AI for healthcare clinics: a playbook for intake, prior auth, referrals, and documentation
The best AI projects in a clinic do not touch diagnosis at all. They take paperwork off the people who should be with patients: intake, prior authorization packets, referral coordination, and the documentation that eats evenings. This is how I would sequence that work for an outpatient clinic or a multi-site group.
the short version
- Point AI at administrative load first. The clinical decision stays with the clinician, and the system prepares, drafts, and routes.
- Prior authorization prep and referral coordination usually return the most staff time, because they are rule heavy and document heavy.
- HIPAA is a design requirement, not a checkbox: BAAs with every vendor in the chain, minimum necessary access, audit logs, and clear human sign-off.
- Measure turnaround times and staff hours on specific queues, and track errors caught in review as closely as time saved.
01the rule that keeps you out of trouble
Draw one line before you start and do not cross it: AI prepares, a licensed person decides. The system can read, summarize, match, draft, and route. A clinician makes clinical calls, and trained staff approve anything that goes to a payer or a patient on the clinic's behalf.
That line is not only about risk. It is also where the value is. In most clinics I talk to, the bottleneck is not clinical judgment; it is the hours of assembly work wrapped around it. Take the assembly away and the same team sees more patients and goes home on time.
02where to start
Walk the administrative queues and write down three things for each: how many items come in per week, how long each takes a person, and what it costs when one is late or wrong. The queues that usually top the list:
- Prior authorization requests waiting to be assembled or resubmitted.
- Inbound referrals waiting for records, eligibility, or scheduling.
- New patient intake forms waiting to be reconciled into the chart.
- Unsigned visit notes and the after-hours charting behind them.
- Patient portal messages waiting for a reply.
The one with the worst combination of volume, staff time, and cost of delay is project one.
03the use cases, ranked
1. Prior authorization preparation
Prior auth is rule heavy and document heavy, which is exactly the shape AI handles well. A system can pull the relevant notes and results, compare them with the payer's published criteria, draft the request, and list what is missing before anyone submits.
What it needs: read access to the relevant chart sections, payer criteria kept current, a review screen for staff, and a log of what was submitted. Denials route back to a person with the stated reason summarized.
2. Referral coordination
Referrals stall on missing records and back-and-forth. An AI workflow can read an inbound referral, check it against what your specialists require, request what is missing, verify eligibility, and queue the patient for scheduling.
What it needs: intake from fax, portal, and email (often all three), structured requirements per specialty, and integration with scheduling.
3. Intake structuring
Patients fill out forms in every format imaginable. AI can extract history, medications, and insurance details into structured fields, flag inconsistencies, and present them for staff to confirm before they enter the chart.
4. Documentation drafts
Drafting visit notes from structured inputs or recorded encounters, with the clinician reviewing and signing. Pick a tool that fits your EHR and your specialty's note structure, and require patient consent where recording is involved.
5. Patient messaging
An assistant can answer routine portal and text questions (directions, prep instructions, forms, billing basics) from the clinic's own approved content using retrieval, and route anything clinical to the care team with a summary. It should never give medical advice on its own.
04HIPAA basics for AI systems
None of this is exotic. It is the same framework you already apply to any vendor, applied with more care because AI systems read a lot of data at once.
- BAAs down the chain. The tool vendor, the hosting provider, and the model provider behind the tool all need business associate agreements if they touch protected health information. Ask vendors which model they use and whether that provider has signed one.
- Minimum necessary. The prior auth system needs the relevant notes and results, not the entire chart. Scope access per workflow.
- Audit logs. Record what the system read, what it produced, who reviewed it, and what was sent. When a payer or a patient asks what happened, you want an answer in minutes.
- No training on your data unless you have explicitly agreed to it.
- Human sign-off is logged. A review step that is not recorded is a review step you cannot prove happened.
Many clinics also face a choice between renting a compliant automation platform and owning their own workflows. That tradeoff deserves its own read: HIPAA automation: rent vs own. If you want to go straight to the build, see HIPAA workflow automation.
05what to avoid
- AI in the clinical decision path without a clinician. Triage suggestions, if you use them at all, are inputs to a person, never outputs to a patient.
- Shadow tools. Staff pasting notes into consumer chatbots. Replace the habit with an approved tool, then set the policy.
- Automation without exception handling. Every workflow needs a queue where odd cases land and a person who owns that queue.
- Unreviewed drafts. If clinicians sign every AI draft without edits, either the drafts are perfect or nobody is reading them. Check which.
- Copy that overclaims. Do not describe AI features to patients in ways that imply clinical capability they do not have.
06a 90-day sequence
- Days 1 to 20: baseline. Measure volume, handling time, and turnaround for the target queue. Map every system it touches. Confirm BAAs.
- Days 20 to 45: build the preparation step. The AI assembles and drafts; staff review everything. Collect every correction as test data.
- Days 45 to 75: tighten. Use the corrections to improve accuracy, add checks for the error types you saw, and decide which items can move to spot review.
- Days 75 to 90: expand. Second site or second queue, with the same review discipline. Report results against the baseline to the leadership team.
07how to measure it
| Workflow | Measure | Quality check |
|---|---|---|
| Prior auth | Time from order to submission, staff hours per request | Denials for missing information |
| Referrals | Time from referral received to appointment booked | Referrals lost or duplicated |
| Intake | Time to reconcile forms into the chart | Corrections at check-in |
| Documentation | Time to signed note, after-hours charting | Edit rate on drafts |
| Messaging | Response time, share resolved without a clinician | Messages wrongly answered instead of routed |
08where Insomnia Club fits
We build the clinic-specific parts: prior auth and referral workflows through AI workflow automation, staff-facing review queues as internal tools, and patient-facing apps when the clinic wants its own. We have shipped in healthtech before, including Nestwell, a healthtech startup we took from idea to product as fractional CTO. Every engagement is a fixed budget agreed before work starts, with working software every two weeks. More on our healthcare work is on the healthcare industry page.
common questions
How are healthcare clinics using AI today?
Mostly on administrative work: structuring intake forms, assembling prior authorization packets, coordinating referrals, drafting visit documentation for clinician review, and answering routine patient messages. The systems prepare and route work while licensed staff make the decisions.
Is it legal to use AI with patient data?
Yes, when the system is built and contracted for it. Every vendor that creates, receives, stores, or transmits protected health information needs a business associate agreement, including the model provider behind the tool, and the system should limit access to the minimum necessary and log every access.
Can AI handle prior authorizations?
It can do much of the preparation: pulling the relevant notes, matching them to the payer's stated criteria, drafting the request, and flagging what is missing. A person should review and submit, and denials should come back to a person with the reason summarized.
Will AI documentation tools replace clinicians writing notes?
They change the job from writing to reviewing. The clinician still owns the note and signs it. The risk to manage is rubber stamping, so good workflows make edits easy and track whether drafts are actually being reviewed.
Where should a clinic start with AI?
Pick the administrative queue with the longest backlog or the most overtime attached to it, usually prior authorization, referrals, or intake. Measure its turnaround today, automate the preparation step, and keep a person on the final action.