Can AI Draft Patient Email Replies? A Practice Manager's Guide to Human Approval

A practice manager we spoke with had already decided against AI drafting once, after a demo where the vendor's assistant proposed a reply that quietly invented a dosage instruction that wasn't in the patient's file. Nobody caught it in the demo. The vendor moved on to the next slide. She didn't buy.

The question she was really asking, and the question most practice managers are actually asking when they say "can AI draft patient emails," isn't whether the technology is capable of writing a plausible-sounding reply. It obviously is. The real question is narrower and more useful: can it be trusted to draft, while a human stays in full control of what actually gets sent, and can that control be built into the workflow rather than left to whoever happens to be paying attention that day?

The short answer is yes, with a specific architecture. AI can draft. A named human reviews, edits, and approves every message before it reaches a patient. Some message categories should never reach the AI drafting layer at all. This guide covers exactly where that line sits, what the research says about the payoff, and how to build an approval workflow that survives contact with a busy Monday morning rather than looking good only in the vendor's demo.

Why "Can It Draft?" Is the Wrong First Question

Every AI vendor selling into medical practices can draft a competent-sounding email. That's not the differentiator it's marketed as. Large language models are good at plausible, well-formatted prose; drafting has never been the hard part.

The hard part, and the part that actually determines whether the deployment is safe, is what happens between the draft being generated and the message reaching the patient. That gap is where the workflow either has a real approval gate or doesn't. A vendor that leads with "our AI writes replies for you" and doesn't spend equal time explaining the review step is selling you half a system.

Research backs up why this gate matters more than raw drafting quality. Patients themselves set the condition: a JAMA Network Open study on patient attitudes found people are willing to accept AI-drafted portal messages, but specifically conditional on a clinician reading every word before it's sent, not a spot-check, not a sample audit, every message (Telehealth.org, summarizing the JAMA research). That's not a compliance nicety. It's the condition under which patients say they'll trust the system at all.

What the Research Actually Shows About the Payoff

Every vendor pitch claims AI drafting saves clinicians hours a day. The largest real-world study of it, run at Stanford Medicine on Epic's In Basket Art (the tool behind more than a million AI-drafted replies a month across 150+ health systems), found something more complicated: drafts did not produce a statistically measurable time saving. What they did reduce was cognitive load and reported burnout symptoms. Physicians using the drafts felt less depleted by the same volume of messages, even though the clock time barely moved.

That finding matters for how you evaluate a vendor. If a sales deck promises "save two hours a day," ask them to show the study it's based on. If they can't, they're quoting a number nobody has actually measured at scale. The honest pitch is: drafting reduces the mental tax of starting from a blank page on routine messages, and that's a real, defensible benefit, just not the one usually advertised. Our deeper breakdown of the inbox research covers the full numbers on triage and routing, which is where most of the measurable time savings actually sit, not in drafting itself.

The Three-Tier Approval Model

Not every message category should be treated the same way. A workable approval workflow separates messages into three tiers, and the vendor conversation you should be having is: does their product actually let you configure these tiers, or does it treat every message the same?

Tier 1: Auto-Draft, Human Approves Before Send

Routine, low-risk categories: appointment confirmations, reschedule requests, prescription refill requests that don't require a dosage judgment, general practice information (hours, parking, referral status). AI drafts, a named staff member reviews and clicks send. This is where the bulk of the volume, and the bulk of the genuine time saving, lives.

Tier 2: Auto-Draft, Clinician Approves Before Send

Anything touching clinical content: results questions, symptom descriptions, medication guidance, anything where the reply could be read as advice. The draft still helps, the clinician isn't starting from nothing, but the reviewer must be the clinician, not admin staff, and the review has to be a genuine read, not a rubber stamp. This is the tier the JAMA finding is actually about.

Tier 3: No AI Draft. Human-Originated Only

Complaints, anything involving a safeguarding concern, anything with legal or financial content (billing disputes, insurance appeals, a request that references a complaint already lodged), and any message where the sender is upset or the content is ambiguous enough that a wrong tone could do real damage. A well-configured system should be able to detect these signals and route the message to a human with no draft offered, not because the AI can't produce plausible text, but because plausible text is exactly the risk in this tier. A general rule worth adopting practice-wide: if the message could involve money, a legal interpretation, a complaint, a cancellation, or a refund, it gets human approval by default with no AI draft in the loop at all.

Why the Draft Itself Isn't the Risk. The Unreviewed Send Is.

The failure mode that actually damages a practice isn't a bad AI draft. Bad drafts get caught, edited, or discarded by a reviewer who's paying attention, which is exactly why the review step exists. The failure mode is an approval workflow that exists on paper but not in practice: a queue that gets rubber-stamped at the end of a long day, a "review" button that one overworked staff member clicks fifty times in a row without reading each message individually.

This is where AI agent guardrails and observability matter as much as the drafting model itself. Large language models are non-deterministic even with the temperature turned to zero: the same input can produce a different draft on a different day, and a model can hand back a perfectly formatted, grammatically clean message with logically wrong content, a dosage that isn't in the chart, an appointment date that doesn't match the record. That isn't a bug you patch once. It's a property of how the technology works, and it means guardrails at the input level, output validation before anything reaches a send queue, and full logging of every draft and every edit aren't optional extras, they're the difference between a system you can audit after an incident and one where nobody can reconstruct what happened.

There's a second, less obvious risk specific to inbox-connected AI: hidden prompt injection. Once an AI agent is reading raw email content to draft a reply, it inherits an attack surface a human reader doesn't fall for. An attacker can embed an instruction inside a message using white-on-white text or a near-invisible font, invisible to the staff member scanning the inbox, but read in full by the model parsing the raw content. Security researchers documented a real case in September 2025, "ShadowLeak," where this technique exfiltrated data from an AI email agent with no visible sign to the human operator. Indirect prompt injection, delivered through content rather than typed by a user, now accounts for more than half of observed attacks against AI systems. The practical implication for a practice: content parsed from an incoming email has to be treated as untrusted input by the system, not as a trusted instruction, regardless of how the drafting pipeline is wired internally. Every draft, and every action the AI takes based on message content, needs to be logged and reviewable, because the alternative is an incident nobody can reconstruct after the fact.

What a Reviewer Actually Needs to See

A common design mistake in early drafting-tool deployments is showing the reviewer only the AI's proposed reply, with no view of the original patient message or the reasoning behind the draft. That design saves screen space but makes genuine review nearly impossible; a reviewer skimming a well-formatted draft without the source message in view is far more likely to approve something that sounds right but has drifted from what the patient actually asked. A workable review interface shows the original message, the draft side by side, and ideally a confidence indicator or flag if the model's drafting confidence for that specific message fell below a threshold. This is a genuinely different product requirement than "generates a plausible reply," and it's worth asking a vendor to demo the reviewer's actual screen, not just the output, before evaluating whether their approval workflow is real.

Building the Approval Workflow: What to Actually Configure

A practice manager evaluating a vendor doesn't need to understand model architecture. There's a much simpler test that predicts, with real accuracy, whether an integration will be smooth: does the platform your practice already runs on (your shared inbox, your EHR, your patient messaging system) expose an API, an MCP server, or a documented integration path? If yes, an AI drafting layer can plug in cleanly, through the front door the vendor built on purpose. If no, the workaround is browser-based automation clicking through the same screens your staff use, which works but is more brittle and breaks every time the vendor moves a button. Ask this question before you ask anything about the AI model itself; it tells you more about how the project will actually go.

Once you know the integration path is sound, the configuration checklist for the approval workflow itself:

• A named reviewer per tier, not a shared queue anyone can clear. Accountability disappears the moment "someone on the team" is responsible for review.
• A hard block on Tier 3 categories reaching the drafting layer at all, configured at the routing level, not left to reviewer judgment.
• Full audit logging: every draft generated, every edit made, every approval, timestamped and attributable to a specific person.
• A defined escalation path for messages the classifier isn't confident about, routed to a human with no draft offered, rather than defaulting to "draft it anyway and let the reviewer sort it out."
• A review-quality spot check, a monthly sample of approved-and-sent messages checked against the original AI draft, to catch rubber-stamping before it becomes a pattern.

The Competitor Pulse Check

Frequently Asked Questions

Can AI draft patient email replies without a doctor reviewing them first?

It can technically generate a reply without review, but every credible deployment and the available patient-attitude research both point the same direction: patients accept AI-drafted messages only when a clinician has read every word before it's sent for anything touching clinical content. Sending unreviewed AI drafts to patients is a governance failure waiting to surface, not a shortcut worth taking.

What's the actual time saving from AI-drafted patient emails?

The largest independent study, run by Stanford Medicine on Epic's In Basket Art, found no statistically significant reduction in time spent per message. The measurable benefit was reduced cognitive load and burnout signal, not faster clock time. Treat any vendor's "saves two hours a day" claim as unverified until they can point to a comparable study.

Which message types should never go through AI drafting?

Complaints, safeguarding concerns, billing or insurance disputes, and anything with legal content. These should be routed directly to a named human with no AI draft offered, because the risk in this tier isn't drafting quality, it's a plausible-sounding automated response landing where a careful, personally-written one is required.

Is AI email drafting HIPAA compliant?

Compliance depends on the vendor's Business Associate Agreement, where data is processed and stored, and whether the audit logging meets your practice's requirements, not on the drafting feature itself. See our HIPAA compliance guide for AI in medical practices for what to check before signing a contract.

How is this different from AI email triage?

Triage decides what a message is and where it goes. Drafting proposes the actual reply text. They're often sold together but carry different risk profiles: triage is close to zero-risk misrouting aside, drafting carries the risk of a wrong or poorly-toned message reaching a patient if the approval step is weak. Our full guide to AI email triage covers the routing and prioritisation layer in depth.

What should I ask a vendor before buying an AI drafting tool?

Ask them to show you the approval workflow configuration screen, not just the drafting demo. Ask whether Tier 3 categories can be hard-blocked from ever reaching the drafting layer. Ask what the audit log actually captures. If they can only answer the first question well, that's a signal the product is optimised for the demo, not the deployment.

What's Next

The drafting model is the easy 20% of this project. The approval workflow, the audit trail, and the routing rules that keep sensitive messages away from automated replies entirely are the harder, more important 80%. If you're evaluating vendors or scoping an in-house build, our agentic AI for medical practice admin hub walks through the full architecture, and our shared inbox comparison for multi-doctor practices covers where drafting tools plug into the inbox platforms practices are already running. If you want a second opinion on a vendor's approval workflow before you sign, get in touch and we'll review it with you.