Short answer
Start where the work is administrative, repeatable and reviewable: recall lists, insurance verification prep, documentation drafts, follow-up messages queued for a human to send. Clinical judgement stays with clinicians. Anything touching patient information needs a business associate agreement with the vendor before a single record moves.
Key takeaways
- The ready work is administrative and reviewable. That is not a limitation, it is where most of the wasted hours are.
- Under HIPAA, a vendor handling protected health information on your behalf is a business associate and needs a written agreement first.
- Draft and queue, do not send. A patient message that goes out unreviewed is the wrong place to start.
- Clinical decisions, triage and diagnosis stay with clinicians, whatever a demo suggests.
Practice owners usually ask this question hoping for the clinical answer and are disappointed by the administrative one. They should not be. The hours bleeding out of a practice are almost never clinical. They are the recall list nobody worked, the verifications done twice, the notes finished at nine at night.
What is ready now
Work that repeats, follows rules you can write down, and produces something a person can check before it matters. That covers most of the front and back office. The agent prepares, a named person approves, and the practice gets the hours back without anything reaching a patient unreviewed.
| Task | Ready? | What stays with a person |
|---|---|---|
| Building and prioritising recall lists | Yes | Approving who gets contacted and how |
| Drafting follow-up and reactivation messages | Yes, drafted and queued | Reading and sending |
| Insurance verification preparation | Yes | The call, the exceptions, the final answer |
| Clinical documentation drafts from a visit | Yes, with review | Every clinical word, signed by the clinician |
| Claim and billing exception flagging | Yes | Submission, appeals, and anything a payer reads |
| Review requests after a visit | Yes, same ask every time | The FTC rules on how they are requested |
| Answering clinical questions from patients | No | All of it. This is care, not correspondence |
| Triage or anything resembling diagnosis | No | All of it, regardless of what a demo shows |
The question to settle before any of it
Whether patient information will pass through the vendor, and what is contractually in place if it will. Under HIPAA, a vendor that creates, receives, maintains or transmits protected health information on your behalf is a business associate, and the arrangement requires a written agreement with specific provisions.
This is not a formality to handle later. It decides which tools are even eligible, and a general consumer assistant with no such agreement is not eligible, whatever it can do. Ask the vendor directly, get it in writing, and involve whoever handles your compliance before the pilot rather than after.
Start with something boring
The recall list is the usual first win: it happens constantly, two people would build it the same way, a mistake is caught before anybody is contacted, and the result is measurable within a month. It also teaches the team what reviewing agent output feels like, on work where the stakes are low.
- Pick one administrative workflow that happens at least weekly and never reaches a patient without review.
- Settle the data question first: what the agent can see, where it is processed, and what agreement covers it.
- Have the person who does the task today write down how, including the exceptions.
- Run it with a named owner approving every output for four weeks, and count hours, cycle time and corrections.
- Then decide, with the numbers in front of you, whether to widen it or move on.
What we would not do yet
Anything that answers a clinical question for a patient, anything that decides urgency, and anything that sends to a patient without a person reading it first. Not because the drafting is poor, but because the failure mode is a fluent, confident, wrong message with your practice name on it, and in healthcare that is not a support ticket.
Questions people ask
Can an AI agent talk to patients directly?
For administrative matters, with a person reading before anything sends. For clinical questions, no. The failure mode is a confident, fluent, wrong answer carrying your practice name, which in healthcare is a patient safety matter rather than a support issue.
What do I need in place before an agent touches patient data?
A written business associate agreement with the vendor, because under HIPAA a vendor handling protected health information on your behalf is a business associate. Settle it before a pilot, and involve whoever owns compliance rather than informing them afterwards.
Can agents write clinical notes?
They can draft from a visit, and the clinician reviews and signs every word. Treat the draft as a starting point that saves typing, never as a record. The signature carries the responsibility regardless of what produced the first version.
What is the best first agent for a practice?
Usually the recall or reactivation list. It runs constantly, two people would build it the same way, nothing reaches a patient without approval, and you can measure hours and corrections within a month.
Will this work with our practice management system?
It depends entirely on what that system exposes and what your agreement with them allows. Ask that question before choosing the workflow, because an agent that cannot read the system has to be fed by hand, which removes most of the benefit.
Sources
- US Department of Health and Human Services, business associate contract provisions (45 CFR 164.504(e)): That a vendor handling protected health information on behalf of a covered entity is a business associate and requires a written agreement with specified provisions.
- Federal Trade Commission, final rule on consumer reviews and testimonials (effective 21 October 2024): The constraints on how review requests may be made, including the ban on incentives conditioned on sentiment.
Published . Last reviewed .
Want this in your business?
Book a call and we will scope exactly which part of your operation an agent should take first.
Book a call with the team