What can an AI agent safely do in a medical practice?

The constraint that shapes everything here is not technical capability. Where a practice uses an outside service that creates, receives, maintains or transmits protected health information on its behalf, that service is a business associate and the practice must have an executed agreement with it. This applies to storage and processing services generally, and the requirement is not waived by encryption — a provider that cannot read the information is still handling it. So the first question about any tool is whether the vendor will sign, and the second is whether the configuration keeps information inside what was signed for.

That question decides more than it appears to. A general assistant product used by a member of staff to draft a letter about a named patient has moved that information to a vendor, and whether an agreement covers it is a question with an answer. Practices that establish this once, and state which tools are permitted for what, avoid the common situation where the policy exists and the actual disclosure happened through a browser tab.

Inside that boundary, the administrative work is substantial and unglamorous. Scheduling and rescheduling. Reminders, subject to the separate rules that govern automated contact. Capturing what a new patient supplied so it lands in fields rather than a message. Chasing outstanding insurance items. Drafting the letter, the summary or the referral for a clinician to read and approve. None of these requires clinical judgement and all of them consume front-desk time.

The line that must not be crossed casually is between administrative and clinical. A system that summarises a record for a clinician is assisting; one that answers a patient's question about their symptoms, medication or whether to come in is doing something else, whatever the interface calls it. The practical rule is that anything a patient could act on medically requires a clinician, and a triage-shaped question routed to a person is the correct outcome rather than a failure of the automation.

Patient-facing communication needs its own decision because the register matters more here than elsewhere. A message that is fluent, confident and slightly wrong about an appointment is an irritation; the same qualities in a message about a result or a change to treatment are not. Practices that automate the confirmations and reminders and keep everything else behind a person get most of the saving and none of that exposure.

Finally, the record. Anything a system writes into a patient record becomes part of a document with legal and clinical weight, read later by people who were not present. A drafted note approved by the clinician who saw the patient is one thing; an automatically filed summary is another, and the difference is who is answering for what it says.