What AI Agents Can and Can't Do for a Small Medical Practice
AI agents took over HIMSS 2026. Here is where they fit in a small practice (intake, scheduling, prior auth, notes), what still needs human review, and why BAAs matter.
At HIMSS 2026 in Las Vegas, the big health IT vendors lined up behind AI agents. STAT reported that Epic showed three agents: Art, which drafts clinical notes and other documentation; Penny, which helps with billing and avoiding coverage denials; and Emmie, which answers patient questions and helps schedule appointments. Oracle rolled out an agent that helps physicians in 30 specialties draft notes and suggest next steps. Amazon, Google and Microsoft added agent features to their health offerings too.
STAT's coverage carried a warning in its headline: agents are spreading quickly, but validation is lacking. That tension is the right frame for a small practice. The useful question isn't whether agents are coming. It's which tasks you can safely hand to one, and which still need a person to check the work.
What "AI agent" means here
A chatbot answers questions. An agent takes steps. It might read a referral fax, pull the patient's insurance details, check the calendar, book a slot and send a confirmation text, all as one task.
Most of what was shown at HIMSS was administrative. Google Cloud described Gemini-powered agents that summarize charts and draft documentation. Microsoft's Dragon Copilot update, announced ahead of the show, added partner-built agents for revenue cycle, prior authorization and clinical decision support through its marketplace. None of this is about running the clinic unsupervised. It's about clearing paperwork.
A small practice won't buy the same enterprise stack, but the same patterns show up in EHR add-ons, ambient scribe tools and front-office automation platforms.
Four admin workflows where agents fit
1. Patient intake
Agents can collect demographics, insurance details and the reason for the visit before the patient arrives, by text, web form or phone. They can chase incomplete forms and flag missing insurance cards.
The risk is bad data flowing straight into the chart. Staff should still verify identity and insurance at check-in, and anything the patient writes about symptoms should be read by a clinician, not summarized away.
2. Scheduling and reminders
This is the most mature use. Agents can book, reschedule and cancel against the real calendar, send reminders, and fill cancellations from a waitlist. They work after hours, which is when many patients try to book.
Keep humans on the rules that need judgment: which visit types need a longer slot, who can be double-booked, and when a request sounds urgent enough that it shouldn't wait for the next open appointment.
3. Prior authorization
Prior auth is where the paperwork pain is worst. In a survey released in May 2026, the AMA reported that physicians complete an average of 40 prior authorizations a week, consuming about 13 hours of physician and staff time, and that 40 percent employ staff dedicated only to prior auth.
Agents can help gather the clinical documentation a payer asks for, fill in forms, track status and draft appeal letters. Regulation is also pushing this toward electronic workflows. Under CMS's Interoperability and Prior Authorization Final Rule (CMS-0057-F), impacted payers, including Medicare Advantage plans and Medicaid and CHIP programs, must send prior auth decisions on medical items and services (not drugs) within 72 hours for expedited requests and seven calendar days for standard requests starting in 2026. They must also stand up a Prior Authorization API with most compliance dates in January 2027.
What shouldn't be automated: the clinical justification itself. A clinician should review what is being submitted under their name.
4. Clinical documentation
Ambient scribes listen to the visit and draft the note. This is the category Epic's Art and Oracle's agent target, and it's where many practices start.
Two things to settle first. The draft is a draft: the clinician reviews, corrects and signs, and owns what's in the chart. And recording a visit is recording a conversation, so state consent laws apply. Several states require consent from everyone in the conversation, so many practices ask patients at the start of the visit and document the answer.
What needs human review
| Task | What an agent can do | What a person should still do |
|---|---|---|
| Intake | Collect forms, chase missing items | Verify identity and insurance, read symptom notes |
| Scheduling | Book, remind, fill cancellations | Set booking rules, handle urgent requests |
| Prior auth | Gather records, fill forms, track status | Approve the clinical justification |
| Documentation | Draft the visit note | Review, correct and sign the note |
| Patient messages | Sort, answer logistics questions | Answer anything clinical |
A simple rule many practices use: the agent can prepare anything, but a person approves anything that goes into the chart, goes to a payer, or answers a clinical question.
Validating before you trust it
STAT's point about validation applies at small scale too. Vendors report impressive numbers, but they are vendor numbers. Before going live with an agent:
- Run it on a limited set of tasks for a few weeks, with staff checking every output.
- Track the errors: wrong appointment types, missing documents, notes that say something the patient didn't.
- Decide in advance what error rate you would accept, and for which tasks.
- Keep checking a sample after launch. Models and vendor settings change over time.
- Ask the vendor what happens when the agent is unsure. A good tool hands off instead of guessing.
Business associate agreements
For a HIPAA covered entity, any vendor whose agent creates, receives, stores or transmits patient information on the practice's behalf is generally a business associate, and a business associate agreement (BAA) needs to be signed before PHI goes in. HHS has said this applies to cloud services even when they store only encrypted data and can't view it.
Agents tend to chain several services together: a model provider, a transcription service, a texting platform, the EHR integration. Ask the vendor:
- Will you sign a BAA, and on which plan or tier?
- Which subcontractors process our data, and do they have BAAs with you?
- Is our data used to train models, and can that be turned off?
- Where are transcripts, recordings and logs stored, and for how long?
- Can we export or delete our data if we leave?
If a vendor won't sign a BAA, keep patient information out of that tool entirely.
A sensible starting order
- Scheduling and reminders, because the data is low risk and the gains are easy to see.
- Intake forms and insurance collection.
- Ambient documentation, with a clinician signing every note.
- Prior auth support, once you trust the tool's handling of records.
Where NutriCove fits
NutriCove sets up automation for medical offices on the front-office side: an AI receptionist, missed-call text back, follow-up, online booking and review requests. Our medical page notes that GoHighLevel, the platform these run on, needs its HIPAA add-on and a signed BAA before any patient information goes in. We don't build clinical documentation or prior auth tools. If scheduling and patient communication are your starting point, see how we set it up for medical offices.
Sources
- HIMSS 2026: Health AI agents are here, but what about the validation?, STAT
- Unify. Simplify. Scale. Microsoft Dragon Copilot meets the moment at HIMSS 2026, Microsoft
- Helping healthcare move from data to agentic action, Google Cloud
- AMA survey: Prior authorization reform pledge falls short with physicians, American Medical Association
- CMS Interoperability and Prior Authorization Final Rule fact sheet, CMS
- Improving Prior Authorization Processes FAQ, CMS
- If a CSP stores only encrypted ePHI and does not have a decryption key, is it a HIPAA business associate?, HHS
- Business Associates FAQ, HHS
- Introduction to the Reporter's Recording Guide, Reporters Committee for Freedom of the Press
This article is general information, not legal or medical advice. Talk to a qualified attorney or licensed professional about your situation.