Automating Appointment Booking in a Medical Practice with AI: What Holds, What Breaks

Automation books slots, it does not give advice

Automating appointment booking with AI means handing a voice or chat agent four precise moves: identify the caller, qualify the reason for the visit, read the slots that are genuinely free in the practice management software, then write the appointment with the right duration and the right practitioner. Everything that involves clinical judgement stays with the practitioner, and the automation must stop dead at an emergency, an ambiguous reason and an uncertain identity. That definition is narrow on purpose. An agent that interprets a symptom, ranks a pain or picks a procedure has left the front desk and entered care. What follows walks through the four moves, then the three points where the machine has to hand control back. The test fits in one sentence: if it decides anything other than a time slot, it has gone too far.

Read the live schedule, never a copy

A practice does not work on a schedule. It works on the one inside its practice management software. Receptionists write in it, practitioners move things around, patients cancel online. Automation is worth something only if it reads that source, live, at the second it is speaking to the patient. A copy synced overnight offers slots that are already gone. French national statistics give the turnover rate. In the DREES waiting-times survey of 40,000 people, one GP appointment in two was obtained in under two days. When symptoms appeared or worsened, half of all attempts to make contact produced a same-day appointment (Études et Résultats no. 1085, 2018). At that pace, a nightly copy and the real schedule diverge within hours. Three engineering consequences follow. Read during the call, not from cache. Fail cleanly on write if the slot went in the meantime, then re-offer without pretending. And the appointment the machine writes must land in the software with the same reason code and the same note a receptionist would have typed at the desk. Two callers can aim at the same slot in the same second. One of them has to leave with a real appointment, not with an excuse.

One duration per procedure, not one practice average

DREES measures an average of 18 minutes for a GP consultation in France, across a panel of 3,300 self-employed GPs (Études et Résultats no. 1113, 2019). That average is useless for booking. An annual check-up, a crown fitting, a first consultation and a dental emergency occupy neither the same time nor the same chair. Duration is a property of the procedure, not of the practice. It lives in the software’s own procedure table. It shifts from one practitioner to another for the same act. Automation reads that table. It never guesses. An agent that defaults to 20 minutes manufactures mornings already running late by 11 a.m. and chairs sitting empty at 4 p.m. So configuration comes before deployment. A practice that has never written down how long its procedures take is not automatable yet. Write the table, then automate. And the duration of the procedure is not the duration of the slot. Chair cleaning, sterilisation and note-taking add to it, and only the practice knows by how much.

• Read the duration from the software, never assume it
• Apply the chosen practitioner’s duration, not a practice average
• Block the chair and the room, not just the clock
• Refuse any procedure whose duration is not configured

The right practitioner, not the first free slot

A free slot is not a valid slot. In a six-practitioner practice, the requested procedure often names one person. Implant surgery, paediatric orthodontics, a follow-up ultrasound: every line in the schedule carries a competence constraint the patient knows nothing about. Those rules already exist. They live in the receptionists’ heads. “Dr X takes no new patients on Mondays.” “Under-sixes go to Dr Y.” “No surgery on Friday afternoon.” None of it is written anywhere in the software. Automation therefore forces an unglamorous piece of work up front: putting those rules in writing, one by one, with the practice. That is the real cost of a deployment. It is also the point. An explicit rule can be tested, corrected, and it survives the departure of the receptionist who carried it. Solva freezes these rules in a per-practice configuration, reviewed by the practitioner before go-live. Absence weighs as much as competence. Leave, on-call duty, a blocked half-day: until those events come out of the software, the agent offers slots that do not exist.

Unknown caller: a provisional record, nothing more

The first-time caller does not exist in the database. The agent has to create a record, and the French framework is very precise here. France’s national patient-identification standard, published by the Agence du numérique en santé, requires at least five strict identity traits: birth name, first given name at birth, date of birth, sex, place of birth (RNIV 1, version 1.2, June 2021). Over the phone, none of those traits is proven. The standard says it flatly: an identity created without calling the INSi service carries the status “provisional identity”. Only a national ID card, a passport, or an electronic identification of substantial or high assurance level under eIDAS promotes the record to “validated identity”. An honest agent therefore creates a provisional record, flags it as provisional, and leaves validation to the front desk. An agent that claims otherwise breeds duplicates. One day it attaches a procedure to the wrong file. For a patient already on file, the rule is symmetric. Confirm the date of birth before opening the record, and say nothing about its contents until it matches.

• Collect the five strict traits, skipping none
• Flag the record provisional until an ID is seen
• Search for a namesake before creating, never after
• Leave validation to the front desk, at first visit

Ambiguous reason: ask, never infer

“It’s been hurting since yesterday.” That sentence contains no procedure. It contains a symptom. Turning a symptom into a procedure is a clinical act, not a front-desk one. The boundary is regulatory too. The French medicines agency ANSM points out that Rule 11 of EU Regulation 2017/745 covers software intended to provide information used to take decisions for diagnostic or therapeutic purposes, and that since 26 May 2021 a large share of the software that qualifies as a medical device sits in class IIa or above. An agent that decided on its own that a given pain is an endodontic emergency falls into that category, with the CE marking and notified body that come with it. The design rule fits in three lines. The agent asks a closed question, drawn from the practice’s own list of reasons. If the answer matches none of them, it does not choose: it transfers to the front desk or schedules a callback. Doubt triggers a human, never a hypothesis. That list of reasons is not written by the vendor. It is written by the practice, reviewed by the practitioner, and it changes when the practice changes.

Emergency: the schedule is the wrong answer

A life-threatening emergency has no business in an appointment schedule. The French code of medical ethics is direct: any doctor informed that a patient is in peril must assist them or make sure they receive the necessary care (article R4127-9 of the public health code). The route is the service d’accès aux soins, which assesses the health need of anyone who calls and arranges the care their condition requires (article L6311-3). In France that number is 15. Every country has its equivalent, and your script has to name yours. An automated agent cannot assess peril. It can recognise the words the practice listed for it, cut off any attempt to book, and redirect. That is deterministic behaviour, not judgement. This path is tested as a safety function, not as a comfort feature. Trigger it deliberately. Check that it kills booking. Check that it says the number out loud. The cost of a false positive is a patient redirected for nothing. The cost of a false negative is a patient waiting for an appointment during a heart attack. The setting leans the way medicine leans.

• Stop booking at the first emergency signal
• State the emergency number, plainly and without delay
• Transfer to the practice while the line is open
• Log the call so the practitioner reviews it

AI proposes, the practitioner decides

The line is not negotiable. The GDPR gives every person the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them, and, where the decision rests on consent or on the performance of a contract, gives them at minimum the right to obtain human intervention (article 22). The French code of medical ethics adds that the doctor builds their diagnosis with the greatest care, devoting the time it takes (article R4127-33 of the public health code). Booking a slot is an administrative task. Deciding what happens in that slot is not. Three obligations frame the rest. The patient must know they are talking to a machine: the article 50 transparency obligation of the EU AI Act has applied since 2 August 2026. The exchange is covered by medical confidentiality (article L1110-4). And in France the data sits with an HDS-certified host (article L1111-8). Decree no. 2026-209 of 24 March 2026 orders that host to publish a map of its transfers outside the European Union. That obligation takes effect six months after the decree appeared in the Journal officiel on 26 March 2026. HDS is a French certification with no equivalent elsewhere.

Sources

1. Légifrance, code de la santé publique, article R4127-9 (assistance à personne en péril) https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000006912870
2. Légifrance, code de la santé publique, article R4127-33 (élaboration du diagnostic) https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000006912895
3. Légifrance, code de la santé publique, article L6311-3 (service d’accès aux soins) https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000048689128
4. Légifrance, code de la santé publique, article L1110-4 (secret médical) https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000043895798
5. Légifrance, code de la santé publique, article L1111-8 (hébergement de données de santé) https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000049577902
6. Légifrance, décret n° 2026-209 du 24 mars 2026 relatif à l’hébergement de données de santé https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000053717250
7. CNIL, RGPD article 22, décision individuelle automatisée https://www.cnil.fr/fr/reglement-europeen-protection-donnees/chapitre3
8. CNIL, profilage et décision entièrement automatisée https://www.cnil.fr/fr/profilage-et-decision-entierement-automatisee
9. Commission européenne, obligations de transparence de l’article 50 du règlement sur l’IA, 2026 https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act
10. DREES, Études et Résultats n° 1085, délais d’attente pour un rendez-vous, 2018 https://drees.solidarites-sante.gouv.fr/publications/etudes-et-resultats/la-moitie-des-rendez-vous-sont-obtenus-en-2-jours-chez-le
11. DREES, Études et Résultats n° 1113, temps de travail des médecins généralistes, 2019 https://drees.solidarites-sante.gouv.fr/publications/etudes-et-resultats/deux-tiers-des-medecins-generalistes-liberaux-declarent-travailler
12. Agence du numérique en santé, référentiel national d’identitovigilance 1, version 1.2, 2021 https://esante.gouv.fr/sites/default/files/media_entity/documents/RNIV%201%20Principes%20communs_1.pdf
13. ANSM, impact des règlements européens sur la classification des logiciels https://ansm.sante.fr/documents/reference/impact-des-nouveaux-reglements-europeens-sur-la-classification-des-logiciels
14. Gesetze im Internet, § 203 StGB, Verletzung von Privatgeheimnissen https://www.gesetze-im-internet.de/stgb/__203.html
15. Kassenärztliche Bundesvereinigung, ärztlicher Bereitschaftsdienst 116117 https://www.116117.de/de/aerztlicher-bereitschaftsdienst.php