AI for Primary Care Referral Intake and Callbacks: Who Owns What

A primary care practice can start using an AI agent for referral intake and callback tracking by giving it one narrow job: log each incoming referral, identify what information is missing, and keep a shared list of open callbacks that staff can see at any time. The agent prepares and routes the work, while clinicians keep every decision about urgency, diagnosis and treatment. Written ownership rules, agreed before the first deployment, define exactly where the agent's authority stops.

Key takeaways

• Referral intake and callbacks are practical first tasks because they are high volume, repetitive and easy to observe, while clinical judgment stays with people.
• Write ownership rules before configuring anything: list the actions the agent may take alone, the actions it may only propose, and the actions it must never take.
• Define one observable success criterion, such as whether each referral has a complete packet and a named owner by the end of the next business day.
• Keep one shared callback register that both staff and the agent write to, so no request lives only in an inbox, a voicemail or a sticky note.
• Review permissions and failed cases on a fixed schedule, and treat every missed callback as a change to the rules rather than a reason to extend the agent more trust.

Where referrals and callbacks get lost

In most primary care offices, a referral arrives through several paths at once: a fax from a specialist, a portal message, a phone call that a front desk employee writes on a notepad, or a letter scanned into the record days later. Each path has its own timing and its own owner, and the loss usually happens between them. A document sits in a shared inbox, a callback request is written down but never transferred, or a patient is told that someone will call and the task has no name attached to it.

These are operational failures rather than clinical ones, but they still reach patients. Staff are interrupted constantly, and the administrative follow-up is the work most easily postponed: confirming that the packet is complete, checking whether the receiving office has confirmed the appointment, or closing the loop with the referring clinician. Callbacks behave similarly. A call that begins as a question about a refill can turn into a symptom report, and the person who took the message may lack the authority or context to triage it.

The same pattern shows up in other intake-heavy practices. The discussion of intake and recall work in a chiropractic practice and the notes on intake and scheduling limits in behavioral health clinics both point to the same lesson: information either gets captured cleanly at intake or it fragments across the day. Primary care adds more referral directions and more clinicians, which makes a single shared register more valuable.

What the agent may do, and what clinicians decide

Ownership rules are the core of the design. Without them, an agent either does too little to matter or does too much to trust. A useful rule set separates three kinds of action: work the agent completes on its own, work it prepares for a human to approve, and decisions it never makes.

• Agent completes alone: create the referral record, check the packet for required fields such as patient identifiers, insurance information and the stated reason for referral, request missing items from the referring office using approved templates, and log the time and result of each callback attempt.
• Agent prepares for approval: draft a callback script, propose a priority based on documented criteria, and draft patient messages that a staff member reviews before sending.
• Clinician decides: whether a referral is clinically appropriate, how urgent a reported symptom is, whether a patient should be seen sooner, and what a patient is told about results or treatment.
• Agent never does: interpret clinical findings, reassure a patient that symptoms are nothing to worry about, change a referral's priority without a clinician, or close a callback that involved a symptom.

Escalation needs its own rule. If an incoming message contains language suggesting an emergency, the agent should route it to a clinician or to the practice's on-call process at once and should not attempt a reply. Write these rules as plain instructions that a clinical lead can read, edit and sign, not as settings buried in a configuration screen. The NIST AI Risk Management Framework is a useful reference for documenting who is accountable for each function and how its risks are reviewed over time.

When the rules are finished, the clinical lead should be able to answer one question for any action in the register: who owns this step, and what would have to happen for the agent to take it.

A step-by-step rollout plan

A narrow rollout is easier to supervise and easier to correct. The sequence below is one reasonable order for a practice that wants to start with a single referral type.

• Step 1: Map the current paths. List every way a referral or callback reaches the practice and name the person who owns each path today.
• Step 2: Choose one referral type to start with, such as outbound referrals to one specialty, and leave the other paths manual.
• Step 3: Write the ownership rules in plain language and have the clinical lead approve them in writing.
• Step 4: Set the agent's access. Give it read access to the referral queue and write access only to the fields and templates named in the rules.
• Step 5: Create the callback register with fields for patient reference, reason, owner, due time and outcome. Every item must have exactly one owner.
• Step 6: Run the agent in shadow mode for a short period, comparing what it would have logged with what staff actually recorded by hand.
• Step 7: Go live for the chosen referral type, review exceptions every week, and widen the scope only after the success criterion holds.

The success criterion should be observable without special tooling. An example is the share of referrals in a given week that had a complete packet and a named owner by the next business day, checked against a sample reviewed by a staff member. Shadow mode matters because mismatches are informative. A difference between the agent's log and the staff log usually points either to a gap in the rules or to inconsistent source documents, and both are worth fixing before go-live.

An illustrative scenario

Illustrative scenario: a front desk coordinator receives a faxed referral asking a cardiology group to see a patient. The agent opens a referral record and notices that the referring note has no medication list. It requests the list through the approved template and adds a callback task to the register, with the coordinator as owner. Two days later the list arrives, and the agent updates the packet and marks it complete. The same week, the patient calls to ask whether new shortness of breath can wait for the appointment. The agent routes the message to the on-call clinician immediately and does not draft a reply. The clinician calls the patient within the hour, and the agent records the outcome only after the clinician enters it.

The scenario shows the division of work. Administrative completeness is automated and visible in the register. The symptom question belongs to a clinician from the first moment, and the agent's role is to make sure that question reaches the right person quickly.

How Be Human approaches this as a managed service

Be Human designs and operates this kind of agent as managed infrastructure. An engagement starts by defining one useful role, here referral intake and callback tracking, together with the memory and tools that role needs, the approval boundaries described above and an observable success criterion. Operations then cover monitoring of the queue, recurring evaluations against a sample of real cases, permission reviews, maintenance of the integrations when the referral source or the electronic record changes, and incident response when something goes wrong. Controlled improvements are made one rule at a time, and the clinical lead approves each change before it takes effect.

Privacy, access and failure planning

Referral data is sensitive health information, so confirm with counsel which privacy rules apply in your jurisdiction, such as HIPAA in the United States or the LGPD in Brazil, and keep the agent's data access to what its role requires. The OWASP authorization guidance is a sound baseline: each action should be checked against the role and the context of the request, not only against the fact that a system is connected. Keep document content in its place as well. Faxed and emailed text can contain instructions meant to change an agent's behavior, so anything read from a referral should be treated as data to interpret, never as a command. The OWASP prompt injection cheat sheet describes these risks in more detail.

Plan for failure before it happens. If the referral portal is unavailable, the agent should stop writing, mark pending items clearly and alert the coordinator. Every action should be logged so that a review can reconstruct who did what and when. Review the logs for near misses as well as for errors, because a near miss, such as a symptom message that almost stayed in the general queue, is the cheapest lesson available.

To find the first task in your practice that is worth handing to an agent, take the free Be Human AI diagnostic.

Frequently asked questions

Can an AI agent decide which referrals are urgent? No. In a sound design, the agent can apply documented intake criteria, such as flagging a referral with a missing reason or an expired date, but a clinician decides clinical urgency. Any message that suggests a symptom should go straight to a clinician or the on-call process, and the agent should not attempt to classify it.

Does this replace the front desk? No. The agent takes over repetitive tracking, such as checking packets, sending approved requests for missing items and keeping the callback register current. Staff remain responsible for patient contact, judgment calls about what needs attention, and the relationships with referring offices, and they review the agent's exceptions each week.

What should we measure in the first stage? Measure something that a staff member can check without special tools. A useful example is whether each referral in a sampled set had a complete packet and a named owner by the next business day. Track missed callbacks separately, and treat each one as a question about the rules or the source data rather than as a number to hide.

Do we need to change our electronic record system? Not necessarily. Many practices start with the referral sources and the register they already use, with the agent working through approved fields and templates. Whether an integration is needed depends on your record system and your privacy review, so settle those questions with your clinical lead and your compliance advisor before connecting anything.

Be Human editorial guidance. Examples are illustrative unless explicitly attributed. Sources provide background; implementation choices depend on your workflow.