Implementation Guide | Healthcare
Governing AI Agents That Handle Prescription Refill Requests in the Patient Portal
Treat refill handling as a governed agent workflow, not a chatbot feature. Let the agent structure, verify, and route requests, and reserve approval and prescribing decisions for clinicians. Enforce that boundary at runtime with a distinct agent identity, least-privilege permissions per stage, allowlisted and parameter-validated tool calls, defined escalation triggers, and an audit record of every action.
Define the boundary before choosing the architecture
Refill handling is a governed agent workflow, not a chatbot feature. The agent structures, verifies, and routes requests. Approval and prescribing decisions are reserved for clinicians.
| Agent | Clinician |
|---|---|
| Structure, verify, and route requests | Approval decisions |
| Read the medication list and compare against protocol | Prescribing decisions |
| Send templated or reviewed patient messages and internal queue messages | Any function that creates or modifies a prescription |
| Write a reviewable record of every action taken | Final decision on escalated requests |
Enforce policy at runtime, not in the prompt
Enforce the boundary at runtime with the following controls:
- A distinct agent identity
- Least-privilege permissions per stage
- Allowlisted and parameter-validated tool calls
- Defined escalation triggers
- An audit record of every action
Refill agent control points
Specify controls stage by stage. Each stage of the workflow has its own purpose and its own set of permissions.
| Stage | Control objective |
|---|---|
| Request intake | Structure the request and reject malformed input. |
| Identity and patient verification | Act only on authenticated, correctly matched requests. |
| Medication and protocol checks | Read the medication list and compare against protocol. |
| Routing or escalation | Send to the right clinician queue with context. |
| Documentation | Write a reviewable record of every action taken. |
Map integrations and permissions to the minimum necessary
The agent typically touches three surfaces: the EHR medication list, pharmacy systems, and messaging tools. Specific interfaces and scopes depend on your vendors and should be validated against their primary documentation. The principle is to grant each surface only what the current stage requires.
| Surface | Guidance |
|---|---|
| Agent identity | Give the refill agent its own identity, separate from any clinician or shared service account, so every action is attributable to it and its access can be revoked independently. |
| EHR access | Scope to the authenticated patient's medication list and the fields the protocol check needs. Avoid broad chart read access, and grant no write access to orders or prescriptions. |
| Pharmacy and e-prescribing | Limit to read-oriented or status functions where possible. Any function that creates or modifies a prescription belongs to the clinician workflow, not the agent. |
| Messaging | Allow the agent to send templated or reviewed patient messages and internal queue messages. Restrict recipients to the requesting patient and designated clinical queues. |
| Least-privilege review | Have privacy and security reviewers confirm each scope against the minimum-necessary goal, and re-review when integrations or protocols change. |
Audit evidence for clinical, privacy, and security review
The audit record for each refill request should capture:
- Agent identity, version, and the policy set in force at the time of the action
- Requesting session, verification outcome, and the patient the request was matched to
- Every tool call with parameters, result, and the allow or deny decision
- Protocol criteria evaluated and the data read to evaluate them
- Escalation trigger, destination queue, and the clinician who made the final decision
- Messages sent to the patient, with timestamps and template or content reference
Put runtime enforcement behind your refill boundary
Discuss how agent identity, least-privilege permissions, tool approval workflows, and audit logging fit into your patient portal architecture.
Talk to an Expert