An Agent That Can Book an Admission Should Never Be Able to Transmit the MDS. Here's How to Scope the Rest.

It is 2:10 on a Tuesday. The admissions coordinator at a 90-bed skilled nursing facility has three referrals in the hospital's discharge portal and a fourth that came in as a 63-page PDF from a case manager who could not get the portal to load. Inside those 63 pages: a face sheet, a medication reconciliation list, two hospitalist notes, a PASRR Level I screen, an insurance card photographed at an angle, and eleven pages of telemetry strips nobody will read. She has forty minutes before the 3:00 stand-up to say yes or no on four beds.

Every operator I visit has, by now, put some kind of AI reader on that packet. What changed the risk picture in 2026 is that the reader is no longer just a reader. It books. It sends. It files. It can put an assessment on the wire to CMS. And the moment it could act, a set of questions that used to belong to your IT vendor landed on the desk of the licensed administrator whose name is on the wall.

The software stopped suggesting and started doing

In 2024 and 2025 the honest description of these tools was “a very fast reader with an opinion.” It summarized the packet, flagged the diagnoses, and handed everything back to a human who typed it into PointClickCare. Slow, but the worst case was one tired person catching a bad summary.

Through 2026 the working products — Claude Cowork, which landed 12 January and went to mobile and web in July, and ChatGPT Work, which arrived 9 July — take a goal and go do it across your systems for hours at a stretch. Give one of them access to your clinical record, your billing clearinghouse and your email and it will genuinely open the admission, generate the agreement, request the eligibility check and draft the assessment. That is the useful part. It is also the whole problem, because a tool that can send is a tool that can send the wrong thing, and in this business some sends do not come back.

Least privilege for an AI agent means it holds exactly the permissions the task in front of it requires, in exactly the systems it needs, for exactly as long as it needs them — and never holds the permission to move money, change a physician order, or transmit a record to CMS without a named human pressing the button. That sentence is the entire policy. Everything below is how you make it real in a building that runs on PointClickCare, a fax machine that still works, and a business office manager who is one person.

The one button that never moves: transmitting the MDS

If you take one rule from this piece, take this: no agent transmits an MDS. Not the 5-day PPS assessment, not the annual, not the discharge tracking record. A human — your MDS coordinator, or the RN who signs Section Z — opens it, reads Section GG and the diagnosis coding, and presses submit to iQIES themselves.

The reason is not squeamishness. A transmitted assessment is three things at once: your PDPM per-diem for that Part A stay, a permanent entry in the quality measures behind Care Compare and your Five-Star rating, and a signed clinical attestation. Getting it back is not an undo. It is a modification request, a paper trail, and a fair question from your Medicare Administrative Contractor about why fifteen assessments changed in one week — which is how buildings land in Targeted Probe and Educate over a workflow decision nobody wrote down.

flowchart TD
  A["Hospital case manager sends 63-page referral"] --> B["Agent reads packet, checks bed and payer"]
  B --> C{"Does this action leave the building?"}
  C -->|No| D["Agent drafts admission packet in PointClickCare"]
  C -->|Yes| E["Held in a queue for named sign-off"]
  D --> F["Admissions coordinator reviews before family signs"]
  E --> G["MDS coordinator checks Section GG and diagnoses"]
  G --> H["Human transmits to iQIES"]

The MDS is the headline case, but it has siblings, and they share the same test: does this action leave the building or become part of the legal record? A UB-04 going to the clearinghouse. A change written into eMAR against a physician order. A disbursement out of a resident trust fund account, which is bonded, audited, and carries its own F-tags. A 30-day notice of transfer or discharge mailed to a resident and the state ombudsman. Each of those is a human hand on the button, every time, no exceptions for the night the census is good and everyone is rushing.

Scope the rest like you scope a new agency nurse

Here is the useful mental model. When an agency LPN walks in for a 7-to-7, you do not hand her the narcotic keys, the medical records room, the payroll system and the trust fund checkbook because she is a nurse. She gets a badge for the unit she is on, the med cart she is assigned, and nothing else, for twelve hours. Do the same thing with the agent.

• Read-only by default. The referral agent needs to read the discharge portal, the packet, your bed board and your payer contracts. It does not need write access to a single clinical field to do that job.
• Write to drafts, never to the record. Let it build the admission agreement, the face sheet and the care plan starter as a draft that a human opens, edits and saves. Drafts are reversible. Signed records are not.
• One agent, one job, one login. Do not give the admissions agent the same credentials as the billing agent. When something goes sideways at 4 a.m., you want to know which one did it, and you want to be able to shut off exactly that one.
• Time-box the access. An agent helping with the quarterly Payroll-Based Journal submission needs your timekeeping data during that window, not permanently.
• Log every action to a name. Your surveyor will not accept “the system did it.”

The attack does not arrive by email. It arrives as a PDF from the hospital.

The failure mode people underestimate is a hidden instruction buried in a document the agent reads — a line of text in a referral packet, a vendor invoice, a resume, or a family email that tells the agent to do something you never asked for. The agent cannot always tell the difference between “this is information” and “this is an order from my boss,” because both arrive as words on a page.

The documents that come in from outside are exactly the ones the agent reads most: hospital discharge summaries, notes from your long-term-care pharmacy, therapy notes from a contract rehab company, invoices through your supply portal. You control none of them. So the fix is not “train it better” — it is permissions. An agent that physically cannot cut a check, change an order or transmit an assessment cannot be talked into it, no matter what is printed on page 41.

What one bad transmission costs, worked out

Illustration only — run your own numbers with your business office manager. Assume a 90-bed building with 22 Medicare Part A residents at a time, and an agent given transmit rights that mis-codes Section GG self-care items on the 5-day PPS assessment before anyone catches the pattern.

Now price the alternative. The MDS coordinator opening fifteen drafts and pressing submit herself costs roughly twelve minutes each — three hours, about $140 of her time, spread over three weeks. That is the whole trade. Nobody in this industry has ever regretted the three hours.

Where the human stays, and the one thing to do Monday

Keep a person on anything that touches a body, a bank account, or a submission. The decision to accept a resident whose care needs sit at the edge of what your staffing can safely cover stays with the Director of Nursing, not with a tool that has read your bed board and noticed an empty room. Any call to a family about a decline, a fall, or the end of life stays human, in a voice they recognize.

Monday morning, do a permissions inventory: one page listing every AI tool touching the building, what each can read, what each can write, whose login it uses, and whether anything it does is irreversible. The ugly surprise is rarely a rogue agent. It is that three tools are all running under the business office manager's PointClickCare login, so your audit trail says she did everything, including what she did not do.

Frequently asked questions

Does letting an agent read a resident's chart create a HIPAA problem by itself?

Reading is a disclosure like any other, so the vendor needs a signed business associate agreement and access limited to the minimum necessary. The practical trap is not the reading — it is agents that quietly retain what they read, or route it through a consumer account somebody set up with a personal email. Confirm in writing where the data sits, how long it is kept, and that it trains nothing.

Our corporate office wants one agent with access to all twelve buildings. Is that bad?

One agent with twelve buildings of read access is fine and genuinely useful for census and PBJ work. One agent with twelve buildings of write access is how a coding mistake becomes an enterprise-wide repayment instead of a building-level correction. Split the permissions by building even if the tool is shared.

What about state AI laws — do they reach a single-site nursing home?

Texas TRAIGA and California SB 53 both took effect 1 January 2026, and Colorado, New York, Utah, Nevada, Maine and Illinois have their own statutes. Federal preemption is still unsettled as of July 2026, so in those states, state law binds you today. The obligations that bite hardest are disclosure and record-keeping — another argument for that one-page inventory.

Can we let the agent answer the phone if it cannot write to anything?

Yes, and it is usually the best first job to hand over, precisely because it is read-and-speak rather than write. Answering, routing, taking a message and booking a tour are all reversible.

If the phone is where you want to start, that is the part CallSphere builds: AI voice and chat agents that answer the main line and the web chat around the clock, route the 6 p.m. family call to the right unit, capture tour inquiries when the marketing director is at lunch, and book appointments — while every clinical, billing and CMS submission stays behind a human signature, exactly where it belongs.