Patient services teams should drill a privacy failure in the most routine message they send: appointment reminders that carry another patient's name and clinic. In about 90 minutes, coordinators practise pausing the reminder agent to draft-only, escalating to the service manager, information governance and clinical safety, recording decisions and contacting affected patients with care.
What does a patient services drill rehearse?
Patient services coordinators manage bookings, reminders, cancellations, transport and patient enquiries in hospitals and clinics. A reminder agent typically sends appointment reminders at depth 3 within bounds, from the appointment system, which is sealed. Enquiry replies are drafted at depth 2. Any message suggesting a patient is unwell or at risk goes to a clinical person.
Health data is special-category data under GDPR, and HIPAA applies in the US. A reminder that names a clinic, such as a sexual health or oncology clinic, discloses health information to whoever reads it. The patient services manager owns the drill; a senior coordinator facilitates. Coordinators, the information governance lead, a clinical safety representative and IT take part. For the training needed to get a team ready, see how long it takes to train patient services teams to supervise AI agents.
The scenario
Monday, 08:15. A patient calls: the text she received this morning reminded "Mr J. Okafor" of his appointment at the oncology clinic, but the phone number is hers. A coordinator checks: during a weekend migration, the link between patient records and contact details shifted for a block of records. Overnight, the agent sent about 600 reminders; perhaps 150 went to the wrong person.
The drill step by step
- Person (facilitator): reads the scenario and starts the clock.
- Person (coordinator): thanks the caller, asks her to delete the message and escalates to the service manager.
- Person (service manager): pauses the reminder agent to draft-only. No further reminders go out unless a person approves them. The verdicts name the organisation's own limits.
- Person (service manager): escalates to information governance, clinical safety and IT.
- Person (IT): confirms which records were affected and fixes the contact link.
- Person (coordinator with IT): lists every reminder sent from affected records using the record and the appointment system.
- Person (information governance lead): assesses the breach and decides on notification under the rules that apply.
- Person (clinical safety): checks whether any patient missed an appointment because their reminder went elsewhere, and prioritises those needing urgent rebooking.
- Person (service manager): decides on patient contact, records each decision; the facilitator runs the debrief.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Alert | Has sent reminders | 3 | Taking the call, escalating |
| Pause | Holds every reminder | Dropped to 2 | Tightening limits |
| Escalate | Nothing new | 2 | Governance, safety, IT |
| Fix | Nothing | 2 | IT correction |
| Scope | Nothing new | 2 | Listing affected reminders |
| Breach and safety | Nothing | 2 | Assessments |
| Patients | Drafts contact messages | 2 | Calls and rebooking |
What makes this drill specific to patient services?
The appointment system was sealed and the reminder agent read it correctly. The fault sat in the link between records and contact details. Sealed does not protect against errors inside the system of record.
Two harms run in parallel: disclosure to the wrong person, and patients who did not receive their own reminder. Clinical safety must look at the second, because a missed oncology appointment matters more than an embarrassing text. The drill should make sure both are handled.
The debrief often leads to a new bound: the agent holds any reminder where the contact details changed within a set period before sending, so a person checks before it goes.
Coordinators should also rehearse what to say to a patient who calls about a reminder meant for someone else. They should thank the caller, ask them to delete the message, avoid confirming anything about the other patient, and log the call so information governance has a full picture.
Which controls does the drill test, and what evidence do they leave?
The pause. Evidence: the limit change in the record.
Scope. Evidence: the list of affected reminders and recipients.
Breach assessment. Evidence: the information governance decision and any notification.
Clinical follow-up. Evidence: patients identified as needing urgent rebooking, and each rebooking.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What should the patient services manager measure?
- Time from the first call to the pause.
- Time to identify every affected patient.
- Patients who missed appointments, and time to rebook each.
- Whether the contact-change bound was added before depth 3 returned.
Where do patient services drills go wrong?
Focusing only on the breach. The patients who did not get reminders may be at greater risk.
Mass messaging to correct it. A second message sent in a hurry can repeat the error. Fix the data first.
IT and patient services working apart. The fix and the patient contact depend on the same list.
Neighbouring drills cover related ground: the student services team drill deals with welfare in another setting, and the payroll team drill with personal data errors at scale. New reviewers can learn the steps through the reviewer onboarding checklist for a patient services team, and a structured plan is in the AI agent training plan template for patient services teams. The full method is in training teams for AI agents.
Where the Academy fits
Pryme Intelligence Academy's lessons can be read or listened to as audio, with highlights and notes, which suits coordinators who work on the phones. Module tests are set in the learner's own industry and role, so coordinators practise on bookings and reminders, and the Operator track's module on when something goes wrong mirrors this drill.
Questions people ask
Should reminders name the clinic?
Many organisations use neutral wording, such as the hospital name only, to limit disclosure if a message goes astray. Decide this with information governance.
Who calls a patient whose details were disclosed?
A coordinator or the information governance lead, following the organisation's breach process. The drill should rehearse what they say.
How often should patient services drill?
Twice a year, and after any change to the appointment system, contact data or the agent's depth.