Scheduling and Notes Agents for Physical Therapy: Memory and Limits

An AI agent for a physical therapy clinic is software that works through the clinic's scheduling system, visit notes, and messaging channels to handle routine work such as rebooking, reminders, and first-draft documentation. Clinicians and front desk staff approve anything that touches a patient record or a payer. A more capable scheduling and notes agent would take on longer, multi-step tasks and keep more context about each patient's plan of care, but in a US practice the real questions are which memory it holds, which actions it may take alone, and who signs off.

Key takeaways

• Scheduling agents add the most value in cancellation rebooking, waitlist filling, and reminder follow-up, where the rules are already written down.
• Notes agents should draft from dictation and approved session data. A licensed clinician reviews and signs every note.
• Memory should cover the active plan of care and communication preferences, not every conversation the clinic has ever had with a patient.
• Set approval boundaries before launch: no chart edits, no payer submissions, and no clinical replies without staff review.
• Treat patient messages as untrusted input, and give the agent only the permissions a single task needs.

What changes at the front desk when scheduling becomes an agent

A physical therapy schedule is full of small, rule-bound changes. A patient cancels a Tuesday visit, a visit needs a therapist with a specific skill, an evaluation has to happen before an authorization runs out, or a patient can only come after work. Today a front desk coordinator handles each of these by reading the calendar and the chart at the same time. An agent with a longer working context can hold those rules, check the calendar, propose the next slot, and send the message through a channel the clinic has approved.

The change is in the breadth of the task, not in the clinical decision. The agent can see that a cancelled patient has three visits left under the current authorization and offer the two open slots that match the assigned therapist. It should not decide whether a visit is clinically necessary, and it should not waive a cancellation fee. Those decisions stay with people.

Recall work follows the same pattern. Clinics that track when a discharged patient should return can apply the approach described in AI Agent for a Chiropractic Practice: Intake and Visit Recalls. For intake and waitlist handling, the limits look more like those in AI for Behavioral Health Clinics: Intake and Scheduling Limits, especially around what a non-clinical system should never say to a patient who sounds unwell.

What a notes agent can draft and what it must not sign

Documentation is where much of a therapist's non-treatment time goes. A notes agent can turn a dictated summary and the session flowsheet into a draft in the clinic's note structure. It can flag missing fields, such as a pain rating or an assist level, and list the exercises performed with the parameters the clinic uses. After the clinician confirms the content, it can prepare the home exercise summary the patient takes home.

The boundary is authorship and signature. The agent does not decide the assessment, change a diagnosis code, edit a signed note, or submit anything to a payer. The clinician reviews, corrects, and signs. Whether the clinic is a HIPAA covered entity, what business associate terms apply to its software vendors, and which state rules govern records and telehealth are questions for the practice's compliance advisor. This article does not replace that review.

Which memory a clinic agent needs, and what it should leave out

Memory is the part most often set too broadly. A useful clinic agent needs a small, current working set: the active plan of care, the next scheduled visits, the assigned therapist, authorization dates, contact preferences, and open administrative tasks. Everything else should be read on demand from the record the clinic treats as its source of truth, not stored as a permanent summary the agent carries into every conversation.

Anthropic's guidance on context engineering makes the underlying point: an agent performs better when its context holds the smallest set of high-signal information for the task at hand. Reading the chart at the moment of a task is a different design from training a model on patient records, and the difference matters for correction, deletion, and audit. The following checks keep the memory scoped.

• List each memory category the agent may hold, with an owner and a retention rule for each.
• Exclude diagnoses, social history, and free-text conversations unless a specific task requires them.
• Require the agent to name the record it used whenever it proposes a change.
• Clear working notes at the end of each task.
• Log every read and write so a clinic manager can review them.

Approval boundaries to set before the first deployment

The approval design should be written before anyone configures a tool. A workable starting list for a clinic looks like this.

• The agent may propose reschedules within the therapist's posted hours. A person approves any change outside them.
• The agent may send reminders and confirmations from templates the clinic wrote. Free-text replies about symptoms or treatment go to staff.
• The agent may draft notes. It may not sign, amend, or lock a note.
• The agent may prepare authorization requests. It may not submit them to a payer.
• The agent may flag any message that mentions worsening pain, new symptoms, or a fall for immediate review by the on-duty clinician. It may not answer those messages itself.
• The agent may not change billing codes, waive fees, or grant exceptions to cancellation policy.

The clinical lead should review this list before launch, and the list should change only through a recorded decision.

Protecting the agent from untrusted messages and over-broad access

Patient messages, referral letters, and forwarded emails are untrusted input. A message can contain text that tries to override the agent's instructions, for example a demand to move someone to the front of the waitlist. OWASP's prompt injection guidance treats this as a design problem: the system should separate instructions from content, and the tools should enforce permissions regardless of what the text says. Authorization is the second layer. Scheduling access should cover the calendar and the approved template library, not the full chart, and each tool call should be checked against the role on whose behalf it runs, as described in OWASP's authorization guidance.

The NIST AI Risk Management Framework offers a useful vocabulary for this work before launch. It helps a clinic name who owns each risk, how the risk is measured, and what triggers a review.

Illustrative scenario and how a managed setup handles it

Illustrative scenario: a clinic with three therapists and one front desk coordinator lets an agent handle cancellation rebooking. On Monday, a patient texts to cancel a Thursday visit. The agent reads the plan of care, sees that the visit is one of the last under the current authorization, and proposes two open slots with the same therapist through the approved text template. The patient picks one. The agent holds the slot, writes an audit entry, and asks the coordinator to confirm the remaining authorized count. The same afternoon, another patient writes that their pain has increased sharply since the last session. The agent does not reply with advice. It routes the message to the on-duty clinician and records the routing.

Be Human's managed approach starts with one role, here cancellation rebooking, and defines the memory that role needs, the tools it may call, the approval boundaries above, and one success criterion the clinic can observe, such as the share of cancelled slots refilled on the same day. After launch, managed operations cover monitoring of the audit trail, recurring evaluations on de-identified cases that reflect real clinic traffic, permission reviews whenever staff roles change, and controlled changes to prompts or tools that pass through the same approval path as the original design.

Where to start with a scheduling and notes agent

Start with the one task where the rules are already written and a wrong draft is cheap to catch, usually cancellation rebooking or reminder follow-up. Leave note signing, authorization requests, and anything involving payers for later stages, after the first task has produced a clean audit trail for several weeks and the clinical lead has reviewed the exceptions. Expansion should follow evidence from the logs, not the size of the tool's promises.

Take the free Be Human AI diagnostic to find the first task worth handing to an agent.

Frequently asked questions

Will an AI agent replace front desk staff at a physical therapy clinic? No. The agent takes over repetitive, rule-based steps such as rebooking and reminder follow-up, which frees staff for work that needs judgment, including exceptions, payer calls, and patient relationships. A sound first deployment changes the workload of the role rather than eliminating it.

Can an agent write the daily treatment notes? It can draft them from the clinician's dictation and session data, but the clinician reviews, corrects, and signs every note. The agent should not change assessments, diagnosis codes, or billing entries. Confirm documentation requirements with the compliance advisor before turning drafting on.

How should a clinic handle patient data in an agent? Limit the agent to the records each task needs, retrieve information when it is used instead of storing long summaries, and log every read and write. Confirm HIPAA obligations and state requirements with counsel, and make sure software vendors have appropriate contract terms in place for handling protected health information.

What should a clinic measure before expanding the agent's role? Track whether the single task it handles is completed correctly, how often staff overrule its proposals, and whether any action fell outside the approved boundaries. Expand only after those checks have held over a period the clinical lead considers sufficient for that task.

Be Human editorial guidance. Examples are illustrative unless explicitly attributed. Sources provide background; implementation choices depend on your workflow.