Can you just let AI handle your patient portal inbox while you grab a coffee?
Short answer: No.
Long answer: It depends entirely on what you mean by "let." If you mean using AI as a drafting assistant to speed up your workflow while you maintain final clinical control, absolutely. If you mean setting it to autopilot and blindly clicking "send" on whatever the algorithm spits out, you are asking for trouble.
There is a massive difference between low-risk drafting support and high-risk fully autonomous sending. AI can absolutely help you clear the inbox backlog. But it only works if you review, edit, and control the final message. You are the clinician. The AI is just a very fast, occasionally hallucinating medical scribe.
Please note that the following information is for educational purposes only. It is not financial advice, not legal advice, and not tax advice. Because specific institutional policies and figures vary, you should always consult a qualified professional before implementing new technologies in your practice.
Let's clear up the confusion right now. I've seen too many clinicians treat large language models like magic wands. They aren't. They are prediction engines.
Myth: AI can send routine replies with zero supervision. Reality: It can hallucinate, oversimplify, or completely miss clinical nuance. I've seen AI confidently tell a patient to stop taking a medication because it misinterpreted a typo in the chart.
Myth: Templated portal answers are always low risk. Reality: Even simple responses become unsafe if symptoms, medications, or red flags are buried in the patient's message. A "routine" refill request might include a passing comment about new-onset chest pain. AI might just process the refill and ignore the chest pain.
Here is where AI actually shines. It is brilliant at drafting language, summarizing dense chart context, translating medical jargon into plain English, and fixing your tone when you're tired and cranky at 4:00 PM.
Here is where AI should never be used alone: diagnosis, medication changes, triage, abnormal results interpretation, and urgent symptom management.
What Are the Real Risks: Privacy, Liability, and Clinical Safety
If you think the only risk of using AI is that it might sound a bit robotic, you're missing the bigger picture. The risks fall into four distinct buckets, and they are all serious.
1. Privacy Risk If you are copying and pasting patient data into a public, consumer-grade AI tool, you are violating HIPAA. Period. Patient data may be exposed, stored, or used to train future models if the tool is not explicitly approved, secure, and contractually covered for healthcare use (like a BAA-covered enterprise version).
2. Clinical Safety Risk Inaccurate wording can delay care, minimize symptoms, or create false reassurance. If the AI drafts a message saying, "Your mild shortness of breath is likely just allergies, keep taking your antihistamine," and the patient actually has a pulmonary embolism, that automated draft just caused a sentinel event.
3. Liability Risk This is the one that keeps risk managers awake at night. The clinician and the organization remain entirely responsible for the message, even if AI helped draft it. If the AI tells a patient their chest pain is just heartburn and they code in the parking lot, the AI doesn't get sued. You do. AI does not shift accountability.
4. Operational Risk Overreliance reduces professional judgment. When you get used to just clicking "approve" on AI drafts, your brain stops actively reading the chart. You create inconsistent communication standards and lose the human touch that builds patient trust.
You must rely on organizational policy, strict documentation rules, and approved AI governance. If your hospital hasn't given you a sanctioned tool, don't use one.
How to Use AI Drafting Safely: A Practical Workflow
So, how do you actually use this technology without getting fired or sued? You build a rigid workflow and you stick to it.
Step 1: Use approved, secure environments only. Never copy PHI into a public browser window. Use only the AI tools integrated directly into your EHR or explicitly approved by your IT and compliance teams.
Step 2: Start with a controlled prompt. Don't just ask the AI to "reply to this." Limit the scope. Use prompts like: "Draft a brief, empathetic reply to this patient. Acknowledge their frustration about the wait time, confirm their appointment is still scheduled for Thursday at 2 PM, and remind them to fast for 8 hours prior. Do not offer any medical advice."
Step 3: Review the draft ruthlessly. Read it for accuracy, patient-specific details, empathy, and completeness. Does it sound like you? Is it clinically sound?
Step 4: Run your mental checklist. Before you hit send, verify these four things:
- Facts: Are the dates, times, medication names, and dosages 100% correct?
- Red Flags: Did the AI miss any urgent symptoms buried in the patient's message?
- Unsupported Claims: Did the AI invent a medical explanation or promise a specific outcome? Delete it.
- Next Steps: Is it crystal clear what the patient needs to do next?
Step 5: Escalate when necessary. If the question is complex, urgent, highly emotional, or legally sensitive, ditch the AI draft. Write it yourself. A grieving family member or a patient reporting suicidal ideation needs a human, not a language model.
Bottom Line: When AI Helps, When It Hurts, and What to Do Next
Here is the decision framework: AI is a drafting assistant, not a substitute for clinical judgment.
The practical rule of thumb is simple. AI is safe for simple, non-clinical administrative tasks, provided you still review the output. It is incredibly risky for anything involving clinical assessment, triage, or care decisions.
Your immediate next steps:
- Check your institutional policy. Find out exactly which AI tools are approved for patient communication.
- Audit your current workflow. If you are using consumer AI for portal messages, stop immediately.
- Establish documentation standards. Ensure your EHR is configured to log when an AI draft was used and modified, maintaining a clear legal record of your oversight.
Use the tool to buy back your time. Just don't let it buy you a malpractice claim.
