AI Agents for a Dermatology Practice: Referrals and Recall Lists

An AI agent in a dermatology practice can reliably own the administrative side of referral tracking and recall lists: matching incoming referrals to patient records, watching for open loops, flagging overdue follow-ups and preparing outreach for staff to approve. It should not interpret lesions, decide how urgent a symptom is, or change a clinical interval on its own judgment. Drawing that line before any setup begins is the most important design decision a practice can make.

Key takeaways

• Referral tracking and recall lists are mostly administrative workflows with clear owners, which makes them a sensible first place for an agent.
• The agent reads, compares, flags and drafts. Clinicians decide, sign and deliver anything that carries clinical meaning.
• Recall rules must come from the practice's own protocols, written and approved by a clinician, never inferred by a model.
• Every agent action needs a named human approver, a narrow set of permissions and a log that staff can review.
• Start with one role and one observable success criterion, such as every incoming referral having a status and a named owner within the agreed window.

Where referrals and recalls actually get lost

Referrals reach a dermatology office in many shapes: faxed letters, scanned PDFs, portal messages, and phone notes taken by a receptionist. Each shape carries different identifiers, and a letter without a date of birth can sit in a queue for days because nobody is sure which patient it belongs to. The referring office usually expects confirmation that the visit was booked, and when that confirmation never goes out, the relationship suffers even if the clinical care is excellent.

Recall lists drift for a different reason. A patient who was due for a skin check two years ago may have changed phone numbers, moved, or simply never returned after a scheduling reminder went to an old address. Staff eventually build a spreadsheet from exports, and that spreadsheet becomes the only memory of who is overdue. The work is repetitive, easy to postpone and rarely urgent on any single day, which is exactly the kind of work that slips.

Referral tracking tasks an agent can own

A well-scoped agent can carry the bookkeeping around each referral, leaving the decisions to people. In practice that usually means:

• Intake matching: attaching incoming referral documents to a candidate patient record and marking any match that relies on partial identifiers as unconfirmed.
• Status tracking: recording whether a referral is received, scheduled, seen or closed, with the date of the last contact and the person responsible.
• Missing information requests: drafting a request to the referring office for absent notes or imaging, for a staff member to send.
• Overdue flags: listing referrals with no scheduled visit after the practice's own waiting window, sorted so the front desk sees the oldest first.
• Loop closure: preparing a summary to send back to the referring provider once a clinician has signed the visit note, held until that clinician approves it.

Notice what is absent from this list. The agent does not triage the referral, assign a clinical priority, or decide whether a lesion described in a letter needs faster review. Those judgments stay with the clinical team, and the agent's job is to make sure they reach the right person on time.

How to build a recall list without guessing intervals

Recall logic is where practices are most tempted to let a model improvise, and it is where that improvisation does the most harm. A safer sequence looks like this:

1. A clinician writes the recall rules in plain language, grouped by visit type and condition category, and names the protocol each rule comes from. 2. The practice stores those rules as structured fields with an owner and a review date, so the agent reads the same rule every time. 3. The population query selects patients whose last relevant visit or procedure falls inside a rule's window, using only the fields that role needs. 4. The agent produces the list with the triggering rule shown beside each entry, so staff can see why a patient appears. 5. Staff review a sample each cycle, and a clinical lead approves any rule change before it takes effect. 6. Outreach uses approved message templates, and the agent fills in the name, available appointment windows and the scheduling link only. 7. Replies are tracked, and any reply that mentions bleeding, spreading redness, fever or a changing spot leaves the automated flow and goes to a nurse or clinician immediately.

The same structure applies to other specialties with recall cycles. A practice comparing its approach with orthodontic follow-up can read how aligner tracking and recalls are usually separated into rules, queues and human sign-off.

Clinical boundaries the agent must not cross

The boundaries are easiest to hold when they are written down as things the agent does not do, not as general intentions. For a dermatology practice, the agent should not:

• Interpret clinical images, dermoscopy findings, pathology reports or any other diagnostic material.
• Assign or change urgency for a symptom, or tell a patient whether they should be seen sooner.
• Add, remove or shorten a patient's recall interval based on its own reading of the chart.
• Give treatment, medication or skincare advice in any message, including reminders.
• Write, edit or sign clinical notes, or send anything on behalf of a clinician without that clinician's approval.
• Release results or diagnostic language to a patient before a clinician has reviewed them.

When a rule is unclear or a message falls outside the approved templates, the agent should stop and route the item to a person. Consent and intake wording raise similar questions in other clinical settings, and the approach used for massage clinic intake and consent shows why written scope matters more than good intentions.

Illustrative scenario: a referral that stalls

Illustrative scenario: a primary care office sends a scanned referral letter that omits the patient's date of birth. The agent matches the letter to a candidate record using name and phone number, marks the match as unconfirmed, and places it in the front desk queue with the missing field highlighted. Staff confirm the identity, and the agent updates the status to received. When no appointment is booked inside the practice's window, the referral moves onto the weekly overdue list with a drafted scheduling message waiting for approval. Later, a patient replies to that message describing a bleeding spot. The agent does not answer. It routes the reply to a nurse within the same working session and records that the automated thread was closed.

Be Human's managed approach begins with one role, usually referral tracking or recall lists, and defines the memory fields the agent may read, the tools it may use (for example, read access to the scheduling calendar and write access to a draft queue, but no access to clinical notes), the approval steps and an observable success criterion. Monitoring of the rule set, recurring checks on the agent's outputs, permission reviews and incident response then run as ongoing operations, so the boundaries are tested after launch rather than assumed.

Permissions, audit trails and ongoing review

Referral letters and patient replies are untrusted input. A scanned document or a free-text message can contain unexpected instructions, and an agent that reads them must treat that content as data, never as commands. The OWASP guidance on prompt injection describes this risk for language model applications, and the same discipline applies to any intake channel in a clinic.

Access control should be enforced on every request rather than assumed from the interface. The OWASP Authorization Cheat Sheet recommends checking permissions at the point of action, which here means the agent should be unable to open a clinical note even if a staff login could. The NIST AI Risk Management Framework frames this as a continuing practice of mapping risks, measuring them, managing them and assigning governance responsibility, not a one-time setup. For each action, keep a record of the rule applied, the source document, the person who approved it and the time it happened, so that a reviewer can reconstruct any decision later.

Patient information in a dermatology setting is health data, and the practice must confirm which privacy rules apply in its jurisdiction before any agent touches a record. That review belongs with the practice's compliance lead and legal counsel, and it should be completed before the first pilot, not after.

If you want to find the first task worth handing to an agent in your practice, take the free Be Human AI diagnostic.

Frequently asked questions

Can an AI agent send recall reminders to dermatology patients on its own? Not in a well-designed setup. The agent can draft messages from approved templates and queue them, and a staff member or a defined approval step releases them. Any reply that describes a symptom should leave the automated flow and reach a clinician.

Does the agent need full access to the electronic health record? No. It needs only the fields its role requires, such as identifiers, referral status and the last relevant visit date. Clinical notes, images and results should stay outside its permissions, and that separation should be tested during permission reviews.

How is an agent different from the reminder feature in our scheduling software? Built-in reminders usually fire on fixed dates from a single field. An agent can read an incoming referral document, compare it with the practice's rules, explain why each entry appears on a list and draft a follow-up for review, while leaving every clinical judgment to people.

What should a practice prepare before starting a pilot? Choose one role, have a clinician write and approve the recall or referral rules with their source protocols, and define a success criterion staff can observe in their own queues. Confirm the applicable data protection requirements with the compliance lead and legal counsel before any patient data is connected.

Be Human editorial guidance. Examples are illustrative unless explicitly attributed. Sources provide background; implementation choices depend on your workflow.