AI in healthcare for practices and care providers, with HIPAA settled first

Where does AI in healthcare help a practice first?

It helps first at the front desk and in the billing office. Front-desk staff re-key intake packets into the EHR, chase insurance cards and referral letters, and spend hours on the phone rescheduling. Billing staff assemble prior authorization packets, look up payer requirements and rework denials caused by missing or mismatched data.

These are high-volume, rules-heavy tasks where a person can check the output quickly. They also sit away from diagnosis and treatment, which keeps clinical risk low while the practice builds confidence and controls.

• Intake: reading completed intake forms and referral faxes into structured fields for staff to confirm.
• Scheduling: handling reschedules, waitlist fills and reminders, with transfer to staff on anything clinical.
• Prior authorization: gathering chart notes and payer criteria into a packet a coordinator reviews and submits.
• Billing handoff: checking visit data for missing codes, durations or signatures before claims go out.
• Staff knowledge: an assistant over your policies and payer manuals that answers with citations.
• Documentation support: drafting visit summaries for clinicians to edit and sign, where your EHR allows.

What does HIPAA require before using AI in healthcare?

Any AI vendor that handles protected health information needs a signed Business Associate Agreement. The catch is that major model vendors sign BAAs only on certain API or enterprise tiers, not on consumer plans, so a staff member pasting a patient note into a personal chatbot account is a problem regardless of how useful the answer is.

Voice tools follow the same rule. Vapi sells HIPAA compliance as a paid add-on, and Bland AI includes a BAA on its Enterprise plan, so the plan you pick matters as much as the platform. If you record calls, states with two-party consent rules apply to an AI receptionist as they would to a person. This is not legal advice, and we work alongside your privacy officer or counsel.

How do we prioritize AI use cases in a care organization?

We count staff hours and denials, then weigh integration effort. Discovery means sitting with front-desk staff, intake coordinators, billers and a few clinicians, and recording how long each task takes and how often it causes rework. A use case that prevents claim denials can rank highly even if it saves fewer hours, because it protects cash.

Integration with your EHR is usually the biggest variable. Some systems offer APIs or approved integration paths, others only exports or fax queues. Use cases that work outside the EHR and hand staff a prepared result tend to go first, with deeper write-back later once the BAA chain, access controls and review steps are proven.

What did a guided portal change for a therapy provider?

For a therapy services provider, we built a guided AppSheet clinician portal with validation, auto-calculated session durations, approvals and sync to billing. Clinician data entry dropped from 10 to 15 minutes a day to under 3, and errors were stopped at the source instead of being found by billing. More detail is in our case studies.

That project is a useful reminder that not every gain comes from a language model. Structured capture with validation often has to come first, because AI in healthcare is only as reliable as the session, visit and payer data underneath it.

What governance should a practice put around AI?

Governance should keep clinicians in charge, keep PHI inside covered accounts and make every AI output traceable. We write rules that name who may use which tool, what data each tool may see, and who reviews the output before it reaches a chart, a payer or a patient.

Colorado SB 26-189, effective January 1, 2027, adds notice duties for automated decision-making in consequential decisions, and healthcare is one of the named areas, with rights to an explanation of adverse outcomes, human review and data correction. Our controls are designed with rules like that in mind: logged prompts and outputs, minimum-necessary data in each request, confidence thresholds that send uncertain extractions to a human-review queue, and an eval set of de-identified past cases rerun after every change.

• BAA register covering every vendor in the data path.
• Role-based access, so front-desk tools never see full clinical notes.
• A documented fallback when the AI tool is unavailable.

How does a healthcare AI engagement run?

It starts with a free review, then a short discovery with your front desk, billing team and clinical leads, plus a check of your current vendors and BAAs. You get a ranked roadmap, a governance pack and a fixed price for the first use case.

We can build that first use case on covered infrastructure and test it with your staff, or specify it for your EHR vendor or IT partner. The practice owns every account, workflow, prompt and data store.