Deflection bots close the easy tickets and leave the regulated ones for a human. In healthtech, the regulated ones are most of the inbound. The system worth running is the one that resolves a member's issue end-to-end and logs every action it took to get there.
An AI concierge for healthtech is an agentic system that resolves member and patient support issues end-to-end - eligibility checks, prior-authorization status, appointment changes, billing disputes, refill questions - across chat, email, voice, and SMS, while logging every tool call, prompt, and reasoning step in an audit trail that supports your HIPAA obligations. The distinction that matters in 2026 is resolution versus deflection. A deflection tool answers a question and hands off the action. A concierge takes the action, in your systems, and records what it did so a compliance officer can review it later.
Resolution means the issue is actually closed: identity verified, eligibility checked, the record updated, the member told what happened - not a knowledge-base article handed back.
Audit trails are the load-bearing capability for healthtech. Every action, the reasoning behind it, and the data accessed should be timestamped, attributable, and replayable to support HIPAA audit-control obligations.
Minimum-necessary access is a design constraint, not a setting. The concierge should reach only the PHI a given workflow needs, through least-privilege scoped tools.
Escalation is part of resolution, not a failure of it. The right design knows when to stop, hand to a licensed human, and carry the full context across.
Provability comes before launch. Adversarial simulation and guardrail testing let a compliance team review behavior before the concierge ever touches a real member.
Last updated: June 2026
Healthtech support is not a volume problem dressed up as a CX problem. A member asking why a claim was denied, whether a prior authorization went through, or why their prescription is on hold is asking a question where the wrong answer has consequences a refund cannot fix. These tickets touch protected health information, they require correct action across multiple systems, and they leave a trail that a regulator or an internal compliance review can ask to see. This guide walks through how to resolve those issues end-to-end with an AI concierge, how the workflows and escalation paths should be built, and what an audit trail has to capture to support your obligations under HIPAA. The product example throughout is Lorikeet, which is built for exactly this class of regulated, multi-step support.
What End-to-End Resolution Means in Healthtech
Resolution in healthtech support means the member's underlying issue is closed, not that their question was answered. Those are different outcomes. A member who writes "why is my prescription on hold" has a question, but the resolution is finding the hold reason in the pharmacy system, determining whether it can be cleared, clearing it or routing it to the right team, and confirming back to the member what happened and when their medication will be ready. A deflection tool stops at "here is our refill policy." A concierge runs the chain.
The category splits on what the agent can actually do. First-generation healthcare chatbots retrieve answers from a knowledge base and escalate anything that requires an action. Agentic concierges take actions: verify a member's identity, check eligibility against the payer record, look up prior-authorization status, update an appointment, and confirm the outcome. The difference is not cosmetic. In healthtech, most of the tickets that matter require an action against a system of record, which means a retrieval-and-reply bot deflects the majority of real work back to your team.
Audit trail: A timestamped, attributable, replayable record of every tool call, prompt, reasoning step, and data access the AI performed on a given interaction. It is the artifact a compliance team or auditor reviews to confirm what the system did and why.
Minimum necessary: The HIPAA principle that a system should access only the protected health information required for the specific task at hand, no more. For an AI concierge, this maps to least-privilege scoped tools that expose only the data a given workflow needs.
A concierge built for this is positioned as a resolution system rather than a deflection tool. Lorikeet describes its agents as concierges that resolve issues end-to-end across voice, chat, email, and SMS for complex and regulated businesses, including healthtech. The framing matters because the architecture follows from it: a system designed to take action needs the audit, guardrail, and escalation machinery that a system designed only to answer questions never has to build.
Why Audit Trails Are the Hard Requirement
The HIPAA Security Rule requires covered entities and business associates to implement audit controls - mechanisms that record and examine activity in systems that contain or use electronic protected health information. When an AI concierge is the thing acting on that PHI, the audit obligation extends to the concierge. Your compliance team needs to be able to answer, for any given interaction, what the system accessed, what it did, and on what basis it decided to act.
Most support tooling hands you a conversation transcript and calls it a log. A transcript shows what was said. It does not show that the agent queried the eligibility system, received a specific response, applied a coverage rule, and updated the record - the chain of actions and reasoning between the member's message and the outcome. For a regulated workflow, the transcript is the least interesting part of the record. The useful audit trail is the sequence of tool calls, the prompts and reasoning that produced each one, the data each touched, and the timestamps that order them.
A few properties make an audit trail fit for healthtech use:
Completeness. Every action the concierge took, not a sample. If the system updated a record, refilled a prescription request, or sent a member a benefits explanation, that action is in the trail.
Attribution. Each action is tied to the specific interaction and the specific automated actor that performed it, so review can reconstruct accountability.
Replayability. A reviewer can walk the interaction step by step months later and see the reasoning that led to each decision, not only the final message.
Data-access visibility. The trail shows which PHI the workflow reached, which is how you demonstrate minimum-necessary access in practice rather than in policy.
Lorikeet is built so that its concierge logs the steps it takes when resolving an issue, which is what lets a compliance team review the system's behavior. Combined with PII redaction and role-based access control, this is how an audit trail supports HIPAA obligations rather than merely claiming to. The wording matters: an audit trail supports your obligations. It does not, on its own, make you compliant. Compliance is a posture you hold across people, process, and technology, and the concierge is one component of it.
Designing the Resolution Workflow
A healthtech resolution workflow is a sequence of steps that takes a member from an inbound message to a closed issue, with the right checks at each stage. The design problem is ordering those steps so the concierge verifies before it acts, acts only within its permissions, and records each step as it goes.
Take an eligibility-and-prior-authorization example. A member messages: "Did my prior auth for the MRI go through, and is it covered?" A well-built workflow runs roughly like this:
Verify identity. Before touching any PHI, confirm the member is who they say they are, using the verification method your compliance team approved. No identity, no data access.
Scope the data access. The workflow reaches only the eligibility and prior-authorization records for this member, through a scoped tool that cannot read unrelated PHI. This is minimum-necessary enforced at the tool layer.
Run the lookups. Check prior-authorization status in the utilization-management system, then check coverage in the eligibility system. The concierge holds state across both calls.
Apply the rule. Interpret the results against the plan rules - approved, pending, denied, or needs more information - and decide the next action.
Resolve or route. If the answer is clean, explain the status and coverage to the member in plain language. If the prior auth was denied for a reason the member can act on, explain the appeal path. If the case needs a licensed reviewer, escalate with full context.
Confirm and log. Tell the member what happened and what comes next, and record the full chain in the audit trail.
Lorikeet supports two workflow styles that combine in a single interaction: natural-language workflows, where you describe the desired behavior in plain English, and deterministic structured workflows, where the path is fixed and predictable. Regulated healthtech work usually wants both. The deterministic structure pins down the high-stakes path - identity check, then data access, then action, in that order, every time - while natural-language handling absorbs the variation in how members actually phrase things. A concierge can also dispatch sub-agents to coordinate with third parties, for example contacting a pharmacy or a payer to chase a status, which is what lets a single member request resolve across multiple external systems.
Two design rules carry most of the weight. First, verify before you access, and access only what the workflow needs. Second, the workflow should be configured in plain language and reviewable by the people accountable for it, so the compliance owner can read the behavior rather than infer it from code.
Designing the Escalation Path
Escalation is not the concierge giving up. It is the concierge recognizing the boundary of what it should resolve autonomously and handing off cleanly. In healthtech, the boundary is sharp in places: anything that crosses into clinical judgment, anything where the member is in distress, anything where the data is ambiguous in a way that risks an incorrect action on PHI. A concierge designed for this class of work should be built to stop at those boundaries by default.
A good escalation path has three properties. It triggers on the right conditions, it carries context, and it is recorded.
Trigger conditions. Define the cases that must escalate - clinical questions, suspected emergencies, repeated verification failures, requests for a human, any action above a defined risk threshold - and configure them so the concierge routes rather than guesses.
Context handoff. When the concierge escalates, the human receives the verified identity, the steps already taken, the data already pulled, and the reason for escalation. The member does not repeat themselves, and the agent does not start cold.
Recorded handoff. The escalation itself is an event in the audit trail, with the trigger reason and the state at handoff, so the decision to escalate is reviewable like any other action.
Lorikeet's defence-in-depth model is the machinery behind safe escalation and safe action. The layers run from pre-launch adversarial simulation, through inbound message checks, to outbound guardrails, to one-hundred-percent post-interaction quality assurance by its Coach agent. Guardrails are where escalation triggers and prohibited actions live: the conditions under which the concierge must hand off rather than proceed, and the actions it is never permitted to take. Because guardrails are testable before go-live, a compliance team can confirm the escalation behavior is correct before the system handles a real member, rather than discovering a gap in production.
The honest limitation worth stating: no escalation design removes the need for a staffed human layer. A concierge that resolves the bulk of inbound and escalates the rest still depends on licensed people being available to receive what it hands off. The concierge changes the ratio and the quality of the handoff; it does not eliminate the human team behind it.
Proving Behavior Before Go-Live
A compliance team should not be asked to approve a system on the promise that it usually behaves. Healthtech procurement increasingly asks to see behavior before launch, which means the platform has to make behavior testable. This is where simulation and guardrail testing earn their place in the evaluation.
Lorikeet runs pre-launch adversarial simulations and red-teaming against the configured workflows and guardrails. In practice this means you can construct the difficult cases - the member who tries to access another person's records, the ambiguous denial, the distress signal mid-conversation - and confirm the concierge handles each the way your policy requires, before it goes live. The simulation results become the evidence a compliance reviewer reads. Combined with post-launch one-hundred-percent QA from the Coach agent, the system is checked adversarially before launch and monitored on every interaction after it.
The practical sequence for a healthtech deployment looks like this:
Configure the resolution workflows and the scoped tools, enforcing identity-first access and minimum-necessary data reach.
Write the guardrails: the escalation triggers, the prohibited actions, the disclosures the workflow must make.
Run adversarial simulations across the hard cases and read the pass and fail results with your compliance owner.
Confirm the audit trail captures the full chain - actions, reasoning, data access, timestamps - on representative interactions.
Go live on a scoped set of workflows, with Coach running QA on every interaction and the audit trail available for review.
On the compliance posture itself, Lorikeet is SOC 2, is willing to enter a Business Associate Agreement for HIPAA work, is aligned with GDPR, supports PII redaction and role-based access control, and offers US, AU, and UK data residency. It holds contractual no-train agreements with the underlying model providers, so member data is not used to train third-party models. These are the table-stakes facts a healthtech buyer checks first. The differentiator is everything above: whether the system resolves the regulated issue end-to-end and proves what it did.
What This Costs and What It Replaces
Lorikeet prices per resolution rather than per seat: approximately $0.80 for a chat, email, or SMS resolution and approximately $1.00 for a voice resolution, with the Coach QA agent at approximately $0.10 per ticket. The customer defines what counts as a resolution, and escalations are not charged. A representative Scale plan is 48,000 resolutions for $48,000 per year. The model is deliberately the opposite of deflection pricing: you pay when an issue is actually resolved, not when a bot deflects a contact.
The comparison point is the cost of a human-handled ticket, which industry benchmarks put in the range of roughly $1.25 to $4.00 depending on complexity and channel. Healthtech tickets sit toward the higher end because of the verification, the system lookups, and the care required on PHI. Resolving the bulk of that volume end-to-end at a per-resolution price below the human baseline is where the economics come from, and pricing on resolution rather than deflection keeps the incentive pointed at closing issues rather than closing conversations.
Lorikeet's Take
The healthtech buyers worth designing for treat the audit trail as the first question, not the last. They are not asking whether an AI can answer a benefits question. They are asking whether it can resolve a prior-authorization status check end-to-end, touch only the PHI that task requires, hand off cleanly when the case crosses into clinical judgment, and produce a record their compliance team can review months later. That is a resolution problem and an audit problem at the same time, and the two are not separable.
The way to evaluate any concierge for this work is to bring your hardest member journeys - the denied claim, the prescription on hold, the eligibility edge case - and ask to see them resolved in simulation, with the full audit trail, before anything goes live. If the vendor cannot show you the behavior before launch, your compliance team is being asked to approve faith rather than evidence. See how Lorikeet handles end-to-end healthtech resolution.
Key Takeaways
Resolution, not deflection, is the bar for healthtech: the concierge should close the member's issue by taking action across your systems, not hand back a knowledge-base article.
The audit trail is the load-bearing capability. A complete, attributable, replayable record of actions, reasoning, and data access supports your HIPAA audit-control obligations; a transcript does not.
Workflows should verify identity first, access only minimum-necessary PHI through scoped tools, and combine deterministic structure with natural-language handling.
Escalation is part of resolution: define triggers, carry full context to the human, and record the handoff. A staffed human layer is still required.
Prove behavior before go-live with adversarial simulation and testable guardrails, then keep one-hundred-percent QA running on every interaction after launch.
