What healthcare administration teams use it for
The work that fits is the work that already runs on templates and judgment calls about wording: letters, messages, forms and answers to the same twenty policy questions. Each job below lists the templates and tools that do it. Every template is free to copy and needs no account or key.
Patient letters people can read
Paste the notice your practice management system produces, such as a referral status, a balance due or a “please call to schedule” letter, and have the prompt rewrite it at about a sixth-grade reading level. The prompt keeps every date, amount and phone number exactly as written and refuses to explain any result or diagnosis, which it hands back to the care team in a fixed sentence. A translation pass then drafts the Spanish or Vietnamese version from the approved English one, for a qualified translator to review.
Rewrite expert text in plain languageTranslate for local readersPrompt GraderVersion Compare
Prior authorization drafts
Most of a prior authorization is copying: codes, dates of conservative treatment, prior imaging and the ordering clinician, moved from the visit note into the payer’s form. An extraction prompt returns those fields as JSON and writes “not found” for anything the note does not say, so a coordinator sees the gaps before the payer does. A second prompt checks the draft letter of medical necessity against the chart excerpt and flags any sentence the chart does not support. The clinician still decides what is medically necessary and signs.
Extract fields from documents into JSONCheck a draft’s claims against your sourcesPrompt TesterModel Compare
Scheduling and reminder messages
Reschedules, no-show follow-ups and prep instructions are short, high-volume and easy to get subtly wrong. Rewrite your saved portal and text replies so they sound like your front desk, and set a length check so a text stays inside one message. Prep instructions should come from the department’s approved sheet pasted into the prompt, never from the model’s memory of how a colonoscopy prep usually works.
Rewrite a saved reply so it sounds like a personReply to an upset customerPrompt TesterMy Prompts
Sorting the portal inbox
A triage prompt sorts non-clinical portal messages into billing, scheduling, records requests and forms, and sends anything that mentions a symptom, a medication or a test result straight to the clinical queue untouched. That last rule is the one to test hardest. In the Prompt Tester, give it twenty real messages with the right queue as the expected answer, and treat a single clinical message routed to billing as a failed suite.
Sort a batch of emails by what needs youTriage support tickets into JSONPrompt Tester
Policy and payer-rule answers for staff
New staff ask the same questions: which payers need a referral on file, how long a self-pay estimate stays valid, who can approve a write-off. An internal assistant that answers only from your policy manual and the payer bulletins you paste, cites the section, and says “not in the policy” when it is not, saves the office manager a dozen interruptions a day. If the assistant reads documents or emails from outside, test it for prompt injection before staff rely on it.
System prompt for an internal policy Q&A assistantDocument answerer that cites sourcesChatbot Safety Test
Complaints and online reviews
A reply to a one-star review has one rule that matters more than tone: it must not confirm that the reviewer is a patient or say anything about their visit. Put that rule at the top of the prompt, give it your standard “please call our practice manager” line, and keep a person between the draft and the post. Written complaints that arrive by letter or portal get the same care, with the facts supplied by whoever investigated.
Reply to a negative online reviewReply to an upset customerPrompt Grader
Procedures and front-desk training
Turn the check-in, eligibility and end-of-day reconciliation steps that live in one person’s head into a written procedure, then into a first-week guide and a training session for the next hire. These drafts need no patient information at all, which makes them the best place for a team to start.
Turn a messy process into an SOPWrite a new hire’s first-week guidePlan a training session
A worked example: imaging prior authorizations
Take a hypothetical four-physician orthopedic practice that sends about forty MRI prior authorizations a week, each assembled by hand from the visit note. The goal is not to automate the decision. It is to have the form fields filled and the gaps listed before the coordinator opens the payer portal, so the coordinator spends the time on the cases that need a call to the clinic.
- 1Start from the extraction templateList the fields the payer’s form asks for: codes, dates of prior treatment, imaging already done, the ordering clinician.
- 2Grade it before anyone relies on itThe free estimate flags what is missing, such as what to do when a field is not in the note. No key needed.
- 3Test it on de-identified past requestsTwelve cases with known answers. Checks: valid JSON, the right keys, and not found instead of a guess.
- 4Compare models on the hardest caseRun the longest, messiest note on three models side by side and read where they differ.
- 5Price the monthEnter the weekly volume and see what each passing model costs.
- 6Save the version that passedKeep it with its history, and diff it against the new version when a payer changes its criteria.
The test cases are the part to take seriously. Build them from past requests with the 18 Safe Harbor identifiers removed, or write synthetic notes that copy the shape of real ones: the note that lists two different dates for physical therapy, the one with no prior imaging, the one where the diagnosis code in the header does not match the assessment. Those are the cases where a model is most tempted to fill a gap, and a check that fails on any invented date is worth more than a high average score.
Running the suite in the Prompt Tester or Model Compare needs an API key from a model provider. For de-identified test data any key works. For real patient data, see the guardrails below before you choose one.
What it costs
The chart prices a hypothetical multi-site practice whose admin staff send about 400 drafts a working day across patient letters, reminder texts, prior authorization drafts and policy questions, over 22 working days. Each call carries about 3,000 tokens in (a 1,500-token instruction block plus the notice, note excerpt or question) and about 500 out. The instruction block is the same on every call, so half the input is read from cache. That comes to roughly 26 million input tokens and 4 million output tokens a month.
A hypothetical multi-site practice: 400 drafts a working day for 22 working days. Monthly cost of 8,800 calls with about 3,000 tokens in and 500 out each, 50% of the input read from cache. List prices checked October 20, 2026; your bill may differ.
Two things matter more than the gap between rows. First, the model has to pass your suite: a cheap model that invents a treatment date is the expensive choice. Second, for anything with patient information the model has to be available under an agreement your compliance team accepts, which may rule out some rows before price comes into it. Use the cost calculator to try your own volumes.
A sample prompt
A short prompt for the patient-letter job. The words in double braces are blanks you fill in, or that your system fills in for each letter.
You draft letters for the front office of {{practice_name}}.
A staff member reviews and sends every letter.
Rewrite the notice below as a letter a patient can understand
on first reading.
Notice from our system:
"""
{{system_notice}}
"""
Rules:
- Keep every date, time, amount, address and phone number
exactly as written.
- Aim for a sixth-grade reading level: short sentences, no
abbreviations a patient would not know.
- Do not explain or comment on any test result, diagnosis or
treatment. If the notice mentions one, write only: "Your care
team will talk with you about this."
- End with what the patient should do next and the number to
call: {{callback_number}}.
- If anything in the notice looks incomplete, do not guess.
Add a first line starting "CHECK:" that says what to confirm.
Keep it under 180 words.
Paste it into the Prompt Grader to see its score for free, then put five real notices with the identifiers removed through the Prompt Tester with three checks: the callback number appears, the output stays under 180 words, and the words “diagnosis” and “results show” never appear.
Guardrails
This is practical guidance for admin teams, not legal advice. Your privacy officer and compliance team decide what your organization allows.
Patient information goes only to tools under a BAA
Under HIPAA, a service that creates, receives, maintains or transmits protected health information for a covered entity is a business associate, and HHS’s cloud computing guidance says using one without a business associate agreement violates the rules. An AI model provider that receives patient details is in that position. Whether a provider will sign a BAA, and for which products and plans, varies, so ask for the specific product your team will use. Free consumer accounts and free API tiers are not the place for patient data.
The thinkhard.si tools run in your browser and send prompts straight to the provider on your own key. thinkhard.si never receives them. That keeps one party out of the picture. It does not answer the BAA question, which is about the provider.
Send the minimum necessary
HIPAA’s minimum necessary standard applies to these workflows like any other. A prior authorization draft needs the relevant visit notes and codes, not the whole chart. A reminder text needs a first name, a time and a location. Build the prompt so it asks only for what the job uses.
Test with de-identified or synthetic cases
Test suites get exported, shared and kept. Write them from records with the identifiers listed in HHS’s de-identification guidance removed, or invent cases that copy the structure of real ones. A suite of twelve good synthetic cases tests a prompt better than two hundred real ones nobody can share.
Clinical content stays with clinicians
No prompt on this page interprets results, triages symptoms or decides medical necessity, and none should. Write the boundary into the prompt (“do not explain any result”), test it with a “Does not contain” check, and route anything clinical to licensed staff. A model can be confidently wrong, which the glossary calls a hallucination, and in a patient letter that error has a name and an address attached.
Machine translations get a human reviewer
For organizations covered by Section 1557 of the Affordable Care Act, the 2024 rule at 45 CFR 92.201(c)(3) says a machine translation of text that is critical to a patient’s rights, benefits or access, or where accuracy is essential, must be reviewed by a qualified human translator. Budget for that review when you plan translated letters.
Never confirm a patient in public
HHS has settled with several practices that disclosed patient information while replying to online reviews, including a 2023 agreement with a New Jersey provider. A reply drafted by AI is still your reply.
- Staff procedures: Patient data the job needs 1/10, Harm if a draft goes out wrong 2/10
- Policy answers: Patient data the job needs 2/10, Harm if a draft goes out wrong 5/10
- Review replies: Patient data the job needs 2/10, Harm if a draft goes out wrong 8/10
- Reminder texts: Patient data the job needs 6/10, Harm if a draft goes out wrong 3/10
- Patient letters: Patient data the job needs 7/10, Harm if a draft goes out wrong 6/10
- Inbox sorting: Patient data the job needs 8/10, Harm if a draft goes out wrong 7/10
- Prior auth drafts: Patient data the job needs 9/10, Harm if a draft goes out wrong 9/10
Placement is a judgment, not a measurement. Start in the bottom left, where a team learns the tools without any patient data.
Key takeaways
- The best fits are letters, reminder texts, form filling, inbox sorting and policy answers: paperwork, not care.
- Patient information goes only to a model provider under a BAA your organization has accepted, and only the minimum the job needs.
- Prompts should say “not found” or “CHECK:” instead of guessing, and your tests should fail any invented date, code or amount.
- Build test suites from de-identified or synthetic cases so they can be shared and kept.
- Start with procedures and training material, which need no patient data at all.
Related templates, guides and posts
Questions
Can we paste patient information into an AI tool?
Only into a tool your organization has approved for protected health information, which in practice means a model provider that has signed a business associate agreement covering the product you use, and only the minimum the task needs. The thinkhard.si tools send prompts from your browser straight to the provider on your key, so the provider is the party the agreement has to cover.
Can AI decide whether a prior authorization meets the payer’s criteria?
No. A prompt can map the documentation to the payer’s listed criteria and list what is missing, which saves a coordinator real time. Whether the service is medically necessary is the clinician’s judgment, and the coverage decision is the payer’s.
Do we need an API key to use these tools?
Not to start. The templates, the Grader’s free estimate, the cost calculator, the diff and the library need no key. Running a test suite in the Prompt Tester, comparing models in Model Compare or attacking a prompt in the Chatbot Safety Test needs a key from a model provider. Use your organization’s key, under its agreement, for anything with patient data.