AI agents in healthcare: administration with evidence
In healthcare, AI agents first take over administration: appointments, invoices, requests. This almost always involves particularly sensitive data, and practices and insurers must know on whose behalf an agent acts.
Leutrim Miftaraj, Founder, Innopulse Consulting GmbH
Published
Key points
- Agents book appointments, submit invoices and send requests to practices and insurers on patients' behalf.
- Health data are particularly sensitive; agents receive only what an action needs.
- Medical decisions stay with professionals; agents handle administrative actions with evidence.
Starting point
Patients have personal assistants arrange appointments, forward invoices to the health insurer or send a request to the practice. Practices and insurers deploy their own agents for scheduling, first responses to inquiries and checking submitted documents. On both sides, the actions involve health data that the law particularly protects.
Typical scenarios
- Appointment booking: a patient's agent books and reschedules appointments, as described in the use case AI agent books appointments.
- Submitting invoices: the agent forwards medical invoices to the health insurer and tracks reimbursement.
- Requests to the practice: the agent passes on, for example, a request for a repeat prescription or for documents; the professional decides.
- Insurers' agents: they check submitted documents and handle simple reimbursements up to a limit themselves.
What must be verified
Practices and insurers verify whether a mandate from the patient exists that allows exactly this kind of action and whether the agent is bound to it. With selective disclosure, the agent presents only the necessary details. For their own agents: every reimbursement or cost approval lies within the internal authority rules and is recorded with decision and receipt.
Legal framework
In Switzerland, health data are particularly sensitive personal data under the Data Protection Act, and in the EU special categories under Article 9 GDPR. Professionals are subject to professional secrecy. It follows that agents receive only what an action needs, processing needs a legal basis and disclosures to third parties, such as the agent's operator, must be governed. Medical decisions are not within an agent's scope.
First steps in 30 days
- Week 1: define the administrative actions patients' agents may carry out, such as bookings and invoice submissions.
- Week 2: define the evidence for each of these actions and review data minimization.
- Week 3: equip your own agents with limits for reimbursements and introduce decisions.
- Week 4: keep receipts, verify samples with KYA and document data protection.
Typical mistakes
- Agents receive the complete medical history, although name and insurance are enough for an appointment booking.
- Reimbursements are booked without a decision and cannot be justified later.
- Requests to the practice are answered by the agent instead of being passed on to the professional.
Frequently asked questions
May AI agents be used in healthcare?
For administrative actions such as appointments or invoices, yes, in compliance with data protection and professional secrecy. Medical decisions stay with professionals.
How does a practice know an agent acts on the patient's behalf?
From a mandate from the patient that is bound to the agent and allows the specific action, such as appointment bookings.
Which data may an agent receive?
Only what the respective action needs. Selective disclosure allows a mandate to be presented without revealing all details.
May insurers' agents approve reimbursements?
Within the internal authority rules. Every approval should be checked against a mandate, signed with a decision and recorded.
Does KYA store health data?
No. KYA verifies locally in the browser or in one's own system and transmits no data.
May the agent's operator see health data?
Only as far as this is legally governed, for example as a processor under contract. It is better if the agent receives only the necessary details.
What applies to electronic health records?
Access follows the rules of the record and the rights the patient grants. An agent does not automatically receive access.
Can agents obtain cost approvals?
They can pass requests on to the insurer. The insurer decides on the cost approval according to its rules.
General information, not legal advice. The statutes and the circumstances of each case are decisive.
Sources
- Datenschutzgesetz (DSG, Schweiz): https://www.fedlex.admin.ch/eli/cc/2022/491/de
- Verordnung (EU) 2016/679 (DSGVO): https://eur-lex.europa.eu/eli/reg/2016/679/oj