HIPAA-ready Enterprise: enabling HIPAA blocks all custom remote-MCP connectors with no admin UI to unblock

### What happened?

After our Primary Owner enabled **HIPAA Compliance** under
`Organization settings > Data and privacy` on the morning of
**2026-05-21**, every connector in our org switched to "Blocked by your
admin" for end users.

- **Official Anthropic-provided connectors** (e.g. Microsoft 365,
Atlassian, Figma): the admin can re-enable their tool calls from
`claude.ai/admin-settings/connectors` as documented.
- **Custom remote-MCP connectors** (added by an Owner via "+ Add" at
`admin-settings/connectors` with a remote MCP URL): show all
Interactive tools and Read-only tools as "Blocked by your admin" in
the end-user view, but the **admin view exposes no toggle, dropdown,
or any other control to unblock them**. The same admin page surfaces
these controls for official connectors side-by-side.

We tried:
- Re-registering the custom connector from scratch (delete + Add
again) — block persists.
- Reauthorizing the connector — OAuth succeeds, block persists.
- Looking at the admin connector detail page for the custom entry —
no per-tool, per-group, or per-connector enable control is rendered.

Per
[HIPAA-ready Enterprise plans](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans):

> "Enabling HIPAA resets certain settings across your organization.
> Some configurations return to defaults as part of the transition to
> a HIPAA-ready state."

> "This is a one-way decision. Once HIPAA is enabled and the BAA is
> accepted, the change can't be reversed from admin settings."

So we accept that defaults were reset. The bug/UX gap is that for
**custom** connectors specifically, the admin UI does not offer the
same re-enable path it offers for official connectors, and there is no
in-product messaging explaining whether this is policy-by-design or a
missing control.

The
[Implementation Guide for HIPAA Entities](https://trust.anthropic.com/resources?s=rgirr4qe8u7ek8c2igx3&name=claude-for-enterprise-hipaa-ready-offering-implementation-guide)
is the documented source of truth on what's restricted under HIPAA-ready
mode, but it is access-gated and our access request has not yet been
approved, so we cannot confirm whether this behavior is intentional or
not.

### What did you expect to happen?

One of:

1. **If custom connectors are policy-blocked under HIPAA-ready mode
(intentional):** the admin connector detail page for a custom
connector should explicitly say so — e.g. "Custom connectors are
not available under HIPAA-ready Enterprise. Contact your Anthropic
account team." — instead of just hiding controls. The HIPAA
enablement modal should also list "custom remote-MCP connectors
will become unavailable" alongside the other reset-to-defaults
warnings. The Implementation Guide should be reachable from the
admin UI without a separate access request, at minimum the section
that enumerates restricted features.

2. **If custom connectors are admin-toggleable under HIPAA-ready mode
(unintentional):** the same per-tool / per-group enable controls
that render for official connectors should also render for custom
connectors, so admins can re-enable them after the HIPAA reset.

3. **In either case:** re-registering a custom connector should either
work (option 2) or be blocked at the "+ Add" step with the policy
reason (option 1). Today the "+ Add" flow appears to succeed (OAuth
completes, the connector appears in the admin catalog) but the
resulting connector is unusable, which is misleading.

### Steps to reproduce

1. Enterprise org with at least one previously-working custom remote-MCP
connector (added by an Owner via `admin-settings/connectors > + Add`
with a remote MCP URL, OAuth-backed).
2. Primary Owner navigates to
`Organization settings > Data and privacy > HIPAA Compliance` and
completes the enablement flow (accept BAA, accept Implementation
Guide, click "Accept and enable HIPAA").
3. End users see the custom connector with all tools marked
"Blocked by your admin" (sample screenshot below).
4. Primary Owner navigates to `admin-settings/connectors`, opens the
custom connector's detail page → **no toggle or dropdown to
re-enable any tool group or any individual tool is rendered**.
5. Compare with an official connector (e.g. Microsoft 365) on the same
admin page in the same browser session → the per-tool-group enable
dropdowns are present.
6. Delete and re-add the custom connector from `+ Add` → "Add" completes,
OAuth succeeds, connector is created → but the same all-tools-blocked
state with no admin control persists.

### Area

MCP Connector (adding/managing servers)

### MCP Server (if applicable)

Self-hosted remote MCP server (Jira Data Center integration; OAuth 2.0
authorization-code + PKCE; Streamable HTTP transport; MCP SDK 1.29). The
specific server URL is internal; happy to share privately with support
if needed for trace correlation.

### Error messages or logs

No surfaced error — the failure mode is silent (controls absent on
admin UI, end users see "Blocked by your admin"). No `ofid_...` flow id
is available because there is no failing flow; the connector simply
exists with no admin path to enable it.

### Additional context

- End-user view (from the affected connector's permission sheet) shows
the connector URL, "Interactive tools (2) — Blocked", and
"Read-only tools (13) — Blocked", with every individual tool listed
as "🔒 Blocked by your admin" and no per-tool control available. The
identical layout on official connectors does expose the admin toggle.
- HIPAA enablement on 2026-05-21 is the proximate trigger; the same
custom connectors worked normally the previous day.
- The HIPAA enablement modal warned about "settings reset to defaults"
but did not specifically call out custom connectors as becoming
permanently unmanageable.
- Asks for the triage thread:
1. Is this intentional policy under HIPAA-ready Enterprise?
2. If yes, can the admin UI / HIPAA enablement modal be updated to
state this explicitly?
3. If no, can the missing per-tool controls be restored for custom
connectors?
4. What is the supported path to restore a working custom connector
for an org that has enabled HIPAA? ("contact account team" is the
current answer per the help center, but a documented self-serve
path or per-connector exemption flow would be valuable.)