AI Clinical Assistant, Powered by Live FHIR
An AI agent that answers plain-English questions from live FHIR data — with allow-list and PHI-redaction guardrails built in.
The workflow
The complete flow, exactly as it runs in the Workflow Builder. Scroll to explore, or use the zoom controls.
Requirements
Set up these connections in the Workflow Builder before importing or running this workflow.
Provides the FHIR search API the agent queries for patient resources (conditions, allergies, appointments). Backend auth keeps every request scoped to allowed resource types.
Hosts the LLM that interprets plain-English questions, decides which FHIR resources to fetch, and generates the PHI-redacted answer. Configured via environment credentials — no separate connection object required.
About this workflow
Ask a question about a patient in plain English — “find this patient and summarize their active conditions and allergies” — and get a clear, readable answer pulled straight from the live chart. This workflow is an AI agent that reads FHIR data on demand and reasons over it, wrapped in guardrails so it only ever fetches and returns what it's allowed to.
The problem
All the clinical data is in the EHR, but getting a fast, readable answer out of it usually means clicking through screens or hand-writing FHIR queries. The obvious fix — point an LLM at the data — is also the scary one: an AI with access to patient records has to be tightly boxed in, or it can wander into the wrong resources or leak PHI in its answer.
How it works
A question arrives over an API. The agent authenticates with Epic for a backend token, then an LLM (running on Bedrock) interprets the request and decides what to look up — searching by patient name or MRN first if needed, then fetching conditions, allergies, appointments and more through a FHIR search tool.
Two layers of guardrails keep it safe. A resource guardrail agent vets every tool call so only allowed resource types — Patient, Condition, AllergyIntolerance — get through. An output guardrail then redacts PHI patterns from the final answer before it leaves. The response comes back as clean, formatted HTML, with no raw IDs exposed.
Why it matters
You get natural-language answers that are grounded in real chart data instead of a model's guess — with the safety rails healthcare actually requires built right into the flow. The allow-list and PHI redaction are what separate a fun demo from an assistant you can put in front of clinical or patient users.
Who it's for
Teams building clinical copilots, patient-facing assistants, or internal “ask the chart” tools who want the convenience of an LLM combined with the access controls and PHI handling that healthcare demands.
How to build this workflow
Recreate it in the Workflow Builder by wiring these steps in order — or download it above and import it directly.
Step 1: Receive the Request
A trigger starts the agent — a chat question, an API call, or an inbound/outbound phone call.
Step 2: Authenticate & Set Context
Sign in to the EHR and load the context the agent needs — the patient, the conversation so far, and the tools it can use.
Step 3: The Agent Reasons
An LLM-powered agent interprets the request and decides what to do next.
Step 4: Use Tools & Take Action
The agent calls tools — searching FHIR data, asking the next question, placing the call — and loops until it has what it needs.
Step 5: Guardrails & Safety
Output passes through guardrails — PHI redaction, allowed-resource checks, red-flag escalation — before anything leaves.
Step 6: Respond
The agent returns its answer — text, a spoken reply, or a follow-up action like alerting a nurse.