How should an AI patient assistant verify identity before changing an appointment?
A practical design for matching the caller, stepping up verification and handling failed checks without exposing patient information.
The short answer
An AI patient assistant should verify identity in proportion to the action requested. A caller asking for opening hours may not need an identity check. A caller asking to hear appointment details, cancel a visit or move it to another date should be matched to the correct patient record before any personal information is disclosed or changed.
The safest design uses approved record-matching questions for the first check and a stronger step when the action carries more risk. If the check fails or the patient cannot use the chosen method, the assistant should stop the transaction and offer a verified human route. It should not guess, label the caller as fraudulent or decide whether the person may receive care.
Set the check by action, not by one rule for every call
Write down every action the phone service can take and place it in a verification tier. General information such as parking or opening hours can usually remain public. Finding a record, reading a future appointment, changing a booking, disclosing a clinical message and granting access to another person do not carry the same consequence. Each needs its own approved check and failure route.
This prevents two common mistakes. A weak check can expose or alter the wrong record. An excessive check can block patients from a simple administrative service and collect more data than the purpose requires. The European Commission's GDPR guidance links data minimisation, accuracy and confidentiality to the actual purpose. The clinic should document the tiers with its privacy, security and operational owners before launch.
Match the caller without turning private facts into strong secrets
NHS England's current telephone privacy guidance gives an operational example of asking for two or three details, such as date of birth, postcode and the first line of an address. This is useful as a reference, not as a rule for every European clinic. The caller should state the details. The assistant should not reveal a value and ask for confirmation, because that may disclose information to the wrong person.
Demographic details can help match a record, but many are discoverable or shared within a household. Treat them as evidence for a defined action, not as a universal password. Limit attempts, avoid saying which answer failed and do not confirm that a patient exists in the system. The check should compare against an authoritative record rather than a separate copy maintained by the voice service.
Step up before personal disclosure or a system write
A higher-impact action may need an additional factor. Depending on the clinic's approved design, that could be a one-time code sent to a contact channel already registered in the patient system, an authenticated patient portal or a staff callback through a known number. A number supplied during the same unverified call should not silently become the trusted destination for a code or future messages.
Verification is only one part of a safe appointment change. The assistant must also select the correct appointment, submit one idempotent write and wait for the scheduling system to confirm it. If the connection times out after submission, the result remains uncertain until it is reconciled. The patient should hear an honest pending status instead of a confident confirmation that may be wrong.
Treat inbound calls, outbound calls and voicemail differently
On an inbound call, the assistant can identify the clinic and disclose that it is AI, then ask for the approved matching details before discussing the patient's record. An outbound call needs more restraint because another household member may answer. NHS England advises verifying the person before revealing the service or purpose of a healthcare call and keeping voicemail free of confidential information.
The clinic should decide what the assistant may say before verification in each campaign. A neutral request to call an official number may be appropriate where naming a specialty, test or procedure would itself reveal sensitive information. The person receiving the call also needs a way to verify the clinic, for example by ending the call and using the number published on the organisation's own website.
Give failed checks a safe and accessible route
A mismatch should stop disclosure and the requested write, but it should not become a permanent lockout or a decision about entitlement to care. Use a neutral response, cap repeated attempts and create a staff task without copying the failed answers into a broad case note. The follow-up should use a contact route already held by the clinic or direct the caller to an official channel.
Design alternatives for patients who have changed number, share a phone, cannot receive a code, have a disability or need another language. Some cases may require an in-person check or a staff member authorised to use a different procedure. If someone is calling for the patient, verification of the caller does not prove authority to act. Proxy status, consent, capacity and safeguarding questions need their own human-controlled process.
Do not use voice recognition as an easy shortcut
Recognising spoken words is not the same as creating a voiceprint to identify a person. The EDPB explains that voice used for unique identification or authentication is biometric processing and brings additional requirements. A clinic should not add speaker recognition simply because the conversation already contains audio. It needs a separate legal, privacy and security assessment, clear information and a practical alternative.
The assistant should also avoid inferring illness, emotion, reliability or capacity from the sound of a voice. Background noise, accent, speech impairment and a poor connection can affect the call without saying anything reliable about the patient. When the audio is unclear, repeat or transfer the task. Do not turn uncertainty in speech recognition into an identity or clinical judgement.
Log the outcome and test the boundary
Keep an audit event for the requested action, verification method category, pass or fail result, record identifier, write confirmation and handoff reference. Do not put full verification answers, one-time codes or unnecessary call content into the log. Access to failed checks should be limited, and retention should follow a documented purpose rather than a default chosen by the platform.
Acceptance testing should cover duplicate names, incorrect details, a changed phone number, a shared family device, a dropped call after submission, background noise, language switching and a caller acting for someone else. An authorised person must own exceptions. The AI may follow the approved check and stop safely, but it must not override a failure, decide that a caller is dishonest, grant proxy authority, reveal clinical information or make decisions about urgency and access to care.
FAQ
Are date of birth and postcode enough to change an appointment?
Not automatically. They can help match a caller to a record, but they are often discoverable and should not be treated as strong secrets. The clinic should set a proportionate check for each action and use a stronger step where disclosure or a system change creates more risk.
Can the assistant send a verification code to the number the caller gives during the call?
It should not treat a new number from an unverified call as trusted. A code should go only to a channel already registered through an approved process. Changing that trusted channel needs a separate controlled procedure or staff review.
What should happen when a patient cannot pass the check?
The assistant should stop the disclosure or change, give a neutral explanation and offer an authorised alternative such as a callback to a known number, the official clinic line or an in-person check. Failure must not become an automated decision about fraud or access to care.
Sources and further reading
- European Commission: principles of the GDPR
- European Data Protection Board: Guidelines 02/2021 on virtual voice assistants
- European Data Protection Board: Guidelines 01/2022 on data subject rights and authentication
- NHS England Digital: protecting confidentiality and privacy on the telephone
- NIST: SP 800-63 Revision 4 Digital Identity Guidelines