Clinic Inquiry and Appointment Playbook: Automate Admin Work, Keep Clinical Decisions Human

A clinic can automate opening hours, approved service information, slot lookup, confirmation, and change requests. It should not let a conversational system diagnose symptoms, decide urgency, recommend treatment, or reassure a person that waiting is safe.

Use this playbook to separate routine logistics from decisions that require a qualified person. It is an operating template, not medical or legal advice. Before launch, the clinic must adapt it to local law, clinical policy, channel rules, and the actual systems it controls.

Start with the inquiry control card

Patient's request in their own words:
Routine logistics requested:
Symptoms, urgency, medication, treatment or privacy issue mentioned:
Permitted response (answer logistics / clarify / staff handoff / emergency route):
Named owner and backup:
Information allowed in the channel:
Stop condition:

First action: preserve the person's wording. If the message contains symptoms, a possible emergency, medication, diagnosis, treatment, test interpretation, or uncertainty about urgency, stop the routine flow and use the clinic's approved human or emergency route.

Completion standard and roles

• Start: a message enters a monitored clinic channel with an assigned owner.
• End: the routine question is answered from approved content, one appointment is confirmed or changed, or a qualified person accepts the handoff.
• Evidence: content version, request timestamp, permitted fields, booking version, owner acceptance, delivery state, change log, and final disposition.
• Excluded outcome: the workflow never marks a person clinically safe, diagnosed, treated, or suitable for a service.

Role	Owns	Must approve	Receives
Patient-access owner	Routine intake and communications	Eligible inquiry types and channel copy	New routine request
Qualified clinical owner	Triage and clinical boundaries	Clinical escalation and emergency wording	Clinical or urgency handoff
Scheduling owner	Live capacity and booking integrity	Conflict and partial-write recovery	Eligible booking request
Privacy/security owner	Data minimum, access and retention	Channel, vendor and incident controls	Privacy/security exception

The World Health Organization frames health-AI governance around autonomy, safety, transparency, accountability, equity and sustainability. This playbook applies those principles by keeping high-consequence decisions with named people and preserving an audit trail. Read the WHO guidance.

Phase 1: define what automation may answer

• Owner: qualified clinical owner with the patient-access owner.
• Inputs: service catalog, approved copy, clinical policy, emergency route and local privacy/channel review.
• Actions: classify routine, administrative-clarification, clinical-review, emergency and unsupported requests; version the copy; name who may change it.
• Output: approved inquiry-and-escalation matrix. Routine content may include verified hours, locations, appointment types, approved preparation, accessibility and change routes.
• Exit gate: every inquiry type has one response, owner and backup.
• Escalation/rollback: if the boundary is unclear or content expires, withdraw the answer; acknowledge and route without recommending a service.

Phase 2: collect only what changes the next step

• Owner: patient-access owner; privacy/security owner approves the field set.
• Inputs: approved matrix, permitted channel, identity/contact reference and minimum appointment fields.
• Actions: explain required fields; collect only data that changes the logistical next step; provide a human route; stop sensitive-detail collection on a general channel.
• Output: eligible administrative request or accepted exception handoff.
• Exit gate: minimum permitted data is complete and each exception has an owner.
• Escalation/rollback: remove or restrict unnecessary fields under policy; move to an approved route and preserve only the minimum event record.

In the United States, HHS treats appointment reminders as treatment communications and separately advises providers to limit information disclosed in messages and respect reasonable communication requests. Those pages are jurisdiction-specific examples, not a global permission. Each clinic must obtain local privacy advice and configure its channels accordingly. Review the appointment-reminder FAQ and message-safeguard FAQ.

Phase 3: create or change one verified appointment

• Owner: scheduling owner.
• Inputs: eligible request, authoritative capacity, appointment rules, timezone and idempotency key.
• Actions: read capacity; offer permitted appointment types; recheck the slot; write once; return reference, logistics and approved help route.
• Output: one verified booking version or one visible exception event.
• Exit gate: source of record and delivered confirmation agree.
• Escalation/rollback: suppress confirmation on partial write, preserve the event, reconcile/cancel duplicates and notify scheduling.

Phase 4: hand off clinical, urgent, and privacy exceptions

• Owner: clinical owner for clinical/urgency cases; privacy owner for data cases; scheduling owner for conflicts.
• Inputs: original wording, timestamp, contact route, channel, booking reference and current state.
• Actions: stop the routine branch; preserve minimum context; send to the declared destination; wait for acceptance; invoke backup at the team's pre-approved target.
• Output: accepted handoff with owner/time or an activated backup.
• Exit gate: a person or monitored queue accepts responsibility while automation remains stopped.
• Escalation/rollback: withdraw unapproved messages, cancel pending routine actions, preserve the audit event and follow clinic emergency/incident policy.

Severity	Trigger	Primary target	Fallback
Clinic-defined urgent	Symptoms or uncertain urgency	Qualified route at the clinic-set target	Named backup or approved emergency instruction
High	Medication, diagnosis, treatment or test question	Monitored clinical queue before continuation	Qualified clinical backup
High	Sensitive detail in the wrong channel	Privacy/security owner at the incident target	Approved secure channel and incident route
Operational	Booking conflict or duplicate	Scheduling before confirmation	Manual reconciliation queue

“A staff member will review this” is not a handoff until a person or monitored queue accepts ownership. Set an internal response target and a backup route; do not publish a universal medical response time.

Fictional completed run

A fictional clinic receives: “I need to move Tuesday's appointment, and the pain is suddenly worse.” The system copies the message unchanged. It does not offer a new time or comment on the pain. Patient-access owner Mai selects staff handoff; nurse An accepts under the clinic's triage policy. Only after An closes the clinical route does scheduling owner Minh move booking C-482 from Tuesday 09:00 to Thursday 14:00 ICT. The confirmation contains the location, time, booking reference, and change number—no symptom text.

Patient's request in their own words: “I need to move Tuesday's appointment, and the pain is suddenly worse.”
Routine logistics requested: Change appointment C-482
Clinical issue mentioned: Worsening pain; no interpretation
Permitted response: Stop booking and obtain clinical handoff acceptance
Named owner and backup: Nurse An; duty clinical queue as backup
Information allowed in the channel: Appointment logistics only after clinical route closes
Stop condition: No slot offer, confirmation or symptom response until the qualified route accepts and closes its step
Final disposition: Handoff accepted; booking changed once; minimal confirmation delivered

QA, measurement, and pause rules

Review a sample weekly. Record each pre-pilot baseline and team-set pause threshold before launch.

• Valid booking rate: compliant appointments / attempts. Owner: scheduling. Cadence: weekly. Baseline: pre-pilot audit. Never infer clinical appropriateness.
• Accepted handoff rate: accepted required handoffs / required handoffs. Owner: clinical operations. Cadence: each urgent event plus weekly review. Baseline: replay test. Never infer clinical quality/safety.
• Minimum-data compliance: reviewed messages using only approved fields / reviewed messages. Owner: privacy/security. Cadence: weekly sample. Baseline: pre-launch sample. Never infer legal compliance.

Failure	Early signal	Corrective action
Unaccepted urgent handoff	Pending state reaches the clinic-set target	Activate backup, stop the flow, review staffing/alerts
Unqualified clinical response	QA finds diagnosis, reassurance or treatment wording	Withdraw content, preserve event, restrict/retrain and obtain clinical review
Duplicate or partial booking	Source of record and confirmation disagree	Suppress confirmation, reconcile and repair idempotency/write handling
Excess sensitive data	Review finds an unapproved field/channel	Stop collection, restrict access, follow incident policy and revise fields

Pause the affected flow after an unaccepted urgent handoff, clinical advice from an unqualified route, privacy incident, repeated duplicate, stale approved content, or missing audit event. Repair the boundary or system and pass the applicable replay before resuming.

Frequently asked questions

These questions clarify the boundary between a completed administrative handoff and a clinical or legal decision.

Can the workflow decide whether a symptom is urgent? No. It preserves the wording and invokes the clinic's approved qualified or emergency route; it does not perform triage.

Can reminders include the reason for the appointment? Only when the clinic's authorized privacy and clinical owners approve that exact content, channel and jurisdiction. Use minimum logistics by default.

Does an accepted handoff prove safe care? No. It proves only that an operational owner accepted the event. Clinical quality and outcomes require separate governance.

Next steps and limits

Continue the workflow. Use the appointment booking playbook for the shared scheduling contract, the appointment reminder template for one reminder record, and the human-handoff guide for escalation design.

Evidence boundary. This draft claims no Easy AI healthcare feature, integration, medical result, appointment uplift, privacy compliance, or suitability for a jurisdiction. WHO and HHS sources support governance and communication boundaries; the clinic remains responsible for clinical, legal, security, procurement, and local implementation review.