The short answer
Picture a ward where every AI suggestion pops up for a nurse to approve: by the afternoon, people click yes without reading. Approve nothing, and a wrong change can reach a patient’s chart unseen. The fix is to sort AI writes by what they can affect and how easily they can be undone, and keep human approval for the few that matter.
An AI agent should need human approval for EHR writes that act in the world or are hard to undo, and should be able to make low-reach, easily reversed writes alone, with every write read back afterwards. Sort each write by two questions: what can it affect? and how easily can it be reversed? That gives five tiers: read-only, write with read-back, write with approval, write with two approvers, and never. Most hospitals will find only a handful of write types belong in the approval tiers. Who decides the tiers is a clinical and governance question; this post is about the method, not about clinical judgement.
Deedglass
An AI-drafted order waits for a clinician
-
1The AI drafts
Medication order
Metformin 500 mg, twice daily
Bed 12 · AI scribe
Waiting for a clinician -
2A clinician decides
Why it was held
Medication changes need a clinician
DeclineApproveDr. N. Shah approved -
3Saved, then checked
- Saved to the record
- Read back: matches
Record sealedCheck it offline
Two questions for every write
Reach. Does the write stay inside the record, or does it trigger something? A draft note affects nothing until someone signs it. An active order can be picked up by a pharmacy or lab system and acted on. A message to a patient leaves the building.
Reversibility. Can the write be undone cleanly, and would anyone notice if it needed to be? A draft can be deleted. A signed document can be amended, but the original stays in history. A dispensed medication or a sent message can’t be recalled.
| Easy to reverse | Hard to reverse | |
|---|---|---|
| Stays in the record | Write, read back | Approval |
| Acts in the world | Approval | Two approvers, or never |
The five tiers
| Tier | Agent may | Control | Typical examples |
|---|---|---|---|
| 0. Read-only | Read and search | Narrow scopes; log access | Looking up results, history |
| 1. Write, read back | Create or update | Read back every write; alert on mismatch | Draft notes, administrative tags, tasks for staff |
| 2. Approval | Draft only | A named person activates | Orders, problem-list changes, documents sent outside |
| 3. Two approvers | Draft only | Two different people | High-risk orders as your clinical leads define them; bulk changes |
| 4. Never | Nothing | Credentials can’t do it | Deleting records, changing audit data, merging patients |
Tier 2 depends on FHIR’s request model: an agent writes a request as status: draft with intent: proposal, which R4 defines as not ready for action and carrying no authority to act.34 A person’s action makes it an active order. Our post on draft orders and sign-off shows the fields.
India’s ICMR guidelines on AI in healthcare say human oversight and manual override mechanisms must be compulsory for AI technologies that can cause severe or bodily injuries.7 Tiers 2 to 4 are one way to put that into practice for EHR writes.
A worked example for common FHIR resources
This is an illustration of the method for a hypothetical hospital, not a recommendation for yours.
| FHIR resource and action | Reach | Reversible? | Tier |
|---|---|---|---|
| Patient, Observation: read | None | n/a | 0 |
| DocumentReference: create AI draft note | In record | Yes | 1 |
| Task: create a to-do for staff | In record | Yes | 1 |
| Observation: create from a device feed | In record | Amend only | 1 or 2 |
| Condition: add to problem list | In record, shown widely | Amend only | 2 |
| ServiceRequest: lab order | Acts in the world | Cancel before collection | 2 |
| MedicationRequest: order | Acts in the world | Hard after dispensing | 2 or 3 |
| Communication: message to patient | Leaves the building | No | 2 or 4 |
| Patient: merge or delete | Whole record | Very hard | 4 |
What your EHR lets an agent write at all will narrow this. Epic’s public sandbox capability statement, for example, lists create for AllergyIntolerance and Condition, create and update for Observation, DocumentReference and ServiceRequest, and only read and search for MedicationRequest; each customer’s configuration may differ.1 Start from what the server allows, then tier within it.
Enforce the tiers below the agent
A tier written in a policy document and enforced only by the agent’s prompt isn’t a control. Put it where the agent can’t talk its way past:
- Scopes. SMART v2 scopes name exact interactions per resource, such as
patient/Observation.rsfor read and search, and can be narrowed with query parameters.2 Give tier 0 resources read scopes only. - A gateway or policy layer between the agent and the FHIR server that holds tier 2 and 3 writes for approval and refuses tier 4 outright.
- Field rules. The agent’s identity can’t set
status: active,intent: order, or a practitioner asrequester. - Read-back for every tier 1 to 3 write, so a write that said success but stored something else is caught.
- Records of who approved each held write, so the tier is visible after the fact.
Why fewer approvals can be safer
It’s tempting to require approval for everything. The research on alerts says that backfires. In a study of 112 primary care clinicians, the likelihood of accepting a reminder fell by 30% for each additional reminder per encounter.5 A systematic review of automation bias lists workload, task complexity and time pressure among the things that make people over-rely on automated suggestions.6
An approval queue is a stream of alerts. If 200 low-risk drafts sit beside three real orders, the three get the same two-second glance as the 200. Keeping tiers 2 and 3 small is what lets reviewers actually read what’s in them. Our post on alert fatigue and approvals has more.
Questions people ask
Should an AI agent ever write to the EHR without approval?
For tier 1 writes, low reach and easy to reverse, yes, provided every write is read back and mismatches alert someone. Requiring approval for them crowds out the reviews that matter.
Who should decide the tiers?
Clinical leads decide which writes are high-risk; IT enforces the tiers; governance reviews them. The method helps them talk about the same thing.
What about writes the EHR doesn’t expose through FHIR?
They can’t be tiered through FHIR controls. If an agent reaches them some other way, such as screen automation, the same tiers apply, but enforcement is harder.
To see a tier 2 hold in action on synthetic data, run npx deedglass health pilot; one scene holds a high-risk order for a clinician.8 The healthcare overview and the record spec show how approvals get recorded. To try approvals and read-backs on a real database in your browser, open the playground; to grade what an agent can reach on your own machine, run npx deedglass scan (the grade, explained).
Written with AI assistance and checked against our claims register.