Emergency Call Triage Routing

The riskiest sixty seconds in a clinic happen on the phone. Someone calls, and a person with no clinical training has to decide, in real time, whether this is a prescription refill or a stroke. Most of the time they get it right, because they have been doing it for years and they can hear it in a voice. But the line is also ringing with eleven other calls, the hold queue is four deep, the lunch cover is a temp, and the only mechanism separating urgent from routine is one receptionist's pattern-matching under load.

So two opposite failures happen simultaneously. Urgent calls get queued behind routine ones, because the queue is first-in-first-out and nothing in the system knows the difference. And routine calls get escalated to the clinical team by a cautious front desk, which floods the nurse line and trains the nurses to treat escalations as noise, which is exactly the condition under which a real one gets missed. After hours it is worse: the voicemail greeting says to call 911 in an emergency, the caller does not listen to the greeting, and the message sits until morning.

Where it costs money is mundane next to where it costs more than money. Abandoned calls are lost new patients and lost visits. A practice that drops a meaningful share of inbound calls at lunchtime is paying for marketing that rings out. Over-escalation burns clinical time that should be seeing patients. Under-escalation is a patient harm event and a liability exposure, and no amount of operational efficiency is worth increasing its probability by one percent. That constraint shapes this entire build: the automation's job is to collect, to route and to repeat the emergency instruction every time, and never to decide how sick anyone is.

The non-negotiable design rule

Before the inventory, the rule that governs it. The AI agent does not triage. It does not assess severity, grade urgency, estimate risk, interpret a symptom, offer reassurance, suggest whether something can wait, recommend a home remedy, or decide that a call is routine. It performs three jobs: it states the emergency instruction, it captures what the caller says, and it hands the call to a human on a path chosen by rules that a clinician wrote. Every ambiguous case escalates. Every unrecognised case escalates. A failure of the routing logic must fail toward a human, never toward a queue.

This is not a compliance posture bolted on afterwards. It is why the build is structured the way it is, and anyone configuring it should treat any proposal to let the agent "just quickly check whether it is serious" as a defect.

Pipeline and stages

A Contact Routing pipeline records every inbound contact as a routing event, so the practice can audit what happened to every call.

• Received: contact captured, emergency statement delivered, intent not yet established.
• Emergency Instruction Given: caller indicated or the agent detected possible urgency; the fixed safety instruction was delivered and the call was transferred or escalated. Terminal for the agent.
• Clinical - Transferred Live: handed to a clinical staff member on the call.
• Clinical - Callback Queued: no clinical staff available to take it live; queued with a clock and a named owner.
• Clinical - On-Call Paged: after-hours path, on-call clinician paged, acknowledgement pending.
• Administrative - Self-Served: resolved by the agent without a human: booking, directions, hours, forms link.
• Administrative - Front Desk Queued: routed to the front desk task board.
• Billing: routed to the billing owner.
• Abandoned: caller hung up before resolution. Recovery sequence runs.
• Routing Incident: something went wrong: an escalation that was not acknowledged, a misroute found on review, a failover event. Reviewed weekly with a clinician.

Calendars

• Clinical Availability Calendar: which clinical staff are available to take a transferred call, in which time band, at which location. The routing engine reads this; it is the difference between a live transfer and a queued callback.
• On-Call Rotation Calendar: after-hours and weekend coverage, one primary and one secondary per window, maintained by the practice manager. Gaps in this calendar are the single most dangerous configuration error in the build.
• Nurse Callback Calendar: bookable fifteen-minute clinical callback slots, held for the clinical team, not publicly bookable.
• Front Desk Shift Calendar: drives administrative routing and the open-hours definition.

Custom fields

• contact_channel: option: Inbound Call, Inbound SMS, Web Chat, Web Form, Voicemail, Patient Portal.
• stated_reason_verbatim: long text. The caller's own words, captured as given and never paraphrased by the agent into a clinical category.
• routing_path: option: Emergency Instruction, Clinical Live, Clinical Callback, On-Call Page, Administrative, Billing, Self-Served, Abandoned.
• emergency_statement_delivered: switch. Must be true on every single clinical-path record. A false value here is an incident.
• emergency_statement_timestamp: date-time.
• escalation_trigger: option: Caller Said Emergency, Keyword Match, Caller Requested Nurse, Agent Could Not Classify, Caller Distressed, Third Party Calling, Silence or No Input, Agent Error.
• escalated_to: text, the named human or role.
• escalation_acknowledged_at: date-time. The field the whole safety story rests on.
• clinical_callback_due_at: date-time, from the practice's own clinical callback standard.
• callback_completed_at: date-time, stamped by the clinician.
• caller_relationship: option: Patient, Parent or Guardian, Caregiver, Another Practice, Pharmacy, Other. Drives what may be discussed at all.
• identity_verified: switch, with the verification method recorded separately.
• age_band: option, where the practice routes paediatric contacts differently.
• language_requested: option, and whether an interpreter was connected.
• recording_consent: option: Granted, Declined, Not Applicable, plus the jurisdiction rule applied.
• transcript_contains_clinical: switch. True restricts the transcript to clinical roles and blocks it from any outbound templating.
• sms_consent, sms_consent_date, preferred_contact_channel.

Tags

• emergency-instruction-given: applied on every urgency path, no exceptions.
• clinical-escalation, clinical-callback-open, clinical-callback-overdue
• on-call-paged, on-call-unacknowledged: the second of these is a page-the-owner condition.
• unclassified-escalated: the agent could not understand and escalated. Count these; a rising count means the intent model needs work, and under-escalating is never the fix.
• caller-distressed: detected distress or a third party calling on someone's behalf. Always escalates.
• abandoned-recovery, abandoned-unrecovered
• routing-incident, reviewed-by-clinician
• minor-contact: drives the guardian and consent rules the practice's counsel has specified.
• interpreter-used, interpreter-unavailable

Forms

• Clinical Escalation Record: the internal form the receiving human completes: what the caller said in their own words, what was decided, by whom, and the disposition. This is the clinical documentation handoff, and it must write into the chart rather than living only in the platform. Its existence is what makes the escalation defensible.
• On-Call Acknowledgement: one tap by the on-call clinician confirming receipt, stamping escalation_acknowledged_at. Separate from completing the callback.
• Administrative Request: the non-clinical intake, a controlled list only, feeding the front desk board.
• Routing Incident Report: completed by whoever finds a misroute, a missed escalation or a failover event. Short, blameless, and reviewed weekly.
• Weekly Call Review Sample: the internal form a clinician uses to review a sample of escalation records against the practice's own standard.

BO's role and guardrails

BO answers the phone and the chat. What BO does:

• Delivers the emergency instruction first, on every single contact, before anything else is asked. Not at the end, not conditionally, not only to callers who sound unwell.
• Asks one open question (what the caller needs) and captures the answer verbatim.
• Routes by rules a clinician wrote. Non-clinical intents it can serve, it serves: hours, directions, parking, booking, forms, a balance inquiry handoff. Everything else goes to a human.
• Transfers live where clinical staff are available, with a whisper naming the caller's own words and the record.
• Documents the routing event completely, so the audit trail exists.

What BO must never do, enforced in the prompt, in the call flow and in the review process:

• Never assess severity or urgency. No grading, no scoring, no "that sounds like it can wait until Monday", no "that does not sound like an emergency". BO has no clinical judgment and must never simulate one.
• Never give clinical advice. No home care, no medication guidance, no "take paracetamol", no "drink fluids", no "keep an eye on it", no interpretation of a symptom, test result or medication.
• Never ask clinical screening questions. BO does not ask how severe the pain is, how long it has been going on, whether there is bleeding, or anything else that constitutes taking a history. Asking the question implies the answer will be acted on, and BO cannot act on it.
• Never delay or gate an escalation. No "let me just check a couple of things first". The moment urgency is indicated, the emergency instruction is delivered and the transfer begins.
• Never reassure. Reassurance is a clinical act.
• Never decide not to escalate. If BO cannot confidently classify a contact as non-clinical, it escalates. Unclassified always means human.
• Never hold a caller in a queue once urgency is indicated. If no human answers, the path is the hard failover in workflow 9, not hold music.
• Never collect identifiers or clinical detail over SMS, and never put clinical content into an outbound message.

Numbers and channels

• Main inbound number, answered by BO with the emergency statement as the first words spoken, and a zero-out to a human available at every point in the flow including during the statement.
• Clinical line: a separate direct number published to patients for clinical questions, which rings the clinical team directly and is never answered by an AI agent. Having this number exist reduces the load on the routing logic more than any amount of tuning.
• After-hours path: the main number's out-of-hours flow, which delivers the emergency statement, then offers one choice: an urgent clinical matter, which pages the on-call rotation, or a non-urgent matter, which takes a message into the front desk board.
• On-call paging: voice call plus SMS to the primary on-call, escalating to the secondary and then to the practice owner on non-acknowledgement.
• Front desk SMS number: two-way, with urgency interception on every inbound message and an explicit after-hours auto-reply.
• Web chat: same urgency interception, same fixed safety response, with a persistent visible line at the top of the widget naming emergency services.
• Overflow and failover: a defined destination if the platform, the carrier or the internet connection fails. Usually a direct carrier-level forward to a mobile held by the front-desk lead, configured at the carrier and tested monthly.

1. At 11:20 the main number rings. BO answers and the first words are the emergency statement: "Thanks for calling {{custom_values.practice_name}}. If this is a medical emergency, hang up and call 911 or go to your nearest emergency room. I am an assistant: I cannot give medical advice. How can I help?" emergency_statement_delivered is set true and timestamped before the caller says anything.
2. The caller says they need to move Thursday's appointment. BO captures the verbatim, classifies the intent as Appointment Change (a non-clinical intent on the approved self-serve list) and offers the next available slots from the eligible calendar.
3. The appointment is moved, routing_path is set to Self-Served, and the routing event is filed in Administrative - Self-Served. Total time, under ninety seconds, and no human was involved.
4. At 11:24 the next call comes in. Same emergency statement. The caller says "I have been having chest tightness since last night and I do not know if I should come in."
5. BO does not ask a single follow-up question. The urgency lexicon matches on the first utterance. BO delivers the fixed escalation response: "I am not able to help with medical questions or tell you how urgent this is. If you are having chest pain or trouble breathing, hang up now and call 911. Otherwise, stay on the line and I will put you straight through to our clinical team." escalation_trigger is set to Keyword Match.
6. BO reads the Clinical Availability Calendar, finds a nurse available, and transfers live with a whisper: "Clinical call, caller's words: chest tightness since last night, record identifier on screen." routing_path is Clinical Live, the event moves to Clinical - Transferred Live, and the clock stops when the nurse picks up.
7. The nurse handles it clinically (which is the only place clinical judgment happens in this entire system) and completes the Clinical Escalation Record, which writes into the chart.
8. At 11:31 a third call. The caller is upset, speaking quickly, and BO cannot classify the intent after one clarifying attempt. Rather than asking again, BO escalates: escalation_trigger Agent Could Not Classify, tag unclassified-escalated, emergency instruction repeated, and the call transfers to the front desk with the verbatim on screen. Unclassified always means human.
9. At 11:38 a call comes in and no clinical staff are available: both nurses are with patients. BO delivers the emergency instruction again, states plainly that a clinician will call back, and queues it: routing_path Clinical Callback, clinical_callback_due_at computed from the practice's own clinical callback standard, event in Clinical - Callback Queued, and an immediate alert to the clinical team and the practice manager. The caller is told the timeframe, not left guessing.
10. Thirty minutes before clinical_callback_due_at, the callback is still open. The clinical lead gets an escalating alert; at the due time, the practice manager is paged and a routing incident is opened. A clinical callback that breaches its clock is an incident, not a backlog item.
11. At 19:50, after hours, the main number rings. The out-of-hours flow delivers the emergency statement, then the single branch: urgent clinical matter, or non-urgent. The caller presses urgent. BO captures the verbatim and the callback number, repeats the emergency instruction, and pages the primary on-call by voice and SMS simultaneously.
12. The primary does not acknowledge within the practice's acknowledgement window. The secondary is paged. Still nothing, so the practice owner is paged and the caller receives a call from BO with one message: "I am still working on reaching our on-call clinician. If your symptoms are worsening at all, please call 911 or go to your nearest emergency room now." No reassurance, no estimate, the safety instruction repeated.
13. The secondary acknowledges at 19:56. escalation_acknowledged_at is stamped, tag on-call-unacknowledged is removed, and the clinician calls the patient and completes the escalation record.
14. At 20:40 someone calls and hangs up after eleven seconds, during the emergency statement. The abandoned-call recovery fires: within two minutes BO attempts one callback, and if unanswered sends an SMS that leads with the emergency instruction and the clinical line number, because a caller who abandoned during the safety statement is exactly the caller you cannot afford to assume was calling about parking.
15. On Friday a clinician reviews a sample of the week's escalation records against the practice's own standard, flags one call where the transfer was slower than it should have been, and files a routing incident. The weekly safety report counts escalations by trigger, acknowledgement times, callback breaches, unclassified rate and abandoned-unrecovered count. That review is a permanent part of running this build, not a launch activity.

1. Inbound Call Answer and Mandatory Emergency Statement

Trigger: any inbound call to the main number, the after-hours flow, or any tracked number.

Actions in order:

1. Answer within two rings. Create a routing event in Received, write contact_channel Inbound Call, and attempt a match on caller ID without asserting identity.
2. Speak the emergency statement as the first words, every call, with no condition on it: "Thanks for calling {{custom_values.practice_name}}. If this is a medical emergency, hang up and call 911 or go to your nearest emergency room. I am an automated assistant and I cannot give medical advice or tell you how urgent something is. Press zero at any time for a person. How can I help you today?" Set emergency_statement_delivered true and stamp emergency_statement_timestamp.
3. Apply the recording notice the practice's jurisdiction requires, in the wording its counsel approved, and write recording_consent with the rule applied. Where consent is required and declined, continue the call without recording rather than refusing the call.
4. Enable zero-out to a human at every point in the flow, including during the statement. A caller must never be trapped with an automated agent.
5. Capture the caller's response verbatim into stated_reason_verbatim. Do not paraphrase, do not summarize into a clinical term, do not normalize "my chest is tight" into "chest pain". The verbatim is the clinical handoff and the audit record.
6. Pass to workflow 2 for classification.

Stop and exit conditions: caller presses zero, which transfers immediately; caller hangs up, which starts workflow 5; silence or no input twice, which escalates to a human rather than repeating the menu, with escalation_trigger Silence or No Input. The statement is never skipped, never shortened, and never moved later in the flow. A call record with emergency_statement_delivered false is a routing incident and must alert.

2. Intent Classification and Non-Clinical Self-Service

Trigger: verbatim captured in workflow 1, or a web chat or SMS conversation opened.

Conditions and branches:

1. Urgency and clinical screen runs first and wins over everything. If the verbatim matches the urgency lexicon or any clinical term, go immediately to workflow 3. No further questions.
2. Classify against the closed non-clinical allowlist only. BO may self-serve exactly these: opening hours; location, directions and parking; booking, rescheduling or canceling an appointment; what to bring to a visit; forms and registration links; requesting a callback about a bill; requesting records through the regulated intake path; general service availability. Nothing else. This is an allowlist, not a blocklist, anything not on it goes to a human, which is the opposite of how a sales chatbot is usually built and is the correct construction here.
3. Confidence gate. If BO's classification confidence is below the configured threshold, or the caller's intent spans both a clinical and a non-clinical matter, escalate. Set escalation_trigger Agent Could Not Classify and tag unclassified-escalated. One clarifying question is permitted; a second is not. A second attempt is how a caller with a real problem gets stuck in a loop.
4. Third-party branch. If the caller is not the patient (a parent, a caregiver, another practice, a pharmacy) write caller_relationship and escalate to a human. BO does not navigate who may be told what. Where the contact concerns a minor, tag minor-contact and apply the guardian and consent rules the practice's counsel specified.
5. Distress branch. If the caller is crying, shouting, incoherent, or says anything about being frightened or alone, tag caller-distressed, repeat the emergency instruction, and transfer to a human immediately regardless of stated intent.
6. Self-serve path. For an allowlisted intent, complete the action (book the slot, send the link, create the front desk task) then close with "Anything else? And remember, for anything medical please call our clinical line on {{custom_values.clinical_line}}, or 911 in an emergency." Set routing_path Self-Served or Administrative.
7. Billing branch. Capture the request, create a Billing Question task on the front desk board, and state the callback timeframe. BO does not discuss balances, coverage or denials.

Stop and exit conditions: intent served; escalation fired; caller abandoned. Every exit writes routing_path and files the routing event. There is no exit in which BO has decided a clinical matter is not urgent, because that branch does not exist in the flow.

3. Clinical Contact Capture and Immediate Human Escalation

Trigger: urgency lexicon match; any clinical term; caller asks for a nurse or doctor; caller says the word emergency or urgent; classification failure; distress detected; third party calling about a patient.

Actions in order, with no waits anywhere in the clinical path:

1. Deliver the fixed escalation response immediately. "I am not able to help with medical questions, and I cannot tell you how urgent this is. If this is an emergency, or if you are having chest pain, trouble breathing, severe bleeding, or you think someone's life is at risk, hang up now and call 911 or go to your nearest emergency room. If you can stay on the line, I will put you straight through to our clinical team." Repeat the emergency instruction even if it was given forty seconds earlier in workflow 1. Repetition is the design.
2. Set routing_path, escalation_trigger, tag clinical-escalation and emergency-instruction-given, and set transcript_contains_clinical true so the transcript is restricted to clinical roles and blocked from outbound templating.
3. Read the Clinical Availability Calendar. Branch A, clinical staff available: transfer live with a whisper carrying the caller's verbatim and the record identifier: never BO's interpretation of it. Move to Clinical - Transferred Live. Stamp escalation_acknowledged_at on pickup.
4. Branch B, no clinical staff available during open hours: do not hold the caller. Say "Our clinical team are all with patients right now. I am going to have one of them call you back, and the standard for that is {{custom_values.clinical_callback_standard}}. If anything gets worse in the meantime, please call 911 or go to your nearest emergency room." Confirm the callback number by reading it back. Set clinical_callback_due_at, move to Clinical - Callback Queued, and alert the clinical team and the practice manager immediately, not on a timer.
5. Branch C, outside open hours: hand to workflow 4.
6. In every branch, create the Clinical Escalation Record prefilled with the verbatim, the channel, the time and the trigger, assigned to the receiving human. The human completes the clinical content; BO completes only the routing facts.
7. If the transfer fails (no answer, line busy, technical failure) do not return the caller to the menu. Go straight to Branch B, and additionally open a routing incident. A failed clinical transfer is always an incident even if the callback then goes fine.

Stop and exit conditions: live transfer connected; callback queued with an owner and a clock; on-call paged. There is no exit condition in which the contact ends without a human owning it. BO never asks a clinical follow-up question at any point in this workflow, and never offers an appointment as an alternative to clinical contact.

4. After-Hours On-Call Escalation Ladder

Trigger: inbound call, SMS or chat outside the hours on the Front Desk Shift Calendar, or on a practice closure day.

Actions in order:

1. Deliver the emergency statement as in workflow 1, with the out-of-hours variant: "...our office is closed. If this is a medical emergency, hang up and call 911 or go to your nearest emergency room now."
2. Offer exactly two choices, and no more: press 1 for an urgent clinical matter that cannot wait until we reopen; press 2 to leave a message for the office. Two options, because an after-hours menu with six branches is a menu nobody navigates correctly at ten at night.
3. Press 2 branch: capture the message, create a front desk task due at opening, confirm the timeframe, repeat the emergency instruction, end.
4. Press 1 branch: capture the verbatim and read the callback number back. Repeat the emergency instruction. Then page the primary on-call from the On-Call Rotation Calendar by simultaneous voice call and SMS. The SMS carries the callback number, the time and a record identifier, and the verbatim only if the practice's counsel has confirmed the SMS path is covered by a signed business associate agreement. Otherwise the SMS says "Urgent clinical callback waiting: open {{secure_link}}."
5. Wait the practice's acknowledgement window: commonly five minutes, set by the practice, not by the builder. If On-Call Acknowledgement is not submitted, tag on-call-unacknowledged and page the secondary on-call by voice and SMS.
6. Wait the same window again. If still unacknowledged, page the practice owner by voice, SMS and email, and open a routing incident automatically.
7. In parallel with step 6, call the patient back with one fixed message: "This is {{custom_values.practice_name}}. I am still working on reaching our on-call clinician for you. If your symptoms are getting worse at all, or you are worried, please call 911 or go to your nearest emergency room now." No estimate of how long, no reassurance, no assessment. Repeat this call once more at the next window if still unacknowledged.
8. On acknowledgement: stamp escalation_acknowledged_at, remove on-call-unacknowledged, move to Clinical - On-Call Paged, and create the escalation record for the clinician to complete after speaking with the patient.
9. If the on-call clinician has not recorded a completed callback within the practice's standard, alert the practice manager regardless of the hour.

Stop and exit conditions: acknowledgement received and callback completed; caller calls 911, which the clinician records on the escalation record. The ladder never terminates without a human having been reached. It terminates at the practice owner, who is a human. Any gap in the On-Call Rotation Calendar must raise a loud configuration alert the day before, because an unstaffed window is this build's worst failure mode.

5. Abandoned Call and Dropped Contact Recovery

Trigger: call disconnects before a routing_path is written; caller hangs up on hold; SMS or chat conversation abandoned mid-flow; voicemail left with no callback number.

Conditions and branches:

1. Branch A, abandoned during or immediately after the emergency statement, or before any intent was captured. Treat as potentially clinical. Within 2 minutes, attempt one outbound call. If unanswered, send an SMS that leads with safety: "We missed your call to {{custom_values.practice_name}}. If this is a medical emergency, call 911. For a clinical question, call {{custom_values.clinical_line}}. For anything else, reply here or call {{custom_values.front_desk}}." Tag abandoned-recovery, file in Abandoned, and create a front desk callback task due within the hour.
2. Branch B, abandoned after a clinical escalation had already started. This is the highest-priority recovery in the build. Attempt the callback immediately, then every 10 minutes up to three attempts, alert the clinical lead on the first failure, and open a routing incident. A caller who was mid-clinical-escalation and dropped is not an abandoned call; it is an open clinical contact with no contact.
3. Branch C, abandoned during a confirmed non-clinical self-serve flow: for example mid-booking. One callback attempt and one SMS with the booking link, then close to the front desk board as routine.
4. If all recovery attempts fail: tag abandoned-unrecovered, and on a Branch B record notify the practice manager and the clinical lead by name. Unrecovered Branch B records are reviewed individually at the weekly clinical review, every one of them.
5. Daily at close, report abandoned counts by branch and recovery rate to the front desk lead and practice manager, with Branch B listed individually.

Stop and exit conditions: caller reached; caller calls back in; three attempts exhausted on Branch B. Never classify an abandoned call as routine because of the time of day or the number it came from.

6. Inbound SMS and Web Chat Urgency Interception

Trigger: any inbound SMS to any practice number, any web chat message, any web form submission with a free-text field.

Actions in order:

1. Screen before replying anything. Run the urgency and clinical lexicon against the message content before BO generates a single word of response.
2. On match: send the fixed safety response and nothing else: "I cannot help with medical questions by message, and I cannot tell you how urgent something is. If this is an emergency, call 911 or go to your nearest emergency room now. For a clinical question, call us on {{custom_values.clinical_line}} and a member of our clinical team will speak with you." Then: notify the clinical line immediately during open hours, or page the on-call after hours through workflow 4; tag clinical-escalation and emergency-instruction-given; set transcript_contains_clinical true; create the escalation record. BO sends no further messages on that thread.
3. During open hours, additionally create a clinical callback task with clinical_callback_due_at, because a patient who texted about a symptom should get a call, not a text telling them to call.
4. No match: proceed to the allowlisted non-clinical handling in workflow 2. Append to the first reply of every new conversation: "I can help with appointments and practice information. For medical questions please call {{custom_values.clinical_line}}, or 911 in an emergency."
5. After-hours auto-reply on every channel, unconditional: "Our office is closed and this number is not monitored right now. If this is a medical emergency, call 911. For an urgent clinical matter, call {{custom_values.after_hours_line}}. Otherwise we will reply when we reopen at {{custom_values.open_time}}."
6. Web chat and web form hardening: a persistent, always-visible line at the top of the widget naming emergency services, before the first message is typed; controlled lists rather than free text wherever possible; and a form-level notice that it is not for medical questions or emergencies.
7. If a caller supplies clinical detail anyway, capture it, restrict it, and escalate. Never reply to it with content, and never ask a follow-up question about it.

Stop and exit conditions: escalated to a human; non-clinical request served. BO never sends a second message on a thread it has escalated. The human owns the conversation from that point, and a well-meaning follow-up from an automated agent on a clinical thread is a real harm risk.

7. Clinical Callback Queue and Documentation Handoff

Trigger: routing event enters Clinical - Callback Queued.

Actions in order:

1. Assign to the clinical team queue, not to an individual, so it cannot sit on an absent person's name. Surface it at the top of the clinical queue view ordered by clinical_callback_due_at ascending.
2. Alert the clinical team immediately with the record identifier, the channel, the time received and the due time. Clinical content stays in the record, not in the alert.
3. At 50 percent of the callback window: nudge the clinical team. At 75 percent: alert the clinical lead by name. At 100 percent: tag clinical-callback-overdue, page the practice manager, and open a routing incident automatically. These thresholds are not negotiable downward to reduce alert noise. If the alerts are noisy, the staffing or the standard is wrong, not the alerting.
4. The clinician calls the patient, stamps callback_completed_at, and completes the Clinical Escalation Record: the caller's verbatim, what was asked, what was advised, the disposition, and the clinician's name. This record must flow into the chart through the EHR integration or be entered there by the clinician. A clinical interaction documented only inside a marketing-adjacent platform is a documentation gap.
5. Disposition branch. Advised to attend emergency care: tag it, notify the practice manager, and do not send any automated follow-up message. Same-day appointment needed: the clinician books from the held clinical slots on the Nurse Callback Calendar; the ordinary confirmation sequence runs with no clinical content. Routine appointment: hand to the scheduling flow. Resolved on the call: close the routing event.
6. If the patient cannot be reached: three attempts across the window, each logged, then a letter or portal message per the practice's own documented unable-to-reach procedure, and a notification to the clinical lead. Never close an unreached clinical callback silently.

Stop and exit conditions: callback completed and documented; patient unreachable after the documented procedure is exhausted. The routing event does not close until the escalation record is complete.

8. Escalation Audit, Call Review and Weekly Safety Report

Trigger: continuous monitoring, plus scheduled Friday 08:00 and the first business day of each month.

Actions in order:

1. Continuous integrity checks, alerting immediately on any failure: any routing event with emergency_statement_delivered false; any clinical escalation with no escalation_acknowledged_at inside the window; any on-call page with no acknowledgement after the full ladder; any clinical callback past due; any Branch B abandoned record unrecovered; any gap in the On-Call Rotation Calendar in the next 7 days. Each opens a routing incident and pages a named human.
2. Weekly, assemble the safety report for the clinical lead, the practice manager and the practice owner: total contacts by channel; escalations by escalation_trigger; unclassified-escalated rate; median and 90th-percentile seconds from emergency statement to human pickup; on-call acknowledgement times with every breach listed individually; clinical callback breach count; abandoned counts by branch with recovery rate; and routing incidents opened and closed.
3. Create the clinician review task: "Review this week's sample. Every escalation record, plus a random sample of calls BO handled as non-clinical. Against our standard." The second half of that sample is the important half: the risk in this build is not the calls that escalated, it is the calls that did not. The sample size and frequency should be set by the practice's clinical lead.
4. For each reviewed call, the clinician records on the Weekly Call Review Sample form whether the routing was correct, and any call where BO gave advice, assessed urgency, asked a clinical question or failed to deliver the emergency instruction is a routing incident regardless of outcome. Tag reviewed-by-clinician.
5. Branch: if the unclassified-escalated rate is rising, the fix is to widen the non-clinical allowlist only where the clinical lead agrees it is safe. Never to loosen the urgency lexicon or raise the confidence threshold's tolerance. Record the decision.
6. Monthly: reconcile every clinical escalation against the chart documentation; review the urgency lexicon with the clinical lead and add any term that appeared in a verbatim and did not match; confirm the On-Call Rotation Calendar for the coming month has no gaps; and test the failover path end to end and record the result.

Stop and exit conditions: none. This workflow is the control that makes the rest of the build acceptable to operate. If the weekly review stops happening, the practice should turn the automated answering off and go back to a human on the phone.

9. Failover and Degraded-Mode Routing

Trigger: platform unreachable; carrier failure; speech recognition failure; internet outage at the practice; or the agent returning errors on consecutive calls.

Actions in order:

1. Fail toward a human, always. Configure a carrier-level failover on the main number that forwards to a defined mobile held by the front-desk lead during hours and the on-call clinician outside them. This forward lives at the carrier, outside the platform, so it survives the platform being down.
2. If the agent cannot run but calls still connect, serve a static recorded greeting that carries the emergency instruction and the clinical line number, then forward. Never serve a greeting that lacks the emergency instruction, even in degraded mode.
3. On detecting three consecutive agent errors, automatically switch the main number to the static greeting plus forward, notify the practice manager and the build owner, and open a routing incident.
4. Disable all outbound automated messaging while in degraded mode, so the practice is not texting appointment nudges while unable to answer the phone.
5. On recovery, do not auto-resume. A named human confirms the agent is healthy, and the first ten calls after recovery are flagged for review.
6. Test the full failover path monthly as part of workflow 8 and record the test result with a date and a name against it.

Stop and exit conditions: service restored and confirmed by a human. Degraded mode is permitted to be inconvenient; it is not permitted to be silent. A phone that rings out is a worse failure than a phone answered by a person reading from a card.

The practice stops relying on a receptionist's ear as its only triage mechanism, and it does so without pretending software can triage instead. The urgent caller gets a human faster, because the routing is not first-in-first-out any more and because there is a named path with a clock on it. The routine caller gets served immediately without touching a human at all, which is what frees the front desk to answer the calls that matter. And after hours stops being a voicemail box. There is a ladder that terminates at a person, with acknowledgement timestamps proving it did.

The second change is that the practice can now see its own phone. Every contact has a routing event, every escalation has a trigger and an acknowledgement time, and every week a clinician reviews a sample. That audit trail is worth as much as the efficiency: it is how the practice knows the system is working, and it is what makes an escalation defensible if it is ever questioned.

Expect the escalation rate to be higher than feels comfortable at first. That is the design working. Over-escalation is a cost problem and under-escalation is a harm problem, and they are not symmetrical.

Metrics to watch:

• Emergency statement delivery rate. Target one hundred percent. Any miss is an incident, not a metric.
• Seconds from emergency statement to human pickup on clinical escalations: median and 90th percentile. This is the headline safety number.
• On-call acknowledgement time, with every breach listed by name and date. Review individually, never as an average.
• Clinical callback breach count against the practice's own standard. Target zero.
• Escalation rate by trigger. Watch the mix: a rising Keyword Match share is fine; a rising Agent Error share is a defect.
• Unclassified-escalated rate. Treat it as the honest measure of how well the agent understands callers. Reduce it only by widening the approved non-clinical allowlist, never by making the agent more willing to guess.
• Misroute rate found on clinician review, split into escalated-unnecessarily and should-have-escalated. The second number is the one that matters and it should be zero.
• Abandoned call rate by branch, and recovery rate, with Branch B reviewed case by case.
• Share of contacts fully self-served, and the resulting change in call volume reaching the front desk. This is the efficiency dividend, and it is the last thing to optimize, not the first.
• Routing incidents opened and closed per week, with time to closure. A practice reporting zero incidents is usually not looking.
• Failover test results, monthly, dated and signed.

Prerequisites

• Clinical sign-off on the routing rules, in writing, before the agent answers a single call. The urgency lexicon, the non-clinical allowlist, the escalation paths, the acknowledgement windows and the clinical callback standard are clinical decisions. A builder must not author them. Get them from the practice's clinical lead and keep the version history.
• A staffed on-call rotation with no gaps, and a named escalation point above it. If the practice cannot commit to after-hours coverage, do not build the after-hours urgent path. Build a greeting that sends urgent callers to emergency services and the practice's existing answering service instead. An urgent path that pages nobody is worse than no path.
• A published clinical line that no AI agent answers. This single decision removes most of the risk from the build and most of the load from the routing logic.
• A documented clinical callback standard (how fast a clinical callback must happen) agreed by the clinicians who will meet it.
• The practice's own unable-to-reach procedure for a clinical callback that cannot be completed.
• A committed weekly clinician review. This is a permanent operating cost of the build. If nobody will own it, the build should not go live.
• A tested failover configured at the carrier, outside the platform.

Integrations

• Telephony and carrier, for the inbound number, the recording notice, the zero-out path, simultaneous voice-and-SMS paging, and the carrier-level failover forward.
• Practice management system or EHR, for identity matching and, critically, for writing the clinical escalation record into the chart. A clinical interaction that exists only in the routing platform is a documentation gap; confirm the write path before go-live.
• Google Calendar or Outlook for the clinical availability, on-call rotation, nurse callback and shift calendars.
• A paging or alerting path for the on-call ladder. Voice plus SMS at minimum, and a mobile push or paging tool if the practice uses one.
• Interpreter service, connected into the escalation path rather than bolted on, so a non-English-speaking caller is not routed more slowly than anyone else.
• Slack or Microsoft Teams for internal alerts, only where the practice's agreements cover it, and configured to carry identifiers and links rather than clinical content.

Numbers and provisioning

• Provision the main inbound number, the separate clinical line, the after-hours path and a dedicated front desk SMS number. Keep clinical, operational and marketing traffic on different numbers.
• Complete A2P 10DLC brand and campaign registration before go-live. Register the safety and escalation messaging as its own customer-care campaign with the exact copy in this guide as sample messages. Filtering on a safety message is an unacceptable failure, and note that carrier filtering is a real risk for messages containing emergency instructions, which is one reason the voice path, not SMS, carries the primary escalation.
• Opt-out handling: STOP, STOPALL, UNSUBSCRIBE, CANCEL, END and QUIT halt SMS immediately. Because an opt-out must never stop a safety path, an opted-out contact on a clinical escalation routes to a voice call plus a front desk task instead: never to silence. Have the practice's counsel confirm how the practice should handle safety-critical contact with an opted-out patient.
• Quiet hours do not apply to a clinical callback or a safety message; they apply to everything else. Configure that distinction explicitly rather than relying on a global setting, and confirm the applicable state calling and texting rules with the practice's own counsel.
• Call recording notice and consent wording per jurisdiction, in the practice's own approved language. Two-party-consent states require a different flow from one-party states; this is a counsel question, not a configuration preference.

Protected health information: operational practice

This build touches the most sensitive traffic a practice has, in real time, across voice, SMS and chat. What follows is operational practice, not legal advice. The specifics for your practice (including whether this design meets your obligations) must be confirmed with the practice's own compliance counsel or privacy officer before go-live.

• Keep clinical content out of SMS and unencrypted email entirely, including internal alerts. An on-call page should say "urgent clinical callback waiting, record {{id}}, number {{callback}}, open {{secure_link}}", not the caller's symptom. The verbatim may travel in an SMS only if that specific path is covered by a signed business associate agreement and the practice's counsel has approved it; the safe default is a link.
• Minimum necessary, applied to the whisper and the handoff. A live-transfer whisper carries the caller's own words and a record identifier because the receiving clinician needs them to do their job. That is the minimum necessary, and it is the right amount. An internal chat notification needs far less, and should carry far less.
• Consent capture. Record SMS and email consent with the date and method. Record recording consent with the jurisdiction rule applied. Keep operational and clinical consent separate from marketing consent, and never let a marketing opt-out suppress a safety message, which is why the opt-out branch above routes to voice rather than to nothing.
• A signed business associate agreement must be in place with every vendor in the path before the first live call: the platform, the telephony carrier, the speech recognition and transcription provider, the recording storage, the SMS path, the email sender, the paging tool, any middleware, the internal chat tool, the interpreter service, the EHR connector, and any analytics or storage layer. This build has more boxes in its diagram than any other in this collection, and a recording or transcript sitting in a service without an agreement is the exposure. Walk the diagram box by box and get the agreements in writing.
• Transcripts and recordings are clinical records. Restrict them by role, set a retention period with the privacy officer, confirm encryption at rest and in transit, and confirm that the transcription vendor does not retain or train on the content. The transcript_contains_clinical switch exists to make restriction automatic rather than discretionary.
• Identity verification before disclosure. BO may take a message from anyone. BO may not confirm whether someone is a patient, discuss an appointment, or disclose anything about a record without the verification the practice's procedure requires. Third-party callers (family members, caregivers, other practices, pharmacies) go to a human, who applies the practice's rules about who may be told what. Where a minor is involved, apply the guardian and consent rules counsel has specified; these vary by state and by service type, and some services carry separate confidentiality rules that may restrict what a parent may be told.
• Never collect identifiers conversationally. No dates of birth read into an SMS thread, no member numbers in chat, no card details on the automated path. Those go through authenticated forms or a human.
• Access control and audit. Named accounts, no shared logins, two-factor authentication, role-based access separating clinical from administrative views, and confirmation that the platform's audit log records who listened to a recording and who read a transcript. The audit trail is part of the deliverable.
• Language access and accessibility. An interpreter path and a TTY or relay path are obligations in most settings, not enhancements, and the routing must not make a non-English-speaking or deaf caller wait longer. Confirm the practice's specific obligations with counsel and test both paths before go-live.
• Document the whole design and keep it versioned. The urgency lexicon, the allowlist, the scripts, the escalation windows and who approved each. If a routing decision is ever questioned, the answer is a dated document with a clinician's name on it.

Scoping

This is the most involved build in this collection and the one with the least tolerance for shortcuts. Most of the elapsed time goes into the clinical sign-off, the on-call and failover configuration, and the testing, not the automations. Expect a supervised pilot period where a human monitors the agent's calls live before it runs unattended. To scope it against your own call volume, coverage model and clinical staffing, book a call at bookings.appbo.io.