AI AgentPatient Appointment Scheduling
Agent that verifies identity and eligibility, proposes clinically appropriate slots, holds one for a human scheduler to confirm and drafts consented reminders
The challenge
Booking lines open at eight and are engaged until ten. Patients who cannot get through stop trying, and the ones who do get through are asked their date of birth by a scheduler who has no way to confirm the person on the line is who they say they are. Referrals expire unnoticed in a queue, interpreters and accessible rooms are discovered at the appointment rather than booked with it, and self-service portals cheerfully offer a routine slot in six weeks to someone describing chest pain. Empty chairs and missed emergencies come from the same place: a booking process that cannot tell one caller from another.
The outcome
A deterministic agent verifies who is asking before anything about a patient is disclosed, checks the referral, coverage and consent behind the request, and proposes slots that are actually appropriate — right clinician, right modality, enough lead time, interpreter and access needs carried through. Anything that reads like a clinical emergency, a self-harm disclosure or a safeguarding concern is taken out of the booking path immediately and handed to a named clinician. The agent holds a slot; a person confirms it.
01 — Architecture
End-to-end architecture
Requests arrive by phone, portal or referral letter and are extracted into structured data. The Foundry agent verifies identity, resolves the referral, coverage and consent behind the request, evaluates slot suitability in deterministic code, and then either proposes a reversible hold or routes the case to the right human queue — clinical, safeguarding, registration, authorisation or scheduling.
- Patient & referrer: Patient / GP referral
- Intake: Azure Logic Apps, Azure Blob Storage
- Extraction: Azure API Management, AI Document Intelligence, Azure Functions
- AI & safety: Microsoft Foundry Agent, Azure OpenAI models, Azure AI Search
- Clinical systems: PAS / EHR, Azure Cosmos DB, Azure Key Vault
- People & insight: Duty clinician, Scheduler & registration, Power BI / Fabric
02 — Workflow
Process & decision workflow
How a request is received, screened, verified, assessed and routed. The clinical screen runs first and outranks everything except an unreadable request: if somebody describes an emergency and cannot prove who they are, the answer is a clinician, not a better password.
- Receive: Request arrives by phone, portal or referral letter
- Screen: Red-flag, self-harm and safeguarding screen runs before anything else
- Extract: Referral fields and urgency read; injected instructions treated as data
- Verify: Identity established before any patient detail is disclosed
- Assess: Referral, coverage, consent and slot suitability evaluated deterministically
- Route: Case sent to the queue that owns it, or a slot held for confirmation
- Path 1 · routine booking — Propose a reversible slot hold: Verified patient, valid referral, suitable slot — a scheduler still confirms
- Path 2 · red flag or exception — Handover to a named human queue: Clinician, safeguarding lead, registration, authorisation or scheduler
03 — Components
Key Microsoft components
Scheduling patients needs accurate extraction, verifiable identity, deterministic safety rules and an audit trail that stands up to a clinical governance review — all on the Microsoft stack.
Azure Logic AppsReferral inbox, portal event and telephony hand-off watchers.
Azure Blob StorageReferral letters and supporting documents, encrypted and access-logged.
Azure AI Document IntelligenceReferral field, speciality and stated-urgency extraction into structured JSON.
Microsoft Foundry Agent ServiceVerification, assessment and routing orchestration with tools.
Azure OpenAI modelsDrafts the case summary. It does not make the safety decision.
Azure AI SearchGrounded retrieval across scheduling policy, pathways and preparation rules.
Azure FunctionsNormalisation, slot suitability scoring and queue routing.
Azure API ManagementSecure gateway for PAS, EHR, referral and slot-pool APIs.
Azure SQLAppointment, referral and attendance history.
Azure Cosmos DBCase state, retries and per-case audit history.
Azure Key VaultPAS and referral repository credentials and integration secrets.
Azure Communication ServicesConsented appointment reminders, sent by the provider rather than the agent.
Azure Container AppsContainerised extraction and assessment workers.
Power BI / Microsoft FabricAccess, waiting time, DNA and capacity dashboards.
04 — AI
What the agent consumes
The capabilities the agent applies to every scheduling request, and the line it does not cross.
AI capabilities embedded in the agent
- OCR
- Referral field extraction
- Stated-urgency classification
- Clinical red-flag screening
- Self-harm and safeguarding detection
- Identity assurance assessment
- Referral validity and expiry checking
- Coverage and prior-authorisation checking
- Consent state evaluation
- Slot suitability and lead-time scoring
- Interpreter and accessibility matching
- Attendance risk banding
- Duplicate appointment detection
- Prompt-injection screening
AI responsibility boundaries
The agent does not perform clinical triage and must never be described as doing so. It screens for words that may indicate an emergency and hands the case to a clinician — the decision stays with the clinician, and a clear screen is not a clinical opinion that nothing is wrong. It cannot book, cancel, reschedule, confirm or send: of its fourteen tools exactly three write anything, and the strongest is a slot hold that is reversible and expires. Nothing about a patient is disclosed until identity is established, and the words a person uses to describe a symptom or a disclosure never enter a work queue, a log line or a telemetry span — only the category does. Every assessment records the rule, prompt and red-flag list versions that produced it.
05 — Personalization
Personalization & evolving process
The same methodology applies to every agent in the catalog. Tune the service profile, the workflow, the clinical thresholds and the value model — the page structure stays identical.
Service & document profile
Define the specialities, appointment types and sites in scope, the patient administration system and referral repository, the interpreter and accessibility provisions available, and the languages patients actually contact you in. The personas are the patient, the scheduler, the registration clerk, the duty clinician and the safeguarding lead.
Workflow template
One consistent flow for every scheduling agent: receive, screen, extract, verify, assess, route, review, hold, confirm and remind — with a named human queue behind every branch.
Rules & clinical thresholds
Configure the red-flag term list under clinical governance, the identity assurance required before disclosure, minimum lead times and preparation windows by appointment type, referral validity periods, and attendance risk bands. The red-flag list is a clinical safety artefact: it is versioned, reviewed by a clinician rather than an engineer, and every change ships with the inflected forms patients actually use.
Value model
Capture baseline metrics first, then map the expected benefits: time to first offered appointment, call abandonment, did-not-attend rate, referrals expiring unbooked, interpreter and access needs met at first attempt, and the proportion of emergencies identified at first contact.
06 — Impact
Key outcomes & business impact
Starting targets for the value case — validate each one against the customer baseline during discovery, under the provider’s own clinical governance.
- Time to first offerSame dayRoutine, fully verified requests are offered a suitable slot without waiting for a callback.
- Call abandonment−50%Routine booking leaves the phone queue, so the queue is shorter for those who need it.
- Did-not-attend rate−25%Suitable slots and consented reminders, with attendance risk shown to a person rather than acted on.
- Audit readiness100%Every assessment stores the evidence, the reviewer and the rule and red-flag list versions applied.
Illustrative improvement index
Manual baseline = 100. Illustrative targets, not a commitment and not a clinical safety case — confirm against the customer baseline.
- Time to first offer: manual baseline 100, AI-assisted target 30
- Call abandonment: manual baseline 100, AI-assisted target 50
- Did-not-attend rate: manual baseline 100, AI-assisted target 75
07 — Deployment
Deploy this agent
Verifies identity, consent, referral and coverage, proposes safe slot holds for schedulers, and escalates clinical red flags without exposing PHI/PII. This agent ships as a versioned, evaluated package: 9 Azure resources described in Bicep, 14 scoped tools, and a blocking evaluation gate that must pass before it is considered ready.
- Package version1.0.0foundation maturity, hosted agent on Microsoft Agent Framework, probed on port 8088.
- Azure resources9Provisioned from Bicep in roughly 25 minutes, excluding model capacity approval.
- Evaluation cases5511 evaluators run as a blocking gate on every change.
- Review triggers1711 of them stop the agent and hand the case to a person.
What gets provisioned
Every resource below is declared in the agent's Bicep templates and deployed with a user-assigned managed identity. No key or connection string is stored in the package.
- Microsoft Foundry account and projectHosts the agent, model deployments, hosted container and managed identity.Microsoft.CognitiveServices/accounts
- Azure AI Document IntelligenceLayout, table and field extraction from referral letters, insurance cards and identity documents. Reads administrative evidence only.Microsoft.CognitiveServices/accounts
- Azure StorageScheduling intake artefacts and immutable structured assessments for audit.Microsoft.Storage/storageAccounts
- Azure Key VaultHolds legacy PAS, EHR or payer credentials that cannot use managed identity.Microsoft.KeyVault/vaults
- Application Insights and Log AnalyticsTraces, metrics and audit diagnostics with PHI/PII redaction and message content capture disabled.Microsoft.Insights/components
Optional: Azure AI Search.
Deployment parameters
Collected before provisioning and validated against the manifest. Credentials are never parameters: the agent resolves them through managed identity, or by Key Vault secret name.
Identity
- Tenant identifierrequiredPHI/PII isolation boundary. Every backend port receives it explicitly.
- Require strong identitytrueRequires a strong factor before patient-specific detail is disclosed. Disabling it is a deliberate privacy-risk decision.
Infrastructure
- Azure regionuaenorthRegion for the Foundry project and supporting resources.
- Environmentdev
Model
- Document understanding model deploymentgpt-5.4-mini
- Scheduler summary model deploymentgpt-5.4
Thresholds
- Extraction confidence floor0.7Below this score a person re-keys or verifies extracted fields.
- Assessment confidence floor0.7
- Slot-hold recommendation floor0.85Extraction and assessment confidence must both reach this before a clean case can recommend a reversible slot hold.
Attendance
- Elevated non-attendance threshold0.35Advisory band only. The agent never denies, deprioritises, overbooks, charges or withholds a slot because of this score.
- High non-attendance threshold0.6
- Repeat non-attendance count3Count that makes repeated non-attendance a support prompt.
- Non-attendance lookback window365
Reminders
- Reminder offsets in hours168,48,24Comma-separated reminder offsets before the held slot.
- Enabled contact channelssms,email,portalComma-separated deployment channels, intersected with per-patient consent.
- Minimal content on low-assurance channelstrueSMS, voice and postal reminders omit the appointment type by default.
Locale
- Dates are day-firsttrueResolves ambiguous numeric dates such as 03/04/2026.
- Clinic timezoneAsia/DubaiIANA timezone used for slot comparisons and patient-facing times.
Scheduling
- Booking horizon180Requests beyond this horizon are waiting-list cases owned by a person.
- Minimum appointment lead time2Minimum notice for ordinary appointments.
- Slot hold duration30Expiry for a reversible slot hold. A hold is not a booking.
- Older adult prompt threshold75Age at which access, transport and support prompts are surfaced.
- Maximum proposed slots3Maximum ranked candidate slots shown to a human scheduler.
- Appointment type cataloguenew_patient_consultation,follow_up,routine_screening,vaccination,diagnostic_imaging,phlebotomy,physiotherapy,telehealth_consultation,procedureComma-separated appointment types the agent recognises. Unmapped types are surfaced for human classification, never coerced to a nearby entry.
- Human-only appointment typesprocedure,diagnostic_imagingTypes that can never reach a slot-hold recommendation without review.
- Allow reversible slot-hold recommendationtrueSet false to prevent even expiring holds. Confirming an appointment is never available either way.
Authorisation
- Minor age threshold18Patients younger than this require guardian authority review.
Referrals
- Referral validity window90Referrals without explicit expiry are treated as stale after this many days.
- Referral-required appointment typesnew_patient_consultation,diagnostic_imaging,physiotherapy,procedureTypes requiring a valid referral before a slot recommendation.
Coverage
- Coverage expiry notice window30Coverage expiring inside this window is surfaced for a person to check.
Integrations
- PAS/EHR credential secret namerequiredKey Vault secret NAME holding the PAS, EHR or payer credential, used only when the integration cannot authenticate with managed identity. The secret value is never collected here and never appears in a manifest or a deployment log.
Deployment lifecycle
A deployment moves through an explicit state machine. Illegal transitions are rejected, so a deployment record can never sit in an undefined position — and a failure is always either retried or torn down, never abandoned.
- 01 Requested
- 02 Validating request
- 03 Waiting for configuration
- 04 Provisioning Azure resources
- 05 Configuring Foundry project
- 06 Deploying agent
- 07 Connecting tools
- 08 Connecting knowledge
- 09 Running deployment validation
- 10 Running evaluation gate
- 11 Ready
- 12 Degraded
- 13 Failed
- 14 Updating
- 15 Decommissioning
- 16 Decommissioned
Tools and their blast radius
14 tools across 1 toolbox. 3 can write, and every write is scoped, audited and reversible.
- find_patient
- get_patient
- get_consents
- get_attendance_history
- find_slots
- get_location
- get_appointments
- get_coverage
- get_referral
- find_referrals
- check_red_flags
- hold_slot · write
- create_review_task · write
- draft_patient_message · write
What this agent will never do on its own
- Booking, confirming, cancelling or rescheduling an appointment without human confirmation
- Giving clinical advice, reassurance, diagnosis, risk assessment or triage decisions to a patient
- Disclosing patient details, appointment details, identifiers, contact details or coverage details to an unverified caller
- Overriding, downgrading or ignoring a clinician's decision, referral urgency or safeguarding instruction
- Sending, releasing or marking as sent any patient message or reminder
- Recording, changing, withdrawing or inferring patient consent
- Creating, amending, merging or deleting a patient record
- Reading, summarising, copying or writing clinical notes as a clinical record
- Deciding a patient should not be seen because cover is inactive or unknown
- Denying, deprioritising, overbooking, charging, penalising or withholding a slot based on non-attendance risk
- Converting an expiring slot hold into a booking or extending a hold indefinitely
- Changing payer coverage, prior-authorisation status or referral metadata
- Requesting, storing or disclosing data belonging to another tenant
Evidence before it ships
The evaluation gate is blocking: a regression on any evaluator stops the release rather than documenting it.
- golden-scheduling23 casesRepresentative scheduling cases with expected routing and review decisions, including clean slot holds, missing information, identity and consent holds, referral and coverage problems, access needs, duplicate appointments and tool-failure paths.
- adversarial-scheduling32 casesPrompt injection in submitted content, clinical red-flag and safeguarding presentations, authority-boundary probes, clinical text containment, identifier containment and benign controls that must not wake the clinical queue.
Evaluators
- routing_accuracy
- review_decision_accuracy
- finding_recall
- trigger_recall
- red_flag_recall
- red_flag_false_positive_rate
- injection_containment
- authority_boundary
- clinical_text_containment
- identifier_containment
- tool_authority_surface
Identity, isolation and network
- Agent identityuser-assigned-managed-identity. No shared keys, no embedded credentials.
- Public network accessconfigurable. Private endpoints available for Azure AI Search, Azure Storage, Azure Key Vault, Azure AI Document Intelligence.
Role assignments
- Azure AI DeveloperFoundry projectRun the hosted agent and evaluations without granting infrastructure ownership.
- Search Index Data ReaderAzure AI Search serviceRetrieve tenant-scoped administrative policy and coverage references. Read-only by design.
- Storage Blob Data ContributorScheduling intake and assessment containersRead submitted administrative documents and write immutable assessment records.
- Key Vault Secrets UserKey VaultResolve PAS, EHR and payer credentials that cannot use managed identity.
- Monitoring Metrics PublisherApplication InsightsEmit redacted traces and metrics.
What you can see once it is running
Traced with opentelemetry and exported to Application Insights. Document content and model reasoning are dropped before export — neither is ever written to a log.
- patient_scheduling.processed
- patient_scheduling.review_required_rate
- patient_scheduling.confidence.extraction
- patient_scheduling.confidence.assessment
- patient_scheduling.recommended_action
- patient_scheduling.clinical_red_flag_detected
- patient_scheduling.safeguarding_detected
- patient_scheduling.security_concern_detected
- patient_scheduling.identity_hold_rate
- patient_scheduling.consent_hold_rate
- patient_scheduling.coverage_review_rate
- patient_scheduling.referral_review_rate
- patient_scheduling.no_suitable_slot_rate
- patient_scheduling.slot_hold_recommended_rate
- patient_scheduling.slot_hold_created
- patient_scheduling.draft_message_created
- patient_scheduling.tool_failure_rate
- patient_scheduling.processing_duration_ms
Cost drivers
- Document Intelligence pages analysed
- Model inference for administrative document understanding
- Hosted-agent container compute
- Azure AI Search unit hours
- Storage retention for PHI/PII-bearing intake and immutable assessments
Supported regions
- uaenorth
- westeurope
- swedencentral
- eastus2
Getting it deployed
The package is ready to provision into a customer subscription: infrastructure as Bicep, the agent as a container image, and the evaluation gate as a pipeline step. Provisioning runs against your own tenant with your own approvals, so the last step is a conversation about region, capacity and the systems this agent will read from.
Published by Cloud Mechanics · Owner Cloud Mechanics - AI Solutions · standard support
Deploy this agentRelated & recommended
Derived automatically from our solution knowledge graph.
Related professional services
How we design, build and secure it.
ServiceAI Agent Development
AI Agent Development delivered by Cloud Mechanics certified experts.
ServiceAI Governance
AI Governance delivered by Cloud Mechanics certified experts.
ServiceAI Integration
AI Integration delivered by Cloud Mechanics certified experts.
ServiceAI Security
AI Security delivered by Cloud Mechanics certified experts.
Related quick wins
Ready-made Azure AI to start fast.
Technologies
What powers this solution.
TechnologyAzure AI Foundry
Platform to design, evaluate and operate AI apps and agents.
TechnologyAzure AI
Managed AI services for vision, speech, language and document.
TechnologyAzure Functions
Serverless compute for event-driven workloads.
TechnologyAzure OpenAI
Enterprise access to GPT models with governance.
Related managed services
Keep it running and optimised.
ManagedAI Managed Services
AI Managed Services from our UAE-based 24/7 Cloud Operations Center.
ManagedCloud Managed Services
Cloud Managed Services from our UAE-based 24/7 Cloud Operations Center.
ManagedDevOps Managed Services
DevOps Managed Services from our UAE-based 24/7 Cloud Operations Center.
ManagedFinOps / Cloud Cost Management (OpsNow)
FinOps / Cloud Cost Management (OpsNow) from our UAE-based 24/7 Cloud Operations Center.
Ready to move from challenge to solution?
Talk to a Cloud Mechanics expert or build your solution in minutes.