AI Urgent Triage Routing: HIPAA Plus the Emergency-to-911 Hand-Off

The fastest path from an AI voice agent to a 911 dispatcher is the difference between a good triage workflow and a wrongful-death suit. HIPAA permits the disclosure under 45 CFR 164.512(j); the speed is on the design.

What this workflow does

flowchart TD
  In[Patient interaction] --> MinNec{Minimum necessary?}
  MinNec -->|yes| Process[AI process]
  MinNec -->|no| Reject[Block + log]
  Process --> Encrypt[(AES-256 at rest)]
  Encrypt --> DB[(PostgreSQL)]
  Process --> Audit[(Audit trail)]
  DB --> Right[Right of access §164.524]

A patient calls the practice with symptoms. The AI agent runs a structured triage script, classifies acuity (emergency, urgent, routine, self-care), and routes — to 911 (or local equivalent) for emergencies, to the on-call clinician for urgent, to scheduling for routine, to nurse-line content for self-care. For emergencies the agent stays on the line with the patient, conferences a 911 dispatcher when local protocols permit, and documents the encounter in the EHR. For everything else it captures a structured chief complaint and routes per the practice's protocol.

Done well, the workflow handles 60–80% of calls without staff time and never misses an emergency. Done badly, it converts a STEMI into a billing question.

HIPAA constraints

Disclosure to avert serious threat under 45 CFR 164.512(j) permits the practice to share PHI with persons who can prevent or lessen the threat — including 911 dispatchers, EMS, and law enforcement when responding to an emergency. The disclosure must be in good faith and limited to the minimum necessary to address the threat. Documentation in the EHR after the fact is required under 45 CFR 164.528 accounting of disclosures.

Triage protocols themselves are a clinical-liability question, not a HIPAA question. Most practices use Schmitt-Thompson, Briggs, or a customized protocol vetted by their medical director. The AI agent's role is to apply the protocol consistently, not to invent triage logic. The audit trail at 45 CFR 164.312(b) must capture every triage decision, classification, and routing action.

How CallSphere implements it

CallSphere's Healthcare Voice Agent runs triage through the triage_caller tool — 1 of 14 healthcare tools. The triage script is loaded from a versioned protocol library — Schmitt-Thompson by default, Briggs and custom-vetted protocols available. Emergency keywords (chest pain, suicidal ideation, stroke symptoms, anaphylaxis, severe bleeding, unconscious) short-circuit the script and route to 911 in under 4 seconds. The agent stays on the line and offers to conference 911 where the carrier permits. Urgent calls hit the on-call clinician's pager with a structured handoff. Routine calls go to scheduling. Every call is captured in post-call analytics with sentiment (–1.0 to +1.0), lead score (0–100), AI summary, audit trail, and a flag for triage outcome stored in the encrypted healthcare_voice PostgreSQL database (1 of 115+ tables). HIPAA and SOC 2 aligned, 37 agents and 90+ tools across 6 verticals. Pricing on /pricing; start with the 14-day trial; healthcare overview at /industries/healthcare.

Implementation checklist

1. Use a vetted triage protocol — Schmitt-Thompson, Briggs, or medical-director-signed custom.
2. Hard-code emergency keywords for instant 911 routing — never let the LLM judge "is this an emergency?"
3. Stay on the line with the caller until 911 has them — no abandoning the call.
4. Conference 911 where carrier protocols permit; otherwise warm-transfer.
5. Document the disclosure in the EHR per 45 CFR 164.528.
6. Capture chief complaint as structured fields, not just transcript prose.
7. Route urgent calls to on-call clinicians within the practice's stated SLA.
8. Provide self-care content for routine items (cold symptoms, minor cuts) where protocol permits.
9. Run daily reconciliation: every triage classification gets a clinician spot-check.
10. Audit-log every triage decision with timestamp, protocol step, classification, and routing action.
11. Sign BAAs with carrier, ASR, TTS, LLM, and EHR vendors.
12. Tabletop quarterly: "what if the agent misclassifies a STEMI?" — practice the recovery.

FAQ

Can the AI agent disclose patient name and location to 911? Yes — 45 CFR 164.512(j) authorizes disclosure to avert a serious threat. Minimum necessary still applies; provide name, location, and clinical situation, not the full chart.

What if the patient does not want 911 called? The agent respects refusal where the patient is competent, documents the refusal, and offers alternatives. For imminent suicidal or homicidal risk, 45 CFR 164.512(j) and most state mental health laws authorize disclosure even over patient objection.

How fast must the routing be? There is no HIPAA-defined SLA. Clinical-liability standards expect under 60 seconds for emergency routing; CallSphere's hard-coded keyword path triggers under 4 seconds.

Does the AI agent give clinical advice? Only what the protocol permits — typically structured self-care guidance for routine items. The agent does not invent advice and never goes off-protocol.

What about behavioral-health emergencies? 988 Suicide and Crisis Lifeline is the default for behavioral-health crisis. See the dedicated 988 hand-off workflow in this series.

Sources

• 45 CFR 164.512(j) Uses and disclosures to avert threat: https://www.ecfr.gov/current/title-45/section-164.512
• 45 CFR 164.528 Accounting of disclosures: https://www.ecfr.gov/current/title-45/section-164.528
• 45 CFR 164.312 Technical safeguards: https://www.ecfr.gov/current/title-45/section-164.312
• HHS Disclosures for Emergency Preparedness: https://www.hhs.gov/hipaa/for-professionals/special-topics/emergency-preparedness/index.html
• AHRQ Schmitt-Thompson Pediatric Telephone Protocols overview: https://www.ahrq.gov/