AI Surgery Pre-Op Intake: PROMs Collection That Holds Up to HIPAA

A surgical practice with a pre-op PROMs program completed at 90%+ has structured outcome data nobody else has. An AI voice agent makes that achievable — without becoming a HIPAA liability or a clinical-judgment substitute.

What this workflow does

flowchart TD
  In[Patient interaction] --> MinNec{Minimum necessary?}
  MinNec -->|yes| Process[AI process]
  MinNec -->|no| Reject[Block + log]
  Process --> Encrypt[(AES-256 at rest)]
  Encrypt --> DB[(PostgreSQL)]
  Process --> Audit[(Audit trail)]
  DB --> Right[Right of access §164.524]

A patient is scheduled for surgery 14, 7, 2, and 1 days out. The AI agent calls (or texts a portal link) at each touchpoint to administer the standardized PROMs (PROMIS, KOOS, HOOS, Oswestry, Eq-5D, depending on procedure), confirm pre-op instructions (NPO timing, medication holds, anticoagulation plan, transportation), capture changes in symptoms or medications, and answer common questions. Critical findings (new chest pain, signs of infection, medication misunderstandings) escalate to the surgical team in real time. Completed PROMs flow to the EHR as structured data.

Done well, the workflow lifts pre-op completion rates from 40% to 90%+ and gives the surgeon a baseline outcomes dataset. Done badly, it captures more PHI than necessary or replaces clinician judgment on a deteriorating patient.

HIPAA constraints

PROMs collection is treatment under 45 CFR 164.501, fully covered by the treatment-payment-operations exception at 45 CFR 164.506(c). Minimum necessary at 45 CFR 164.502(b) governs which PROMs and which fields the agent collects — only what the surgeon and the post-op outcomes program use. Voicemail content stays generic (name, callback, "your pre-op survey is ready") under HHS guidance.

The 2026 NPRM expectations — written technology asset inventory, MFA, encryption everywhere, annual technical safeguards verification — apply to the AI vendor as a business associate. The audit trail at 45 CFR 164.312(b) records every PROM administration and every pre-op confirmation.

When the agent escalates a critical finding (new chest pain, infection signs), the disclosure to the surgical team is treatment under 45 CFR 164.506(c). When the agent declines to give clinical advice, it is operating within the practice's protocol — the agent is not the practice of medicine.

How CallSphere implements it

CallSphere's Healthcare Voice Agent runs pre-op intake through the administer_proms, confirm_preop, and escalate_critical tools — 3 of 14 healthcare tools. The PROMs library carries PROMIS, KOOS, HOOS, Oswestry, Eq-5D, VR-12, and procedure-specific instruments; the surgeon picks the bundle per case type. The agent administers the PROM verbatim — wording matters for outcome scoring — captures answers as structured data, and writes them back to the EHR via FHIR R4. Pre-op instruction confirmations cover NPO timing, medication holds, anticoagulation, and transportation, with a clinician-vetted Q&A for common questions. Critical-finding keywords (chest pain, calf pain, fever, surgical-site redness, severe nausea on hold meds) escalate to the surgical team's task queue with a 30-minute SLA. Every call is captured in post-call analytics with sentiment (–1.0 to +1.0), lead score (0–100), AI summary, and audit trail in the encrypted healthcare_voice PostgreSQL database (1 of 115+ tables). HIPAA and SOC 2 aligned, 37 agents and 90+ tools across 6 verticals. Pricing on /pricing; start with 14-day trial; see /industries/healthcare for surgical specialties.

Implementation checklist

1. Pick the right PROMs bundle per procedure with surgeon sign-off.
2. Administer PROMs verbatim — outcome scoring depends on wording.
3. Capture answers as structured data and FHIR-R4 back to the EHR.
4. Hard-code critical-finding keywords with a 30-minute clinician-task SLA.
5. Cover NPO timing, med holds, anticoagulation, transportation in pre-op confirmations.
6. Build a clinician-vetted Q&A for common pre-op questions; the agent does not freelance.
7. Voicemail content stays minimum necessary — no procedure name on voicemail by default.
8. Cap call frequency to once per touchpoint plus one retry.
9. Sign BAAs with EHR, FHIR gateway, voice carrier, ASR, TTS, and LLM sub-processors.
10. Audit-log every PROM administration, every escalation, and every Q&A response.
11. Run weekly QA on a sample of pre-op calls; 100% review on critical-finding escalations.
12. Reconcile completed PROMs with surgical schedule daily.

FAQ

Can the AI agent give clinical advice on pre-op questions? Only what the practice protocol authorizes — typically structured Q&A on NPO, meds, and logistics. Anything beyond protocol routes to the surgical team.

What if the patient asks the agent to cancel surgery? The agent captures the request, escalates to the surgical scheduler, and follows the practice's cancellation policy. It does not act on cancellation autonomously.

Does the agent collect PROMs for outcome research? PROMs collection for treatment is TPO. Use of identifiable PROMs for research requires IRB and patient authorization unless de-identified per 45 CFR 164.514 or under a limited-data-set DUA.

Can the agent leave PROMs answers on a voicemail callback? No. PROMs answers stay in the secure record. The voicemail says "your pre-op survey is ready" with a callback or portal link.

What about the day-of-surgery confirmation? CallSphere ships a 5 a.m. NPO and arrival-time confirmation as a separate workflow — typically text only, with same minimum-necessary rules.

Sources

• 45 CFR 164.506 Treatment payment operations: https://www.ecfr.gov/current/title-45/section-164.506
• 45 CFR 164.502 Minimum necessary: https://www.ecfr.gov/current/title-45/section-164.502
• 45 CFR 164.312 Technical safeguards: https://www.ecfr.gov/current/title-45/section-164.312
• HealthMeasures PROMIS: https://www.healthmeasures.net/explore-measurement-systems/promis
• AHRQ CAHPS Surgical Care Survey: https://www.ahrq.gov/cahps/surveys-guidance/surgical/index.html