AI for Occupational Therapy Practices: Referrals, Scheduling and Notes

An AI agent can help an occupational therapy practice sort incoming referrals, propose appointment options and send reminders about open session notes, but only inside boundaries the practice defines before go-live. It should not make clinical judgments, author clinical documentation without clinician review, or see more patient information than its role needs. The practical starting point is one narrow role with written permissions, a visible approval queue and a success criterion the owner can check.

Key takeaways

• Start with one intake or scheduling task, not the whole front office.
• Staff verify referral details before any patient-facing message is sent.
• The agent drafts and reminds; clinicians decide, sign and file clinical records.
• Permissions follow roles, so scheduling staff, clinicians and the agent each see different data.
• Measure success with one observable criterion, such as a complete referral packet on file before the first scheduling call.

Where referral intake usually breaks down

Referrals reach an occupational therapy practice from physicians, schools, employers, family members and sometimes other therapists. Each source sends a different level of detail. The delay usually sits in the gaps: an order that is unsigned, a guardian contact that is missing, a payer that is unclear, or a question about which evaluation was requested. Staff then spend hours chasing answers before anyone can book the first visit.

An agent is useful here because it can check each referral against a fixed list and show exactly what is missing. It also introduces a risk, because referral text comes from outside the practice. A sentence inside an emailed or uploaded referral could try to instruct the agent to change a booking or reveal information. OWASP's prompt injection guidance treats text from outside sources as untrusted, and that rule applies directly here.

The design rule follows from this. The agent reads referrals as data to classify, never as instructions to follow. Anything that names a diagnosis, a change in treatment or a safety concern goes to a staff member. Intake limits in a neighboring clinical setting are covered in AI for Behavioral Health Clinics: Intake and Scheduling Limits, which applies the same logic to a different workflow.

Scheduling: what an agent can handle safely

Scheduling is often where an agent earns its place first, and also where a poorly scoped permission causes the most trouble. A reasonable first scope lets the agent read availability that staff have released for new evaluations, hold a proposed slot for a short window, confirm a booking using an approved message template and add a patient to a waitlist. It should not cancel appointments, move a session to another therapist or decide that a request is urgent.

Calendar access should use the narrowest permission the scheduling system offers. Standard OAuth 2.0 guidance describes scoped access tokens for exactly this purpose, and the practical habit is simple: a token that can only read availability is safer than one that can also delete events. Every write action should be logged with the record it touched, the time it happened and the rule that allowed it.

The same pattern of checked forms and staff-released slots appears in AI for Dietitian Practices: Intake Forms, Plans and Follow-Up, where intake accuracy has to come before any automated follow-up.

Session note reminders without writing the chart

Session notes are clinical records. The safe role for an agent is to notice when a note is overdue and remind the responsible clinician through an internal channel. Drafting note text from session data is a separate decision. Most practices should make it only after the reminder workflow has run cleanly for a while and a clinical lead has approved the draft format and the review steps.

Illustrative scenario: At the end of a clinic day, the agent compares the scheduling system with the list of finalized notes and finds three sessions with no finalized note. It sends each responsible therapist one internal message that lists session times and an internal patient identifier, with no clinical content in the text. The next morning, the clinic manager receives a summary that gives only the count of open notes per therapist. Nothing in that workflow writes to the chart.

The same principle applies to messages going outward. A patient-facing reminder should not mention a diagnosis, a goal or a treatment detail. Note reminders follow similar timing and routing logic in other session-based practices, as the AI Agent for Business Coaches: Session Notes and Follow-Up describes for coaching records. Keeping the agent's job to timing and routing is where automation is safest.

Consent, records and privacy rules to settle first

Before an agent touches patient information, the practice should write down the rules it will enforce. These decisions belong to the owner and the clinical lead, not to a vendor alone. A short checklist to complete first:

• A written list of which data each role can see, and which data the agent can see, approved by the owner and the clinical lead.
• The consent language used for automated messages, checked against the privacy law that applies to your patients, such as LGPD in Brazil or HIPAA in the United States. Brazilian practices should consult the guidance published by the national data protection authority, ANPD.
• A minimum-necessary rule for messages: no diagnoses, goals or treatment details in SMS or email.
• Retention rules for agent logs and drafts that match the retention rules for the practice records they relate to.
• An audit trail for every agent action on a patient record, reviewable by a named person.
• Vendor terms that cover hosting location, subprocessors, access by vendor staff and breach notification.
• A patient-facing opt-out and a route to a human, stated in every automated message.

The NIST AI Risk Management Framework offers a useful structure for documenting these risks and naming owners without requiring any particular tool. Practices can use its categories to decide who reviews what, and how often.

Clinician approvals: a decision guide

Approval rules should be specific enough that a staff member can apply them on a busy Monday morning. This decision guide is a starting point for the practice's own version:

• If the action would change clinical content, a clinician approves it before it happens.
• If the action changes a scheduled session for a minor, or for a patient with a documented accommodation, a staff member approves it.
• If the action sends a patient message, the template must already be approved, and the agent may send only that template.
• If the action is an internal reminder that names no clinical detail, the agent may send it without individual review.
• If the agent cannot place an action in one of these categories, it stops and routes the item to staff.

Approval is not a one-time sign-off. Permissions need periodic review because staff change roles, calendars change and integrations get updated. OWASP's authorization guidance is a useful reminder to check access on every action, not only at login, so that a role change or a revoked permission takes effect immediately.

A first deployment plan, and how Be Human handles it

A first deployment should be small enough to test in a few weeks and clear enough that the owner can judge the result. A workable sequence:

• Step 1: Choose one task, such as checking referral completeness before scheduling.
• Step 2: Write the boundary: what the agent reads, what it writes and what it must never do.
• Step 3: Load approved templates and intake rules as versioned documents the agent retrieves from, so answers come from current policy rather than from memory.
• Step 4: Set up the approval queue and audit log before any live use.
• Step 5: Test on past referrals, including incomplete, unusual and ambiguous ones, and record each failure with its cause.
• Step 6: Set one success criterion the owner can observe, such as every scheduled evaluation having a complete packet on file before the first call.
• Step 7: Review permissions, failures and staff feedback on a fixed schedule.

Be Human designs and operates this kind of setup as a managed service. A first engagement defines one useful role, the memory and tools it needs, the approval boundaries and an observable success criterion. Ongoing operations can include monitoring, recurring evaluations, permission review, integration maintenance and incident response, so the practice's boundaries stay current as forms, staff and calendars change. The work is remote and available in English and Portuguese.

Take the free Be Human AI diagnostic to find the first task in your practice worth handing to an agent.

Frequently asked questions

Can an AI agent write session notes for an occupational therapist? Not as a substitute for the clinician. An agent can remind clinicians about open notes and help organize approved templates, but the clinician authors, reviews and signs the documentation. If a practice wants drafting support, that should be a separate decision with its own review step and approval from the clinical lead.

Is it safe to let an agent message referring physicians or families? Only for routine, templated exchanges that contain no clinical content. Inbound messages are untrusted input and may include text that tries to change the agent's behavior, so the agent should classify them and route anything clinical to staff.

How much does an AI agent for an occupational therapy practice cost? This article does not state prices. The scope depends on the first role, the systems involved and the approval boundaries, and these are defined in the first engagement before any commitment to ongoing operations.

Where should a practice start? Start with one intake or scheduling task that has clear rules and little clinical content, such as confirming referral completeness before a call. Write the permissions and the success criterion first, then test on past referrals before any live use. The free Be Human AI diagnostic can help narrow the choice of task to begin with.

Be Human editorial guidance. Examples are illustrative unless explicitly attributed. Sources provide background; implementation choices depend on your workflow.