Patient intake compliance: what to capture, what to never capture pre-consult · NeuraVoice

A patient calls a primary-care clinic at 7 p.m. The clinic's AI voice agent answers, takes the caller's name, and then asks: "Can you read me your current medication list, including dosages?"

The caller, trying to be helpful, lists six prescriptions. The agent transcribes them, stores the transcript in a vendor system that has a Business Associate Agreement covering scheduling but not clinical content, and emails a summary to the front desk inbox. The front desk reads it the next morning and pastes the medication list into Epic.

Wrong question. Wrong stage. Wrong storage path. The clinic just generated a new clinical record outside its EHR, captured by a non-credentialed agent, transmitted through a vendor whose BAA scope may not cover what was just collected. The patient was trying to schedule an annual physical.

This is the most-violated rule in AI patient intake. Pre-consult intake is scheduling. It is not diagnosis, not triage, and not history-taking. The line is enforced by the HIPAA "minimum necessary" standard, and most clinic operators do not draw it cleanly when they configure a voice agent.

This post is a working overview register, not legal advice. Run any specific intake schema by your privacy officer and counsel before deploying.

Minimum necessary is the rule, not a guideline

The HIPAA Privacy Rule requires that covered entities make reasonable efforts to use, disclose, and request only the minimum amount of protected health information necessary to accomplish a given purpose (45 CFR 164.502(b), 164.514(d)). The standard applies to internal use, not just external disclosure. A clinic asking its own AI agent to capture more PHI than the appointment booking purpose requires is, on its face, a minimum-necessary problem.

The relevant purpose at the pre-consult stage is scheduling. The information necessary to schedule an appointment is narrow. The information that would be useful to a clinician during the visit is broad. Those are two different purposes, captured at two different stages, with two different sets of safeguards.

A pre-consult AI agent that asks for a medication list is not violating HIPAA because it captured the list. It is creating a problem because it captured the list for a purpose (scheduling) that did not require it.

What to capture pre-consult: the scheduling schema

For a routine new-patient or established-patient appointment, the scheduling-purpose schema is short:

Full legal name and preferred name
Date of birth (used for identity matching, not clinical assessment)
Phone number and a backup contact channel
Mailing address if the practice requires it for billing
Insurance carrier, plan name, member ID, group number
Reason for visit at the chief-complaint level (one phrase, in the patient's words)
Preferred provider, if the patient has one
Scheduling preferences: window, location, telehealth versus in-person
Confirmation of new versus established patient
Consent to receive appointment reminders by SMS or voice

That is the schema. It is enough to book the appointment, verify eligibility, and route the patient to the correct provider. It is not enough to start a clinical record.

"Reason for visit at the chief-complaint level" deserves a specific note. The right capture is the patient's own short phrase: "annual physical," "follow-up on knee pain," "rash on arm." The wrong capture is a structured symptom interview: when did the rash start, is it itchy, have you tried any creams, is there fever. The first is a routing tag. The second is a clinical history.

What to never capture pre-consult

If the appointment is a routine office visit, the AI agent should not ask for, and should not voluntarily transcribe if the patient offers:

Current medications, dosages, or frequencies
Prior or active diagnoses and conditions
Symptom details beyond the chief complaint phrase
Family medical history
Lab values, imaging results, or prior test outcomes
Mental health history or current mental health status
Substance use history
Reproductive health details
Sexual health details
HIV or other infectious disease status

Two reasons this list matters.

First, the moment an AI agent transcribes "patient reports daily 20 mg sertraline and was diagnosed with major depressive disorder in 2024," the clinic has a clinical record sitting outside the EHR, generated by a non-credentialed system, possibly stored by a vendor whose BAA may or may not cover that category of content. Some BAAs explicitly carve out psychotherapy notes and behavioral health records. Some vendors will not sign a BAA at all that covers substance use treatment information governed by 42 CFR Part 2.

Second, any clinical information captured pre-consult will need to be re-captured during the consult, because the clinician cannot rely on a non-credentialed agent's transcription as the basis for medical decisions. Capturing it twice is not "thorough." It is duplicate effort that introduces transcription error and creates an extra PHI record to manage.

If the patient volunteers clinical detail unprompted, the right agent behavior is to acknowledge briefly ("got it, you can share that with the doctor at your visit") and not transcribe the detail into the appointment note.

The triage call exception

Some clinical workflows require pre-consult clinical capture. After-hours nurse advice lines, urgent care intake, and behavioral health crisis lines all need symptom information before the call ends, because the disposition decision (come in now, go to ER, schedule for tomorrow, self-care at home) depends on clinical content.

Triage is a different product, with a different schema, different vendor architecture, and different supervisory requirements. A triage AI typically operates under direct nurse or physician supervision, with stricter audit logging, narrower vendor BAA scope, and often a different recording-and-retention policy. Some states require a licensed clinician to make or review every disposition decision regardless of who took the initial call.

If your practice mixes appointment scheduling and triage on the same phone line, the AI agent needs an early branch: classify the call intent, route triage callers to a separate flow with a separate schema, and keep the scheduling flow narrow. Vendors that offer "one prompt for everything" are quietly mixing two products with two compliance profiles.

New patient versus established patient flows

For an established patient, the clinic already has the demographic record, the active insurance on file, and the chart. The right AI agent behavior is lookup, not re-capture. Verify the caller against the existing record using two identifiers (name plus DOB, or name plus phone number plus DOB), confirm anything that may have changed (insurance, address, preferred contact), and book the appointment.

For a new patient, the agent does need to capture the scheduling schema from scratch. Even then, the agent should not collect intake-form content that the clinic typically gathers via portal or paper before the visit. New-patient registration forms include medical history, surgical history, allergies, current medications, and consent signatures. None of that belongs on the scheduling call. Send the registration link by SMS or email at the end of the call, with the appointment confirmation.

This split also matters for EHR integration. Pushing scheduling data into Epic, Cerner, athenahealth, or eClinicalWorks is well-defined: appointment slot, provider, location, reason code. Pushing clinical data captured by a non-credentialed agent into the same EHR fields is a different conversation. Most EHRs distinguish "scheduling" tabs from "clinical documentation" tabs precisely because the audit trail and credentialing requirements are not the same.

State-specific add-ons most schemas ignore

Federal HIPAA is the floor. Several states have stricter rules for specific PHI categories, and a generic intake schema written against HIPAA alone will miss them.

California's CMIA imposes additional restrictions on disclosure of medical information beyond HIPAA. New York's Mental Hygiene Law and Public Health Law impose enhanced confidentiality on mental health and HIV-related information. Texas, Illinois, and Washington each have their own augmenting statutes. 42 CFR Part 2 federally protects substance use disorder treatment records with stricter consent requirements than general HIPAA.

A pre-consult AI agent should not ask about mental health, substance use, HIV status, or reproductive health regardless of state. The state-specific rules become relevant when the patient volunteers that information or when the practice operates a specialty line (behavioral health, addiction medicine, sexual health) where the schema is different from general practice and the consent-to-record language must be specific.

If your clinic operates across multiple states, the schema should be the strictest of the applicable jurisdictions, not a per-state branching tree. Branching by state at the AI layer is a configuration mistake that produces inconsistent capture across the same practice.

Five vendor-evaluation questions for patient intake compliance

Most clinic operators evaluate AI voice vendors on accent quality, latency, and EHR integration. None of those measure whether the vendor will keep the practice on the right side of minimum-necessary.

These five questions sort the vendors that have thought about it from the ones that have not:

Will you sign a BAA, and what categories of PHI does it cover? Ask specifically about psychotherapy notes, substance use treatment records, and behavioral health content. A BAA that excludes those is fine for scheduling but disqualifying for triage.
Where are call recordings and transcripts stored, for how long, and who has access? Pre-consult intake should generate the smallest possible PHI footprint, with retention measured in days for the recording and only the structured scheduling fields persisting long-term.
Can you configure the agent to refuse to transcribe categories of unsolicited clinical detail? If the patient starts listing medications, the agent should redirect rather than capture. Vendors that auto-transcribe everything are creating PHI you did not ask for.
What is the data path from the agent to our EHR? Direct integration into a scheduling tab is fine. A staff member copy-pasting a clinical summary email into the chart is not the same thing, and it creates an interim record on the email server that needs its own safeguards.
How do you handle calls that should have routed to triage? A patient who calls to schedule and reveals they are having chest pain is a routing problem. The agent's behavior in that moment, and the audit trail it produces, matters more than its behavior on the routine 95% of calls.

The contrarian close

The instinct, when buying an AI voice agent, is to capture more. More fields, more detail, more pre-population of the chart, less work for the front desk. Vendors sell that pitch because it sounds like value.

Capturing more pre-consult is the wrong direction. The right direction is capturing exactly the scheduling schema, refusing the rest, and pushing clinical capture into the consult itself where a credentialed clinician documents it under proper supervision and into the right EHR fields with the right audit trail. A narrow agent is a compliant agent. A "thorough" agent is a liability waiting to be discovered during the next OCR audit or breach investigation.

The clinics that get this right treat their AI intake the way a well-trained front-desk receptionist works: warm, efficient, and silent on anything clinical until the patient is in the exam room.

If you operate a clinic and want help mapping your intake schema against minimum-necessary before turning the agent on, book a call with our team, start a free trial, or review the pricing page.