AI for Clinical Laboratories: Scheduling, Prep Instructions and Limits

AI for clinical laboratories works well in front-desk tasks: organizing the collection schedule, explaining test preparation, listing required documents and opening hours, and routing questions to the team. It should not interpret results or comment on reports, which remain the responsibility of qualified professionals. Because health data is sensitive under Brazil's LGPD, the design must limit what the AI can see, what it can say and what gets recorded.

Key takeaways

• Use AI where the answer already exists in the laboratory's own rules: hours, locations, preparation, documents and the turnaround times the lab publishes.
• Never let the AI say whether a value is normal, high or low, or suggest a course of action. Interpreting a result is a professional act.
• Health data is sensitive personal data. Collect the minimum, define the legal basis with your data protection officer and control where the data travels.
• Every flow needs a handoff to a person, with a conversation summary, and a record of decisions.
• Start with a single flow, such as collection scheduling, with an agreed metric, then decide whether to expand, adjust or stop.

What does superintelligence mean in a clinical laboratory?

The term superintelligence often appears in debates about the future of AI. For someone running a laboratory, the useful question is different: which day-to-day tasks can an AI system take on today, within what limits and under what supervision.

In practice, we are talking about support assistants, scheduling automations and internal helper tools, all with a closed scope. None of them replaces the judgment of the technical director or of the health professionals who perform, release and interpret the tests. If you want to separate promise from operation, read Automatic Appointment Scheduling on WhatsApp with AI, which describes a concrete flow without exaggeration.

Where AI helps: scheduling, preparation and questions

Scheduling is the best starting point because the rules are verifiable: locations, hours, types of collection, tests with a specific time window, home collection. An agent on WhatsApp can gather the patient's name, the requested test, the location and preferred time, check the calendar and propose options. Rescheduling and cancellations follow the same logic.

Preparation needs more care. Instructions such as fasting, collection time and documents must come from the laboratory's own manual, not from the model's general knowledge. That means the assistant consults a curated base approved by the technical team, answers only from it and says it does not know when it cannot find the information. When preparation depends on a medication or on the person's clinical condition, the correct answer is to hand off to the team, not to improvise.

Questions the assistant can answer safely include:

• address, opening hours, locations and directions
• required documents, the doctor's request and accepted health plans, as registered by the laboratory
• what the collection is like and what to bring
• the turnaround time the laboratory publishes for each type of test
• how to access the results portal or app, without opening the content
• rescheduling, cancellation and copies of receipts

Collection and preparation reminders are outbound messages, which require permission and an approved template. The article WhatsApp Outbound Messages: Templates, Opt-In and Best Practices covers this in detail. Avoid naming the test in the reminder: a phone screen can be seen by other people.

What should AI never do with results and reports?

The line is simple: the AI can help a person reach their result, but it cannot say what the result means. As flow rules, the following stays out of scope:

• commenting on whether a value is high, low or within the expected range
• comparing with previous tests and saying whether things improved or worsened
• suggesting a diagnosis, cause, treatment, medication or new test
• reassuring or alarming the patient about any result
• summarizing, rewriting or drafting parts of a report that will be released
• sending a result without identity verification through the laboratory's authenticated channels

The reason is practical. A report is a health document carrying professional responsibility. Reference ranges vary by method, age, sex and context, and the same number can mean different things for different people. A language model produces plausible text, and plausible is not the same as correct. Here the error lands on a real person.

For that reason, the flow should have a short, fixed answer to any question about what a result means: the assistant explains that it does not evaluate results, advises talking to the doctor who ordered the test and offers the contact for the service desk. If the message suggests urgency, such as strong symptoms, it directs the person to urgent care and alerts the team, without trying to assess the situation.

Delivery of the file should go through a portal or app with a login, not through free-form conversation. A good design practice is for the conversation agent to have no tool that can access results. That way, even an attempt at manipulation through a message cannot extract what the agent never had.

Health data and LGPD: what changes in the design

The LGPD treats health-related data as sensitive personal data, and Article 11 defines the situations in which it may be processed. This does not prohibit the use of AI, but it calls for explicit decisions. The laboratory defines the legal basis and purpose, together with its data protection officer and legal counsel. This text does not replace that opinion.

The design consequences we usually recommend are implementation practices, not legal requirements:

• Minimization: the scheduling agent rarely needs a diagnosis or a result. Collect name, contact, test and time slot.
• Purpose: scheduling data should not be reused for marketing or model training without its own basis.
• Where processing happens: know where the model runs and whether data is sent abroad. The article International Data Transfer Under LGPD When Using AI Providers helps organize that analysis.
• Retention: define how long conversations are kept and who can read them.
• Access: role-based permissions and minimal tools for the agent.
• Records: a log of each query, answer and handoff, for audits and to respond to data subject requests.

When an automated decision affects the data subject, such as denying or prioritizing service, it is worth knowing the right of review described in LGPD Automated Decision-Making: The Right to Review (Art. 20). For obligations and interpretations, the primary sources are the ANPD (Brazil's data protection authority) and the text of the law itself.

Also treat every incoming message as untrusted input. Text or an attachment from a patient may contain instructions that try to change the agent's behavior. The OWASP Top 10 for LLM applications describes this risk and the defenses, and the main one is to give the agent the least power possible.

Illustrative scenario: a collection request on WhatsApp

Illustrative scenario: a patient writes outside business hours asking for a blood collection and wants to know whether she needs to fast. The agent identifies a scheduling request, confirms the test by the name she gave, checks the preparation base approved by the laboratory and replies with the registered instruction. Then it offers time slots at the nearest location and records her choice.

Later, the patient asks whether a high cholesterol result would be serious in the future. The agent replies that it does not evaluate results, that the doctor who ordered the test is the one who interprets it, and that the laboratory team can help with access questions. If she mentions a worrying symptom, the agent advises her to seek urgent care and flags a human attendant with a summary of the conversation. The log keeps the question, the source used, the answer and the handoff.

Checklist before going live

Use this list as the release criteria for the pilot:

• A chosen flow and an agreed success metric, such as completed bookings without rework by the front desk.
• A preparation base reviewed by the technical team, with one person responsible for keeping it up to date.
• A fixed answer for questions about results and reports, tested with many ways of phrasing the same question.
• An urgency rule and a handoff to a human, with a context summary.
• Agent tools limited to reading the calendar and creating or rescheduling slots, with no access to results.
• A data map: what is collected, where it is stored, who accesses it and for how long.
• Legal basis and privacy notice reviewed by the data protection officer and legal counsel.
• A clear notice that the service is automated and how to reach a person.
• A stop plan: who switches the agent off, and how, if something goes wrong.

How to map, limit, pilot and hand over

The method used in AI projects for customer service follows four steps. Map: survey the current scheduling and question flow, where people wait, what the front desk repeats every day and what the baseline is. Limit: decide which data and actions are allowed, what the agent never does (results and reports) and when it passes the conversation to a human.

Pilot: run one real flow, with logs and the agreed metric, reviewing conversations regularly. Hand over: deliver documentation, rules and a way to monitor, and then decide whether to expand, adjust or end. This logic is compatible with the NIST AI Risk Management Framework, which organizes AI risk management into the functions govern, map, measure and manage. Any expected gain is a hypothesis until the pilot confirms it.

Frequently asked questions

Can the AI send test results over WhatsApp? It depends on the laboratory's decision about channel and authentication, and on its privacy notice. The design recommendation is that the conversation agent has no access to results and only points to the path through a portal or app with a login. If the laboratory chooses to send results over WhatsApp, that decision should go through the data protection officer and legal counsel, with identity verification.

Can the AI explain what a test is, such as a complete blood count? A general, educational explanation of what the test measures can be given using text approved by the laboratory, unrelated to the person's own result. Saying whether their value is adequate is already interpretation and stays out of scope. When in doubt, the assistant refers the person to the team or to the requesting doctor.

Do I need consent to use AI in customer service? Consent is not always the right legal basis, because Article 11 of the LGPD provides other grounds for health data, such as the protection of health in procedures carried out by health professionals and health services. Whether that ground covers automated service must be settled with the data protection officer and legal counsel. In any case, tell people the service is automated and how to reach a person.

Where should we start? With collection scheduling for one type of test or one location, with a reviewed preparation base, an agreed metric and a handoff to a human. After a period of reviewed conversations, decide whether to expand, adjust or stop. Only then consider new flows, always keeping results and reports out of the agent's reach.

Sources

• ANPD: Autoridade Nacional de Proteção de Dados
• NIST AI Risk Management Framework
• OWASP Top 10 for LLM Applications
• Anthropic: Building effective agents