The problem
Website messages pile up overnight and the front desk spends the first half hour sorting them. In a practice, the risk is that people type symptoms, medications or appointment details into a general contact form, and that text then sits in an ordinary inbox and in any tool that reads it.
Keep out of the AI
- Symptoms, conditions, medications or test results, even if a visitor types them
- Appointment details tied to a reason for the visit
- Existing patients' records, balances or chart questions; those go to the portal or phone
Every dental and medical idea here is designed so no protected health information (PHI) ever goes into Claude. Anthropic offers HIPAA only on Enterprise plans; Team plans can’t enable it. Under the HIPAA configuration, Cowork runs in local mode on a desktop and Cowork in the cloud (including cloud scheduled tasks) isn’t available. Anthropic’s documentation says connectors and MCP servers aren’t covered by its BAA. Nothing here makes a practice HIPAA compliant; ask your privacy officer before you start.
What Cowork does
- The practice replaces its open contact form with one that offers only administrative categories, a short field limited to scheduling preferences, and a clear notice: do not include medical information; for urgent symptoms call the office line or 911.
- The form's notifications go to a dedicated inbox that is not used for patient communication.
- Each morning before opening, Cowork counts inquiries by category and drafts a reply for each that points to the right next step: call to book, the patient portal for anything clinical, or the billing line.
- If a message contains health details despite the notice, Cowork stops, does not summarize it, and flags it for the office manager to move into the practice's approved system and delete from the inbox.
Where the draft lands
A morning count by category and reply drafts in the inquiry inbox.
What stays with you
Booking, every clinical question, and handling any message that slipped health details through the form.
Overnight inquiries: 14. New patient interest 6 · Billing question 4 · Records request 2 · Careers 1 · Stopped and flagged for Pat 1 (message included health details; not summarized).
Draft (new patient interest): Thank you for your interest in Northgate Family Medicine. To book a new-patient visit, please call us at the main number between 8 and 5. If you have a medical concern, please call the office rather than replying here.
Watch-outs
- HIPAA note: you can't fully stop people typing health details into a form. Treat this as a non-PHI workflow with a stop rule, and get your privacy officer's sign-off. If the practice decides inquiries are PHI, this belongs in a system covered by your BAAs, not in Claude on a Team plan.
- Scheduled tasks run hourly at most. The form notice must tell people to call for anything urgent.
- Prospective patients' names and contact details should be deleted from the inbox once the inquiry is handled.
Questions owners ask
Why not let the AI answer health questions after hours?
Because that is clinical advice and it would collect PHI. This setup is designed so the AI never sees or answers clinical questions.
Could this run under Anthropic's HIPAA configuration instead?
That needs an Enterprise plan, and the configuration limits Cowork to local mode on a desktop, so cloud scheduled tasks aren't available. Talk to your compliance lead about whether that fits.