AI Agents in Healthcare: Intake, Booking and HIPAA Rules

In healthcare, AI agents do their most dependable work at the front desk: answering calls and messages, booking and moving appointments, sending reminders and collecting intake details before a visit. Clinical judgement stays with clinicians. Under HIPAA, the company that runs such an agent for a clinic is normally a business associate, so it signs a contract that limits what it may do with patient data.

Doctors are already using AI, mostly for paperwork. An American Medical Association survey of nearly 1,200 physicians found that 66% used some form of health AI in 2024, up from 38% in 2023. The same survey found 57% saw reducing administrative burden through automation as the biggest opportunity, while only 10% used a patient facing chatbot for customer service.

That gap is the subject of this post. The phone that rings out at lunchtime, the reminder that never went, the intake form a patient fills in twice: patients notice those, and they are also the jobs where the rules for an AI agent are clearest. If you want the cost side first, we compared an AI voice agent against a human receptionist in a separate post.

An agent that books appointments works from the same calendar your staff use. It reads the open slots, offers the patient two or three, writes the booking into the practice management system and sends a confirmation. The decisions it makes are the ones you write down for it: which appointment types it may book on its own, how far ahead, which ones need a deposit, and which always go to a person, such as a first consultation about new symptoms.

Reminders are where privacy is easiest to get wrong, because they leave your system and land on a phone that someone else may read. HIPAA's minimum necessary standard asks covered entities and business associates to make reasonable efforts to limit protected health information to what a purpose needs (45 CFR 164.502(b)). For a reminder that usually means the date, the time, the location and a way to reschedule, and nothing about the reason for the visit.

Clinics with patients who write in several languages, or who message late at night, get the most out of this step. The same agent can answer on WhatsApp at 11pm in Arabic or Hindi and book into tomorrow's calendar, which is the pattern we described in multilingual WhatsApp agents and after hours bookings.

Intake is the second job that fits an agent well, as long as the agent collects and a person interprets. Take a dental clinic as an example. Before a first visit the agent asks for the patient's date of birth, insurer and member number, a photo of the insurance card and the reason for the visit in the patient's own words. It checks that every required field is filled and that the card photo is readable, attaches everything to the booking, and tells reception what is still missing.

The line it must not cross is turning those words into advice. An agent that reads "chest pain since this morning" should not file it under a routine slot or tell the patient it is probably nothing. It should stop, give the emergency instruction your clinic has written, and pass the conversation to a person with the full text attached. We wrote down how to set those rules in when an AI agent should hand off to a human; in a clinic, every symptom question belongs on that list.

HIPAA's definition is broad on purpose. A business associate is a person who, on behalf of a covered entity, "creates, receives, maintains, or transmits protected health information", and the definition explicitly includes a subcontractor that does the same for the business associate (45 CFR 160.103). An agent that books appointments and takes intake details handles protected health information, so the company that runs it is a business associate, and the model provider, telephony provider or host behind it can be a subcontractor in the same chain.

The contract between the clinic and that vendor has required contents, set out in 45 CFR 164.504(e)(2). It must say what the vendor may use the data for, and commit the vendor to use appropriate safeguards, to report any use or disclosure the contract does not allow (breaches included), to make its subcontractors accept the same restrictions, and to return or destroy the information when the contract ends, if feasible.

The Security Rule then turns "appropriate safeguards" into specific controls. Its technical safeguards ask for a unique identity for each user, audit controls that record and examine activity in systems holding electronic patient data, and protection for data in transit, with encryption as an addressable specification (45 CFR 164.312). For an agent that means its own service account separate from staff logins, a stored record of every conversation and action, and encrypted connections between the chat channel, the agent and your calendar.

Outside the United States the names change but the idea holds. In the EU and UK, data concerning health is a special category under Article 9 of the GDPR, and processing it is prohibited unless one of the listed conditions applies, so a clinic there needs the same written scope, contract and access control before an agent touches patient records.

United States law draws a clear line here. Since the 21st Century Cures Act, the definition of a medical device excludes software intended "for administrative support of a health care facility", and the list of examples names appointment schedules, billing information and admissions, as the FDA's own guidance on section 3060 of the Cures Act quotes. A booking and intake agent sits on the administrative side of that line.

The other side has its own register. The FDA keeps a list of AI enabled medical devices that are authorized for marketing in the United States, each of which has met the agency's premarket requirements. The page says the list is not comprehensive, but it is a useful test for a clinic owner: if the agent you are buying starts doing something that sounds like it would need to be on that list, such as rating how urgent a symptom is, it has drifted out of front desk work and the vendor should be able to tell you which authorization covers it.

Everything above comes down to a short list you can hold a vendor to. None of it needs a lawyer to read, although your privacy officer should sign off on the first two.

1. A signed business associate agreement with the vendor, plus the names of its subcontractors: the language model, the phone or messaging provider and the host.
2. A written scope that lists the appointment types the agent may book, the questions it may answer and the topics that always go to staff.
3. Reminder and confirmation templates checked for minimum necessary content, with no reason for the visit in them.
4. A log of every conversation and action that your team can search, with access limited per user.
5. A handoff path tested out of hours, including the emergency wording and the number a patient is given.
6. A pilot on one channel, with your staff reading the transcripts for the first weeks before you add the next one.

GenovaFlow builds front desk agents as voice agents for the phone line and chat agents for WhatsApp and the web, and the checklist above is where a scoping call with us starts. If you work in another regulated field, the same questions come up in AI agents in financial services, and the rest of the series is in the AI agents for business category.