AI automation in healthcare: administrative, not clinical

Healthcare has an enormous administrative load and the tightest constraints on touching any of it. Both facts are true at once, which is why this subject produces so much writing that is either uselessly cautious or dangerously enthusiastic.

The distinction that makes it tractable is between administrative work and clinical work. Administrative work — scheduling, forms, referral logistics, reminders, coding support — is a large share of the burden and is automatable within the usual constraints. Clinical work is regulated as a medical device in most jurisdictions the moment software influences a decision about a patient, and that is a different project entirely.

What we'll cover

• The line that decides everything
• When software becomes a medical device
• Patient data, and what it constrains
• Building it with CodeWords
• Where the administrative burden sits
• Communication with patients
• What must never be automated
• Clinicians and what they will accept
• The waiting list, which is the hardest administrative problem
• Making it survive
• Limits worth knowing about
• What to build first
• Frequently asked questions

The line that decides everything

Administrative work supports care without influencing a clinical decision.

Clinical work informs or makes a decision about diagnosis, treatment or triage.

The boundary is not always obvious. Sorting referrals by urgency sounds administrative and is clinical triage.

Prioritising a waiting list by clinical criteria is likewise a clinical judgement wearing an operational label.

When unsure, treat it as clinical, which is both the safe default and the one a regulator would apply.

Get the classification confirmed by whoever holds clinical governance, in writing, before building.

When software becomes a medical device

Most jurisdictions regulate software that is intended to inform clinical decisions, with a classification and a conformity process.

Intention matters more than capability. How the tool is presented and used determines its classification, not only what it computes.

"Decision support" is not a safe harbour — supporting a clinical decision is generally within scope.

The obligations are substantial: clinical evaluation, quality management, post-market surveillance and vigilance reporting.

This is not a question to answer internally on the basis of a blog post, including this one. It needs regulatory advice specific to your jurisdiction and your product.

Administrative automation stays outside it, which is the practical reason the distinction is worth maintaining rigorously.

Patient data, and what it constrains

Health data attracts the highest protection in essentially every data protection regime.

Minimise ruthlessly. An appointment reminder needs a name, a time and a contact — not a diagnosis, a referral reason or a clinic name that discloses one.

A clinic name can be disclosive. A reminder naming a specialist service reveals a condition to anybody who sees the screen.

Third-party processors need agreements and, in several jurisdictions, specific safeguards for health data.

Access must be role-based and logged, since who looked at a record is part of the obligation.

Cross-border processing is frequently restricted for health data specifically, which affects where anything can run.

Building it with CodeWords

CodeWords connects to more than 3,000 integrations, and the connection is made once and reused.

1. Open CodeWords and start a new automation.
2. Describe what should happen in plain language to Cody, the automation builder: the trigger, the minimum data required, who is contacted, and what routes to a person.
3. Authorize the connections — the practice or patient administration system, and the communication channel.
4. Describe the exceptions: a patient flagged for special handling, a safeguarding concern, a contact preference, anything clinical.
5. Run it in report-only mode against one clinic and have somebody read every message before it sends.

You describe the outcome; Cody builds it, connects it, and deploys it. The free plan covers light use, with Pro at $39 per month and Business at $100 per month as usage grows; details are on the pricing page.

Where the administrative burden sits

Appointment logistics: booking, rescheduling, reminders, and the cancellation gap that goes unfilled.

Forms and pre-visit information, collected before the appointment rather than in the waiting room.

Referral tracking, which is where patients are most often lost between services and where nobody owns the follow-up.

Results communication logistics — not the interpretation, which is clinical, but the chase and the notification that a result is ready.

Coding and documentation support, prepared for clinician review rather than submitted automatically.

Reporting returns, which are repetitive, deadline-bound and error-prone by hand.

Communication with patients

Reach them how they prefer, including by post for those who need it, since a digital-only service excludes people systematically.

Do not disclose by implication. The clinic name, the letterhead, even the sender can reveal a condition.

Allow a reply that reaches a person, since a patient replying to a reminder may be reporting something that matters.

Plain language and translation are access requirements rather than niceties.

Confirm, do not assume delivery. An unread message is not a communicated result, and safety-critical information needs confirmation.

Never send a clinical result without the clinical process around it, whatever the technical possibility.

What must never be automated

Triage and prioritisation by clinical criteria, which is a clinical act.

Diagnosis or treatment recommendation, in any form, without the full regulatory path.

Communicating a significant result, which needs a clinician and a conversation.

Safeguarding decisions, which follow an established route to a person immediately.

Consent for treatment, which is a process rather than a form.

Anything where being wrong harms a patient, which is the general form of all of the above.

Clinicians and what they will accept

Time back is the only currency that matters, and it must be time back today rather than after a training programme.

It must not add clicks. A tool that saves five minutes and costs six is rejected correctly.

It has to work inside existing systems, because a separate login during a clinic will not happen.

Errors must be visible and correctable, since a clinician who cannot correct something will stop trusting all of it.

Do not monitor individuals. Automation producing a by-product that measures clinician throughput will be resisted, and rightly.

Involve them in the design, because they know which of the administrative burdens actually costs time and which merely looks like it should.

The waiting list, which is the hardest administrative problem

Almost every healthcare setting has a waiting list, and almost none has good administrative control of it — which produces both wasted capacity and patients who have fallen off it entirely.

Validate it periodically. A proportion of any long list no longer needs the appointment, has been seen elsewhere, or cannot be contacted, and nobody knows which without asking.

Contact people before their slot, more than once and through more than one channel, since non-attendance concentrates among those who were hardest to reach.

Fill short-notice gaps from the list, which is where the recoverable capacity is and which almost never happens fast enough by hand.

Track how long people have waited and surface it, without ordering the list by clinical criteria — the ordering is a clinical decision and the visibility is not.

Flag the person nobody has contacted in months, which is the failure that causes real harm and produces no alert anywhere.

Report the list's shape, not just its length, since the distribution of waits tells you something the total never does.

Making it survive

Fail safe and loudly. A silent failure in a reminder system means somebody misses an appointment.

Handle the incomplete record, which is common, by raising a task rather than guessing.

Keep a full audit trail of what was sent, to whom, and who accessed what.

Apply retention automatically, in line with the applicable schedule, which for health records is frequently long and specific.

Report the outcome: messages sent, failures, patients uncontactable, and anything escalated.

Limits worth knowing about

Clinical systems are frequently closed, and integration may be limited to defined interfaces or exports.

Interoperability standards help and do not solve it, since implementations differ in practice.

Procurement in public health systems is slow and constrained by frameworks.

Digital exclusion is real, and an automation that assumes a smartphone excludes some of the people who need the service most.

Automation cannot fix capacity. It removes administrative load; it does not create clinical time where there are not enough clinicians.

What to build first

Appointment reminders with easy rescheduling and automatic backfilling of cancellations from a waiting list. It is unambiguously administrative, the data required is minimal, and missed appointments are one of the largest recoverable costs in any healthcare setting — a slot that goes empty was a slot somebody else needed.

Two habits make the difference. Classify every proposed automation as administrative or clinical with whoever holds clinical governance, in writing, before building — because the boundary is less obvious than it looks and sorting referrals by urgency sits on the wrong side of it. And minimise disclosed data to the point of paranoia, since a clinic name on a reminder can reveal a condition to whoever is standing nearby.

Frequently asked questions

What can healthcare organisations safely automate?

Administrative work that does not influence a clinical decision: appointment logistics, forms and pre-visit information, referral tracking, the chase around results, coding support prepared for clinician review, and reporting returns.

Where is the line between administrative and clinical?

Anything informing or making a decision about diagnosis, treatment or triage is clinical. Sorting referrals by urgency and prioritising a waiting list by clinical criteria both sound administrative and are not.

When does software become a regulated medical device?

In most jurisdictions when it is intended to inform clinical decisions — and intention, including how the tool is presented and used, matters as much as capability. "Decision support" is generally within scope rather than outside it.

How should patient data be handled in automations?

Minimised to the point of paranoia. A reminder needs a name, a time and a contact. A clinic name can itself disclose a condition to anyone who sees the screen.

What must never be automated?

Triage, diagnosis, treatment recommendation, communication of significant results, safeguarding decisions, and consent for treatment. The general form is anything where being wrong harms a patient.

What do clinicians actually adopt?

Anything that returns time today, inside systems they already use, without adding clicks, with errors visible and correctable. Anything that measures individual throughput as a by-product gets resisted, and rightly.

Is digital-only communication acceptable?

No. Digital exclusion is real, and an automation assuming a smartphone systematically excludes some of the people who most need the service. Post and phone remain part of the design.

What is the highest-value administrative automation?

Appointment reminders with easy rescheduling and automatic backfilling of cancellations. Missed appointments are among the largest recoverable costs in healthcare, and an unfilled slot was one somebody else needed.

Can automation manage a waiting list?

It can validate it, contact people, fill short-notice gaps and surface how long people have waited. It must not order the list by clinical criteria, which is a clinical decision rather than an administrative one.

What is the most dangerous waiting list failure?

A patient nobody has contacted in months. It causes real harm, it produces no alert in most systems, and it is straightforward to detect once somebody looks for it.

Related reading

• Automating appointment scheduling
• Workflow automation for education
• Automating form data routing