’ desktops handle only the AI sessions by policy, leaving the rest of their work untouched. Every request travels outbound through NetFoundry to the centralized inference engine over mTLS with end-to-end encryption, and fine-grained access ensures that only active sessions with valid credentials are ever admitted, reducing PHI exposure. This is the minimum-necessary, task-scoped access HIPAA’s Privacy Rule requires.
Secure Patient Engagement from an EHR Portal
A generative chatbot answers patient questions about medications, lab results, and discharge summaries through the patient portal. The portal backend acts as the client and calls an LLM engine hosted in a separate, non-EHR-connected cloud, such as a private subnet.
A NetFoundry gateway ensures that only the authenticated portal backend can reach the LLM engine. No inbound ports are open in the cloud LLM environment, and every session ties back to a patient session token and hospital policy, so a public-facing model endpoint never exists to be attacked.
AI-Supported Decisionmaking in the Operating Room
Operating room vendors increasingly ship AI decision-support tools, from fluid monitoring to anesthesia dosing, that need real-time recommendations from centralized hospital systems. NetFoundry gateways protect both the OR tool and the backend inference server, whether that server sits in a vendor cloud or on a hospital-owned high-performance cluster, removing any need for VPNs or exposed firewall ports in the OR subnet.
Zero TrustMakes Healthcare AI HIPAA-Ready
AI in healthcare doesn’t fail because the models aren’t good enough. It stalls because the workloads that touch PHI are exposed, over-permissioned, and hard to govern, and because the legacy tools meant to protect them can’t keep up with the speed and scale of agentic AI.
NetFoundry’s LLM and MCP gateways take a different path: make the workload unreachable, authorize every session on strong identity and modern cryptography, and layer that beneath OAuth for real defense in depth. It’s the same approach we’ve spent years applying to Zero Trust connectivity for machine-to-machine traffic, APIs, and OT environments; AI workloads are simply the newest and most urgent place it applies. The result is AI that clinicians and compliance teams can both trust, deployed in minutes rather than quarters.
To see how a Zero Trust enclave would fit your healthcare AI workloads, talk to us.
FAQ
Zero Trust security means no device, user, or AI agent is trusted by default, even inside the network perimeter — every session must be authenticated and authorized before it’s granted access. NetFoundry applies this to healthcare AI by making LLM endpoints and MCP servers unreachable from the network entirely, admitting only sessions that have already been identified and authorized onto a private overlay. This keeps PHI-handling workloads protected even if a firewall or VPN would have let a bad request through.
Identity-first connectivity means access decisions are based on who or what is asking, not on network location like an IP address or which subnet a device sits on. Instead of assuming anything inside the corporate network is trusted, every connection request is evaluated against the identity making it. NetFoundry uses this model, branded Identity-First Reachability™, to authorize every AI agent, MCP server, and human session individually before any data can flow.
No single vendor product can be “HIPAA compliant” on its own — HIPAA compliance is a property of how a covered entity or business associate as a whole handles PHI, including policies, training, and risk assessments. NetFoundry supports HIPAA compliance for healthcare AI workloads by keeping PHI-handling systems unreachable from the network, encrypting all traffic end-to-end, and giving the customer sole control over encryption keys, which aligns with HIPAA’s technical safeguards for ePHI.
An MCP server becomes invisible when it stops listening for inbound connections altogether, so there’s no open port for an attacker to find or scan. NetFoundry achieves this by having the MCP server dial out to a private overlay network instead of accepting incoming traffic; only sessions already authenticated and authorized on that overlay ever reach it, so an unauthorized request has nothing to connect to in the first place.
OAuth secures MCP at the application layer, verifying that a user or agent has the right permissions once a connection is already established. NetFoundry secures MCP one layer below that, at the network layer, by deciding whether a connection is allowed to reach the server at all. Used together, an attacker has to defeat both an application-layer authorization system and a network-layer identity system, which is a stronger posture than either one alone.
