Healthcare
A routine request can expose private care.
An unsupervised agent can reveal sensitive health information while trying to help. Pretxt helps your team support patients without letting a routine request cross a privacy boundary.
The standard: HIPAA’s Privacy Rule
A covered healthcare provider generally needs patient authorization to share health information with an employer, unless another legal basis permits or requires the disclosure. An employer’s request alone isn’t permission.
HHS: Employer requests for health informationEmployer’s request to a clinic
“Can you confirm Alex’s appointment and tell us what it’s for? We need it for leave paperwork.”
Disclosure permission in this example
No patient authorization or other permitted basis to share with this employer.
Without supervision Proposed reply, not sent
“Alex has an appointment for depression treatment on Thursday.”
Pretxt intervention
“HIPAA disclosure permission is missing. Don’t confirm the appointment or share health details. Explain the approved request process.”
Agent’s revised reply
“I can explain our records request process, but I can’t confirm or share patient information without appropriate permission.”
The patient’s health details were not disclosed.
Good supervision keeps learning
Recognize the disclosure inside the request.
Turn everyday requests into clearer privacy guidance for the next interaction.
-
Notice a pattern
Requests for “just a confirmation” can still reveal that someone is receiving care.
-
Refine the guidance
Check permission before confirming attendance as well as sharing a diagnosis. Offer the approved request process.
Your team reviews, tests, and approves -
Help the next person
“Even an attendance confirmation needs appropriate permission. I can explain how to request verification.”
Example after approval
The realities of healthcare
The details matter to the person receiving care.
Patient access, referral coordination, prior authorization, and follow-up each come with different expectations. Bring those distinctions into supervision, so helpful support stays connected to the care your team provides.
Preserve the clinical meaning.
ICD-10-CM classifies diagnoses. SNOMED CT represents clinical concepts in electronic health records. An agent explaining a visit summary needs to preserve what was documented, rather than turn a code or clinical term into a new diagnosis.
Handle patient information with care.
The HIPAA Privacy Rule governs protected health information (PHI) held by covered entities and their business associates. Shape agent guidance around permitted uses, the person’s role, and minimum-necessary requirements where they apply. The minimum-necessary standard has exceptions, including disclosures between providers for treatment.
Keep clinical judgment with the care team.
A medication question, a change in symptoms, or uncertainty about discharge instructions calls for a different response from a scheduling request. Set clear expectations for what an agent can explain and when it should bring the patient back to a clinician.
What could better patient support make possible?
Let’s talk about the work your agent can help with and the moments your care team needs to own.