Conversational AI in Healthcare: What UK Providers Should Know

Where does conversational AI fit in healthcare?

Healthcare providers spend a large share of front-desk time on conversations that are important but not clinical: booking and moving appointments, explaining where to go, answering questions about fees or registration, and passing messages to the right person. Those are the conversations conversational AI can help with, by phone, chat or messaging, including out of hours. For a primer on the technology itself, see what conversational AI is.

The line that matters most is between administration and clinical judgement. An AI assistant can book an appointment with a clinician. It must not decide what is wrong with someone, whether they need treatment or how urgent it is.

Which conversations are suitable for AI?

The right-hand column is not a list of things AI is bad at. It is a list of things where a wrong answer could harm someone, and where responsibility belongs with a qualified person.

How should an AI assistant handle anything clinical?

It should recognise clinical content and step aside, every time. In practice that means:

• Saying clearly at the start that it is an AI assistant that handles bookings and general questions, and cannot give medical advice.
• Not asking about symptoms, and not interpreting them if a patient volunteers them.
• Directing anyone who describes an emergency to call 999, and signposting urgent but non-emergency needs to NHS 111 or the practice's own urgent route.
• Passing anything clinical to the right member of staff, with the message captured accurately.
• Being tested specifically on clinical-sounding questions before launch, not just on the easy ones.

This matters for regulation as well as safety. The MHRA's guidance on software and AI as a medical device explains when software crosses into being a medical device. Its guidance on apps treats symptom checkers that suggest likely conditions or treatment as likely to be devices, while tools that only signpost people to appropriate care are unlikely to be. An administrative assistant should stay firmly on the signposting side.

How does UK GDPR treat patient data?

Health data is special category data under UK GDPR, as the ICO explains in its guidance on what special category data is. Processing it needs a lawful basis and an additional condition under Article 9, and it calls for more care at every step. Even a booking conversation can reveal health information, simply from which clinic or clinician someone asks for.

For a conversational system, that translates into design decisions:

• Collect only what the task needs; a booking rarely needs the reason for the visit.
• Agree data processing terms with every provider involved, including the model, hosting and telephony.
• Know where data is processed and stored, and whether any provider can use it for training.
• Set retention periods for transcripts and recordings, and delete on schedule.
• Carry out a data protection impact assessment before launch.
• Update your privacy notice to describe the assistant.

We build systems to support UK GDPR requirements, but compliance rests with the healthcare provider that deploys and runs them.

Do NHS clinical safety standards apply?

In England, two clinical risk management standards are published under section 250 of the Health and Social Care Act 2012: DCB0129, for organisations that develop and maintain health IT systems, and DCB0160, for health organisations that deploy and use them. Both require a documented clinical risk management process, a clinical safety officer and a hazard log.

If a conversational system is used in NHS-funded care, expect both to apply: the supplier works to DCB0129 and the deploying organisation to DCB0160. NHS buyers also commonly use the Digital Technology Assessment Criteria (DTAC), which cover clinical safety, data protection, technical security, interoperability, and usability and accessibility.

For purely private clinics, whether the standards formally apply is less clear-cut, and you should take advice for your own situation. Either way, the discipline they describe, identifying what could go wrong for patients and controlling it, is good practice for any patient-facing system. Ask any supplier how they approach clinical risk.

How does this differ for NHS and private providers?

NHS practices and trusts work within NHS procurement, information governance and clinical safety requirements, and often existing telephony and booking systems that limit what can be integrated. Changes usually need sign-off from information governance and a clinical safety officer.

Private clinics, such as dental, physiotherapy, aesthetics and private GP practices, typically have more freedom to adopt a booking assistant quickly, and more of their enquiries are about fees, availability and treatments offered. The data protection obligations are the same, and the clinical line is the same.

Dental practices are one of the most common starting points, because so many calls are about appointments and fees. We build an AI receptionist for dental practices on exactly those principles, and our healthcare software work covers wider systems.

Where should a healthcare provider start?

1. Pick an administrative job with high volume, such as out-of-hours booking requests.
2. Write down the clinical boundary and the escalation routes before anything is built.
3. Complete the data protection impact assessment and, where relevant, the clinical safety documentation.
4. Test with realistic patient questions, including clinical ones the assistant must refuse.
5. Launch in a limited way and review conversations closely for the first weeks.

An AI receptionist that handles bookings well and hands everything else to your team is far more valuable than an ambitious system nobody trusts. For more on the dental and medical front desk, see a chatbot for a practice.