AI Agents in Healthcare: Use Cases, HIPAA and Risks

AI agents in healthcare are software assistants that do multi-step administrative work for clinics and practices: answering patient calls and texts, booking appointments, collecting intake and insurance details, preparing prior authorization requests and drafting documentation for clinicians to review. The best results today come from keeping agents on these front and back office jobs, with a signed HIPAA business associate agreement for every vendor and a human taking over anything clinical.

This guide covers the use cases that work, what HIPAA requires in practice, the risks to plan for, and how a small practice can start. It is general information, not legal advice; check your setup with your compliance officer or counsel.

AI agents vs chatbots in healthcare

Conversational AI for healthcare is the broad category: software that talks with patients or staff in plain language by chat, text or voice. A basic chatbot answers questions (“are you open Saturday?”). An AI agent goes further: it can look up the patient, check the schedule, book the slot, send the intake form and log everything in your systems. If you want the general background, see what AI agents are.

That ability to act is what makes agents valuable and also what makes the setup matter. An agent that can write to your scheduling system or EHR needs the same care with access and audit trails as a new staff member.

AI agents in healthcare: use cases that work today

Scheduling and rescheduling

The most common starting point. The agent answers calls and messages 24/7, verifies the patient, finds an open slot that matches the visit type and provider, books it and sends a confirmation. It can also fill cancellations from a waitlist and handle reschedules without anyone at the front desk. For phone coverage specifically, compare options in our guides to medical answering services and dental answering services.

Patient intake and reminders

• Sends intake forms before the visit and follows up on incomplete ones.
• Collects insurance card photos and demographics, and flags missing information.
• Sends reminders with easy confirm, cancel or reschedule replies.
• Answers practical questions: directions, parking, what to bring, fasting instructions you have approved.

Insurance verification and prior authorization

Prior authorization is a large, repetitive workload. In the AMA’s 2025 survey of 1,000 physicians, practices reported about 40 prior authorizations per physician per week, taking roughly 13 hours of physician and staff time (AMA, May 2026).

Agents can help by pulling the relevant notes and codes, filling payer forms or portals, tracking status and drafting appeal letters for staff to review and submit. Regulation is moving in the same direction: under the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), Medicare Advantage plans and Medicaid and CHIP programs have had to decide urgent requests within 72 hours and standard requests within 7 calendar days since January 1, 2026. Those payers, plus marketplace plans on the federal exchanges, must offer a Prior Authorization API starting January 1, 2027. Standard APIs make it much easier for software to submit and track requests.

Clinical documentation

“Ambient” documentation tools listen to the visit (with patient consent) and draft the note for the clinician to edit and sign. Agents can also draft referral letters, visit summaries and patient instructions. The clinician stays responsible for the record, so review is not optional.

Billing and revenue cycle

Answering balance questions, sending payment links, explaining statements in plain language, checking claim status and preparing denial appeals. Much of this overlaps with classic automation; our RPA in healthcare guide explains where fixed bots are still the better tool.

Staff help desk

An internal agent that answers staff questions from your policies, procedures and payer rules, so new front desk staff aren’t interrupting the office manager every ten minutes.

A safe workflow for a clinic AI agent

Administrative tasks are automated; anything clinical goes to a person.

The rules we would put in every patient-facing healthcare agent:

1. Emergency first. Any mention of chest pain, trouble breathing, suicidal thoughts or similar triggers emergency instructions (call 911 or 988) and an alert to staff. The agent does not try to assess.
2. Verify before disclosing. Confirm identity (for example name plus date of birth) before discussing appointments or any health information.
3. No diagnosis or treatment advice. Clinical questions are logged and routed to a nurse or provider.
4. Minimum necessary. The agent only reads the data it needs for the task.
5. Warm handoff. Patients can always reach a person, and the person gets a summary.
6. Full logs. Every conversation and action is recorded and reviewable.

HIPAA and AI agents: what you need

HIPAA applies to AI the same way it applies to any other technology vendor. The key points:

A business associate agreement with every vendor that touches PHI

HHS guidance on cloud services says a provider that creates, receives, maintains or transmits electronic protected health information (ePHI) for you is a business associate and needs a BAA, even if it only stores encrypted data (HHS cloud computing guidance). For an AI agent, that chain often includes the agent platform, the AI model provider, the telephony or messaging provider and any automation tool in between.

Both major model providers offer BAAs, with conditions:

• Anthropic offers a BAA covering HIPAA-ready services such as its first-party API (with some features excluded) and Claude Enterprise plans configured for HIPAA (Anthropic BAA information).
• OpenAI offers BAAs for API endpoints eligible for zero data retention and for certain enterprise and healthcare ChatGPT offerings (OpenAI BAA guide).

Consumer accounts (free or individual ChatGPT, Claude or Gemini plans) are not covered. Staff should never paste patient information into them.

Security and access controls

• Separate accounts for the agent with role-based access.
• Encryption in transit and at rest.
• Audit logs of what the agent read and changed.
• Data retention rules: how long transcripts and recordings are kept, and where.
• A risk analysis update that includes the new AI workflow.

Clinical decision support is a different category

If a tool starts recommending diagnoses or treatments, you move into clinical decision support, where FDA rules may apply (FDA clinical decision support guidance) along with nondiscrimination requirements for patient care tools. Keeping your agent administrative avoids most of this. Our guide to AI governance and responsible AI covers policies for any AI use in your organisation.

Doctor AI chatbots: what patients use and where the line is

Patients increasingly ask general AI chatbots about symptoms before or after visits. These tools can explain terms and help people prepare questions, but they are not approved to diagnose and can be confidently wrong.

For your practice, the line is simple: your agent can tell patients about your services, hours, preparation instructions and how to reach care, and it can collect their reason for visit. It should not interpret symptoms, suggest diagnoses or change medication advice. If a patient says “my chatbot told me I have X”, the agent books them in or routes them to a nurse.

Risks to plan for

How to get started in a small practice

1. Pick one administrative job with clear volume: after-hours calls, rescheduling or reminder confirmations.
2. Map the data flow and list every vendor that will touch PHI. Get BAAs before any real data goes in.
3. Write the rules with your front desk team: scripts, approved answers, escalation triggers.
4. Test with fake patients and role-played edge cases, including emergencies and angry callers.
5. Pilot for a few weeks on a slice of traffic, review every transcript, then expand.

You can buy healthcare-specific tools or build on general platforms; our best AI agents comparison and how to build an AI agent guide cover both routes, and AI agent development services explains what a custom build costs. If you’d like help scoping a HIPAA-conscious agent for your clinic, opsmigo can map the workflow and vendors with you before anything goes live.