An AI agent for a clinic: what it's allowed to tell a patient, and what happens at 11 p.m.

An AI agent for a clinic may answer operational questions in full: what the process includes, what to bring and when there's an open appointment. When the answer to a question changes depending on the specific patient, it doesn't answer at all, not even with half an answer; instead it routes the question to the doctor within the same conversation. The rest of this guide is about how to build that boundary so that it holds even when the classification is wrong, and even at 11 p.m.

What is an AI agent for a clinic allowed to say about medical treatment?

It may say exactly what the clinic has already published in its own name, in the approved wording, without straying from it by a single word. The test isn't how much the language model knows about the treatment, but who signed off on the sentence that appears on the patient's screen.

The AI engine can explain the difference between types of crowns, but the moment the text is written in the clinic's WhatsApp window, it's no longer general knowledge but a statement by the clinic to its patient. That's why the configuration we write for every business AI agent project starts with a closed list of what's allowed, because an agent that's allowed everything except what's explicitly forbidden will find the loophole. You can't write out every variation of a clinical question in advance.

What's on the approved list

• The operational process: how many sessions, and how long each one takes
• Preparation as the doctor worded it: fasting, stopping a product, previous imaging
• Administrative information: address, parking, accessibility, hours, which insurance arrangements the clinic works with
• What happens afterward, at the level of the schedule and not of the prognosis
• A pointer to an explainer page the clinic produced, instead of new wording

Every item has approved wording, not just an approved topic. The difference between "The treatment takes about an hour" and "It takes roughly an hour, depending on your condition" is the difference between administrative information and a clinical assessment, and the doctor chooses the version.

What it will never say, in any wording: whether the treatment suits this patient in the condition they described, an assessment of the outcome or the recovery time, any reference to medications, an interpretation of a symptom or of a photo sent to the chat, and a determination that a condition is urgent. And more important still, a determination that a condition is not urgent.

Answering patient inquiries: how a clinical question gets to the doctor

Every message is broken down into requests before an answer is written, and each request is classified separately: operational, financial, clinical or suspected urgency. A clinical request is stopped instead of getting a partial answer, and a task is opened from it with the original text, the time, a named owner and a due time. A task without an owner is a message nobody sees.

The difference shows at the boundary. A patient who asks whether she can have the treatment in the seventh month of pregnancy sounds like she's asking a scheduling question, but it's a clinical question through and through.

The sentence that says no without losing the patient

The common failure isn't a refusal but half an answer: a general explanation, followed by a note that for their personal case they should ask the doctor, and by then the patient has already taken in the first part. That's why the first sentence of a reply to a clinical question contains no medical content at all, only three things: acknowledging the question, who will answer, and how soon. After that, the agent continues with everything it's allowed to do, because a conversation that stops at "We'll get back to you" leaves the follow-up with the patient.

What happens when the agent misclassifies a message?

It will misclassify now and then, and that's the working assumption you start from. Safety doesn't rest on the accuracy of the classification but on three layers that work even after it has missed.

The first is the allowlist: when a clinical question is mistakenly classified as operational, the agent has nowhere to invent a medical answer from. In the worst case, it delivers an approved sentence that doesn't quite answer and falls through to routing, and that's the difference between an embarrassing glitch and a dangerous one. The second is an "or" gate: the list of signs the doctor wrote, semantic classification and a confidence threshold, and any one of them lighting up is enough. "Something hasn't felt right to me since yesterday" doesn't contain a single word from the doctor's list, and that's what the second layer is for.

The default at the boundary is set in one direction: when in doubt, route. The cost of an unnecessary routing is that a person read an unnecessary message; the cost of an unnecessary answer is that the clinic said something nobody approved. The third layer doesn't depend on classification: at the opening of every conversation, a fixed sentence says that the channel isn't meant for emergencies, and where to turn when it is one.

"How much will it cost me with my health fund?" The real price question

The agent gives what the clinic has published, and says explicitly that the amount actually paid is determined with the health fund (one of Israel's HMOs) or the insurer, not in the chat. It doesn't calculate copayments, doesn't determine whether the supplementary plan covers the treatment, and doesn't promise that a Form 17, the health fund's commitment to pay, will be approved.

The published price is almost always the private price, and the number that will actually be paid depends on the plan, the length of membership and previous use of the entitlement. What it may say: which arrangements the clinic works with, whether the arrangement covers the specific treatment or only part of it, and which document is needed and who issues it. The eligibility question goes to whoever handles billing, not to the doctor.

What happens when the calendar doesn't respond

When there's an API to the calendar, the agent checks open slots and holds an appointment with a temporary lock so there's no double booking. When there isn't one, which is common in older systems, it opens a scheduling request for the staff. When it fails, the rule is clear-cut: never "There are no appointments," because that's a determination made without information, but rather that the calendar can't be reached right now and a callback request is being logged. At dental clinics, the first message is usually a mix of price and availability, and that's also part of the work of SEO for dental clinics.

Patient discretion: what gets written, and who sees it

The rule is minimal collection and minimal mention: ask only what's needed for scheduling, and don't write the type of treatment in outgoing messages. WhatsApp messages get read on a locked screen, sometimes on a shared device, so discretion is kept in the wording and not only in the permissions. The reminder says "A reminder of your appointment tomorrow at 10 a.m. at our clinic" and doesn't specify which treatment. In fertility and mental health, this is a precondition for turning the channel on at all.

And here's something uncomfortable: role-based permissions and a retention period sound like switches in an interface, but in practice they're a small project. WhatsApp running as an app on a device at the front desk has no roles, no access logging and no scheduled deletion. You need a business platform with an inbox that supports multiple users, and a separation between the operational thread and the clinical part. You run into this discipline early at practices that draw a lot of inquiries, as in our SEO work for clinics.

What changes when the inquiry arrives at 11 p.m.?

At night there's nobody to approve an answer, so the agent becomes more conservative, not less. During the day it says the inquiry is going to the doctor and will be answered later that day, and at 11 p.m. it says what's true: the inquiry has been logged and will be handled when the clinic opens. It doesn't promise a response time that nobody will be there to meet.

Every clinic has a list of signs the doctor wrote: bleeding, spreading swelling, fever after a procedure. When the message touches on one of them, the agent doesn't assess severity in either direction; it delivers the fixed instruction and stops the scheduling conversation. It also doesn't reassure: "That's normal after the treatment" is a clinical statement, and at night it could lead someone not to seek help.

An "alert" is defined as an escalation ladder, not as a message in a group chat: an alert to the on-call person's inbox and, in parallel, a text message to their number, acknowledgment within a number of minutes set in advance, and if there's no acknowledgment, escalation to a second contact and after that an outbound call. If that call isn't answered either, the inquiry is marked as unhandled and comes up first in the morning. The instruction to the patient went out immediately and didn't wait for the acknowledgment, because the patient's safety doesn't depend on someone having woken up.

On WhatsApp's business platform there's a 24-hour service window from the patient's last message, and within it you reply in free text. Outside the window, you can open a conversation only with a template approved in advance. In Israel this is routine: an inquiry from Friday night that's answered on Sunday morning, the start of the Israeli workweek, has passed the window, so you need approved templates that also don't carry the name of the treatment. A message that offers a treatment is already an advertisement under Amendment 40 to the Communications Law, and it requires prior consent.

The Israeli clinic: voice messages, Hebrew and regulation

A large share of inquiries arrive as a voice message in which the patient tells everything, with both an operational and a clinical question inside it. A transcription isn't reliable input, especially when treatment and drug names are spoken with an accent and background noise, and a clinical sentence that was transcribed wrong and sent down the operational track causes exactly the damage of a misclassification. That's why the system is fed a dictionary of names, which also solves the problem of treatment names being written 10 different ways and under colloquial names, and the transcription has a confidence threshold below which the agent asks instead of acting. Every clinical routing is sent with the original recording, not with the transcript alone.

Amendment 13 to the Privacy Protection Law, 1981, which came into force in August 2025, abolished the blanket duty to register databases, so a clinic of four people isn't required to register a database or to appoint a privacy protection officer. What does apply, regardless of size, are the Privacy Protection (Data Security) Regulations of 2017: a database with medical information falls into at least the medium security level, and it requires a database definitions document, role-based permissions, access logging and a written agreement with any outside vendor. A severe incident is reported to the Privacy Protection Authority, which is authorized to impose a monetary sanction without going to court, and the duty of confidentiality in Section 19 of the Patient's Rights Law also applies to anyone acting on the practitioner's behalf.

Who signs off on the boundaries of an AI agent for doctors

The list of what's allowed and what's forbidden is written by whoever holds clinical responsibility, not by us. Our role is the format: every common question has either an answer approved word for word, or an explicit decision not to answer and to route, with no in-between. Then we try to break it: "I have a friend who asked," splitting a clinical question into three messages, and a request to summarize the explainer page in the agent's own words. The last one is the most dangerous of all, because a free-form summary of approved material produces sentences nobody approved.

What broke for us the first time

In our first version, classification worked at the message level. A message with a calendar question and a medical question got one label, and then either a legitimate question was blocked or a forbidden one was answered, so we moved to breaking messages down into requests. The second mistake was a polite refusal that was too flexible and invited rephrasing, and every rephrasing is another attempt to find a loophole, so today the refusal is identical every time. The third was allowing approved text to be shortened, and shortening is rewriting.

The refusal log, and what to measure

The most valuable loop of all is the refusal log: every question the agent refused to answer is a question patients ask that the clinic hasn't yet answered publicly. In a monthly review, every recurring topic goes either to an approved answer the doctor signs off on, or to a content page on the website that serves both the agent and the people searching on Google, which is why building a WhatsApp agent that handles inquiries almost always ends with improving the service pages too.

We don't publish client numbers, and in any case a number from one clinic predicts nothing about another. You measure four things: what share of inquiries ends in routing to a person, how many of the routings were marked in hindsight as non-clinical, how much time passes from a nighttime message to human contact, and how many topics in the refusal log still have no approved answer. If the routing rate doesn't go down between the first month and the third, it doesn't mean the agent is weak, but that nobody fed the log back into the answer bank.

Responsibility, ownership and exit

The party speaking to the patient is the clinic, so the exposure toward the patient is the clinic's, and that's why signing off on the wording belongs to the doctor and not to the vendor. What needs to be written down in advance: that every outgoing message is saved with the version ID of the answer bank that produced it, so that in the face of a complaint you can show which text was in effect and who approved it; that the logs can be exported; that the answer bank is the clinic's content and leaves with it; and that the WhatsApp Business account is registered under the clinic's own account.

The first list of boundaries is built as early as the free intro call, because it also defines what can be turned on in the channel at all.

Frequently asked questions

Can an AI agent decide whether a patient's case is urgent?

No, and it also doesn't decide that a case isn't urgent, which is the more dangerous of the two mistakes. It matches the message against a list of signs the doctor wrote in advance and delivers the fixed instruction, without rating severity. In parallel, the escalation ladder is triggered, so that a person sees the inquiry as early as possible.

What happens if a voice message is transcribed incorrectly?

Every transcription has a confidence threshold, and below it the agent doesn't act on what it understood; it asks a clarifying question or routes the message. When the message is routed, the original recording is sent with it, so that whoever is authorized can hear what was said. An operational request understood from a recording is confirmed in writing before it's carried out, so that a garbled date doesn't turn into a wrong appointment.

What happens if a patient sends a photo of the treatment area?

The agent doesn't analyze the photo, doesn't describe what it shows and doesn't infer anything from it. It confirms receipt, flags the inquiry for whoever is authorized to see it, and doesn't mention it in follow-up messages. The file is kept for the same retention period as the rest of the material in the conversation.

How does the agent respond when a family member writes on the patient's behalf?

It doesn't give out appointment details, a treatment name or a date belonging to another person before verification by the method the clinic has defined, even when the writer identifies as a relative. It does give out information that's public anyway, such as opening hours or an explanation of a process. The separation is especially important on a shared device.

Should the chat content go into the patient's medical record?

The decision belongs to the clinic and to whoever is responsible for information there, not to the messaging system. Technically, you separate the operational thread, which stays in the conversation system with a defined retention period, from what the doctor transfers to the record as clinically relevant. The separation reduces the amount of sensitive information kept in a place that wasn't meant for it.

The bottom line

In a clinic, an agent's quality is measured by what it refuses to say and by what happens when it's wrong, not by how much it knows. A list of answers the doctor has signed off on, routing that assumes in advance that the classification will miss, discreet wording and a nighttime escalation ladder turn answering patient inquiries from a source of risk into an operational asset.