AI Agents forPediatric Practices

Almost every patient-communication product sold into medical practices was designed around a single assumption: the person in the chart is the person you talk to. That assumption is false in pediatrics on every single record. The patient is a minor. The communication endpoint is a parent or guardian — frequently two of them, with different phone numbers, different custody arrangements and sometimes different insurance. Every message, reminder, consent and balance in the system is addressed to somebody who is not the person in the chart, and the moment the patient reaches adolescence a privacy dimension appears on top of that.

This is not a nuance you patch later. It is the data model. A vendor demo that shows a voice agent confirming an appointment with "the patient" is showing you an adult primary-care product with a pediatric logo on the slide. The question to ask in the first demo is not how accurate the agent is — nobody can answer that honestly, as we show below — but rather: which record does the agent dial, who decided that, and what happens when there are two guardians and a court order.

The scheduling pattern compounds it. A pediatric calendar runs two interleaved streams: a densely templated well-visit calendar booked months ahead off the periodicity schedule, and same-day sick capacity that must be held open and that collapses in respiratory season. Sibling visits stack into one family appointment. School-year surges load forms and sports physicals into a few weeks. An agent optimising for slot fill without understanding held capacity will happily book well visits into the same-day holds in October and leave you with no sick capacity in December.

This article is operational. It assumes you have already decided that some automation is worthwhile and now need to know the order of operations, who owns each step, what the entry and exit criteria are, what breaks first, and how to roll back. The companion pillar, The Zero-Click Clinic, defines the term we use throughout: a practice where the default administrative path completes without a human click, and humans are deliberately routed to the exceptions and to every clinical, billing-attestation, legal or safety decision. It is not an unstaffed practice and should never be sold as one.

Three things change when the counterparty is a guardian rather than the patient: who may consent, how you verify identity on an inbound call, and what an outbound message is allowed to contain.

There is a fourth constraint that is easy to overlook because it is not an AI rule at all. 45 CFR § 92.210 imposes an ongoing duty on covered entities to make reasonable efforts to identify uses of patient care decision support tools that employ input variables measuring race, colour, national origin, sex, age or disability, and to make reasonable efforts to mitigate the resulting risk of discrimination. It applies whether or not the tool is AI and whether or not FDA calls it a device. A recall-prioritisation model that uses age bands and insurance type is squarely the kind of thing you should be able to describe in that inventory.

If you automate one thing in a pediatric practice it will be the phone and the text channel, because that is where the volume is. That is also where the largest quantified legal exposure in this entire cluster lives, and it is not HIPAA. It is the Telephone Consumer Protection Act.

AI voices are covered.The FCC's Declaratory Ruling FCC 24-17, released February 8, 2024 in CG Docket 23-362, holds that the TCPA's restrictions on an artificial or prerecorded voice encompass current AI technologies that resemble human voices, including voice cloning, and that callers must obtain the prior express consent of the called party absent an emergency or a regulatory exemption. Twenty-six state attorneys general supported that interpretation and may enforce it. There is no "it sounds natural so it is not prerecorded" argument.

The healthcare carve-outs are narrower than the market believes. Under 47 C.F.R. § 64.1200(a)(2), a health-care message from a HIPAA covered entity or its business associate to a wireless number needs prior express consent — not prior express writtenconsent, but not an exemption either. The residential-landline carve-out at § 64.1200(a)(3)(v) does exempt health-care messages from consent, but caps them at one call per day and three calls per week per patient and still requires opt-out handling. The emergency-purposes exception at § 64.1200(f) covers calls made necessary in a situation affecting the health and safety of consumers; appointment reminders and recall campaigns are not that. And anything that includes or introduces an advertisement, or constitutes telemarketing, is outside the carve-out entirely and needs prior express written consent — which is exactly what a "time for sports physicals, book now" blast looks like to a plaintiff.

One deadline worth diarising. The FCC's "revoke-all" provision — under which a revocation given in response to one type of message applies to all future automated calls and texts from that caller — is not yet in effect. It was originally set for April 11, 2025, delayed to April 11, 2026, and on January 6, 2026 the FCC's Consumer and Governmental Affairs Bureau extended it again to January 31, 2027 (DA 26-12, CG Docket 02-278). So a practice running a voice agent for reminders and a separate marketing text program has until January 31, 2027before one "STOP" must kill both. Build for it now anyway; unifying revocation later is a data-migration project you will not want.

Recording consent is a separate statute in every state at once. A voice agent that records or transcribes is doing exactly what all-party consent statutes cover, and a single national deployment triggers all of them simultaneously. California Penal Code § 632.7 makes it an offense to intercept or intentionally record, without the consent of all parties, a communication involving a cellular or cordless telephone — first offense up to $2,500, repeats up to $10,000. Roughly a dozen states are commonly described as all-party; we are deliberately not publishing the list, because the only consolidated lists we could locate are SEO properties rather than statutory compilations. Cite your own state's statute or say "roughly a dozen, verify yours." Practical rule: play the notice beforeanything is captured, capture affirmative assent, and log it. A parent who calls you has not, by calling, consented to be recorded — and "we only transcribe" is not a safe harbour, because the statutes reach the contents of the communication.

Federal law does not yet require an AI voice agent to announce that it is not human. The FCC adopted an NPRM in CG Docket 23-362 on August 7, 2024 proposing to define an AI-generated call, require disclosure at the outset and require affirmative consent — but as of August 12, 2026 it has not been finalized, and anyone quoting you a finalization date is guessing. What is federal law is caller identity, and it always was.

For a pediatric practice the AB 3030 boundary is the one to internalise, because it maps almost exactly onto the safe and unsafe halves of your automation plan. An agent confirming Tuesday at 3:15 is a clerical matter and outside the statute. An agent that answers "should I bring her in for this rash?" is a clinical communication and inside it — unless a licensed human read it first. Design the escalation boundary at that line and the disclosure question mostly answers itself.

A federal preemption fight is running in the background. Federal preemption of state AI law is being actively pursued, but nothing has displaced the statutes above, and we are not going to cite an executive order number or a bill number we did not read. Plan against the law as it stands.

Immunization operations are the single largest automation opportunity in a pediatric practice and the one with the most moving legal parts right now. Before you encode a recall rule, understand what you are encoding it against.

VFC mechanics. Vaccines for Children is a Medicaid-financed, CDC-administered program providing recommended childhood vaccines at no cost to eligible children: those who are Medicaid eligible, uninsured, underinsured and receiving the vaccine at an FQHC or RHC, or American Indian/Alaska Native. The vaccines VFC buys are set by VFC-ACIP Vaccine Resolutions, adopted through a process separate from ACIP's annual vaccine recommendations — which is why CRS concludes that the 2026 schedule revision, unaccompanied by changes to those resolutions, would not appear to affect the vaccines covered under VFC even if it took effect. Per CRS analysis of NIS-Child data, 93% of US children aged 19–35 months were either VFC-eligible or covered by private insurance — one of the few genuinely clean statistics in this market, and worth contrasting with the vendor numbers later in this article.

The operational requirements around VFC — annual provider training, eligibility screening and documentation at every visit, ordering through the state immunization information system, dose-level eligibility reporting, and reporting windows measured in days — come to us from state health department pages rather than a CDC primary, because CDC's own provider pages return access-denied to automated retrieval. Indiana's CHIRP, for example, requires submission within seven business days. Verify your own state's numbers with your state program before you encode a deadline.

The AAP/Bright Futures Recommendations for Preventive Pediatric Health Care — copyright 2025, updated February 2025 — sets the visit columns your recall engine is really encoding: prenatal, newborn, 3–5 days, by 1 month, then 2, 4, 6, 9, 12, 15, 18, 24 and 30 months, then annually from 3 years through 21 years. History, physical exam, measurements, behavioural/social/emotional screening and immunization review occur at every visit; developmental screening at 9, 18 and 30 months; autism screening at 18 and 24 months; and maternal depression screening at the 1-, 2-, 4- and 6-month visits.

One honest caveat before you build against it: the file AAP serves today is the February 2025 edition. AAP updates the periodicity schedule annually, so a 2026 edition may exist and we could not confirm it either way. Re-check before you describe your recall rules as current — and again, version the configuration so that confirming it later is a five-minute change.

Forms deserve their own note because they are high-volume, usually non-covered, and universally hated. They are also the cleanest automation in the practice: the agent tracks which form was requested by which school for which child, whether the required visit has happened, whether the immunization record satisfies the school's requirement, and where the form is in the signature queue. None of that touches clinical judgement. The clinician still signs — and the signature is precisely the boundary that keeps the workflow safe, for the same reason CMS gives for record entries.

This is the category a pediatric practice buys first, so it is the category we ranked. Read the methodology before the table; the exclusions are the reason the table is worth anything.

Tier 1 — best-documented public record. These vendors publish enough for a buyer to verify something without a sales call. That is the whole claim.

Tier 2 — strong product record, thinner public verification. Real conversational voice agents with real funding, where at least one thing a buyer needs is not published.

Tier 3 — credible, early, or narrower than the marketing suggests. Each of these can be the right answer for a specific practice; none should be bought without the questions in the red-flags section.

One structural point that belongs in every buying conversation: the vendors above are not the only things moving. Roll-ups are consolidating this category — Memora Health was absorbed into Commure in December 2024, and Commure raised $70M at a reported $7B post-money valuation on May 19, 2026, which makes it a plausible acquirer of anyone on this list. Ask what happens to your contract and your data on a change of control, and get the answer in the agreement rather than in the demo.

This distinction is verifiable without a single statistic, which is why we lead with it. There are three tiers in this market and they are priced as though there were one.

Tier C is decades-old technology and should be priced accordingly. Tier B is useful and honest when the vendor says so plainly — one vendor in our roster describes its own product as a voicemail replacement, which is more candour than most. Tier A is the thing under discussion when a practice says "AI agent," and it is the tier where the write-path question below decides whether the product can actually finish a job.

The only trustworthy benchmark for your practice is your own baseline. Pull 60–90 days of your own carrier or phone-system call detail records before you sign — total inbound, answered, abandoned, average speed to answer, after-hours volume, repeat callers within 24 hours — and make the vendor commit contractually to reporting the same fields post-deployment, on your data, not theirs.

This is the single most important architectural fact in the cluster, and it is the one most consistently glossed over in demos. Certified API access under § 170.315(g)(10) is read-only. ASTP/ONC's own test method states it: read services allow authenticated and authorized third-party applications to view electronic health information through a secure API, and those services specifically exclude write capabilities where third-party applications would be able to create or modify EHI.

Read services include those that allow authenticated and authorized third-party applications to view EHI through a secure API. These services specifically exclude "write" capabilities, where authenticated and authorized third-party applications would be able to create or modify EHI through a secure API.

— ASTP/ONC, Standardized API for Patient and Population Services test method

So in your EHR, an agent can be guaranteed only to read demographics, problems, medications, allergies, results, notes and coverage, to search, and to export in bulk. Everything else — booking the appointment, updating the immunization record, filing the form, writing the note, posting the payment — is not covered by certification and exists only if that EHR vendor chose to build it, chose to expose it, and chose to let your vendor use it. That is a commercial arrangement, and it can be revoked, throttled or repriced.

Do not overstate the constraint either: some EHR vendors voluntarily publish write-capable FHIR resources, and the documented write surface is narrow and resource-specific rather than nonexistent. The federal trajectory is also moving — ASTP/ONC's HTI-5 proposed rule, published December 29, 2025, states an aim to move beyond read-only interactions in future API requirements. It remains a proposed rule as of today. Write access is on the federal agenda; it is not a right.

And then there is the registry. Writing to a state immunization information system is not a § 170.315(g)(10) capability at all. It is a state-by-state HL7 interface with its own onboarding, and the state registry is the system of record for the reportable event. Three buckets, and every proposed pediatric automation belongs in exactly one:

Write this table into your implementation plan and into your vendor agreement. The categories are not preferences; most of the "never" rows have a statute behind them.

One caution about relying on the middle column. FDA's own 2026 town-hall material discusses automation bias — the propensity of humans to over-rely on a suggestion from an automated system, producing errors of commission and omission, and worsening under time pressure. Pair that with the Nature Communications finding that injections can be non-obvious to human observers, and "a human reviews it" stops being a blanket answer and becomes a design requirement: the reviewer must be given the material they need to actually review, with the time to do it.

This is a 20-week path for a two-to-eight-provider pediatric practice. Each phase has an owner, an entry condition, an exit condition and a stated failure response. Phases overlap deliberately; the gate is the exit criterion, not the calendar.

These are the pediatric-specific failure modes, in roughly the order we see them. Each row gives the signal that tells you it is happening and the rollback that stops it the same day.

1. 1.An accuracy, containment or resolution percentage offered as neutral evidence: No independent benchmark exists in this category. Ask for the denominator, the sample, the date range and the auditor. There will not be one. A vendor that acknowledges that plainly has told you something useful about how it will behave later.
2. 2."We integrate with Epic" used to mean "we write to Epic": Certified API access is read-only. Ask which resources the product creates or updates in your instance, over which interface, and whether the EHR vendor has approved it.
3. 3.No written answer on RPA: If any part of the write path is screen automation under a named user's credentials, you need to know before go-live, because it changes your audit log, your breakage profile and your § 164.312(a)(2)(i) posture.
4. 4."HIPAA-compliant AI" as a product property: HIPAA attaches duties to covered entities and business associates, not to software. The correct formulation is "used under a BAA covering these subcontractors, with these controls." Ask for the BAA and ask which features are in scope under it — that second question is where general-purpose platforms get quiet.
5. 5.A clinical-sounding agent persona: In California, AI use of terms indicating that advice is being provided by a licensed natural person is a per-use violation with licensing-board jurisdiction. "Nurse" anything is a bad name for your intake agent.
6. 6.Consent handled as a checkbox in the vendor's UI: Ask where the consent artefact is stored, whether you can export it, and how revocation propagates across voice and SMS. You are the defendant, not them.
7. 7.Recording enabled by default with notice "in the terms": All-party consent statutes require consent from the parties to the call, not acceptance of a terms page. The notice must play before capture.
8. 8.A pediatric demo that models the patient as the contact: Ask to see the guardian data model, the second-guardian handling and the adolescent content policy. If those are roadmap items, you are the pilot.
9. 9.Case studies denominated in production dollars with no denominator: How many practices, over what period, net of what, against what counterfactual? Dollar-value case studies with no denominator are not evidence, and this category is full of them.
10. 10.No answer on change of control: This category is consolidating, and the roster above has already changed hands: TrueLark into Weave (2025), Klara into ModMed (2022), Tonic into Luma (2025), Memora into Commure (2024). We found no shutdown among the ten. The cautionary case sits in an adjacent category, not this one — after a private-equity roll-up, one healthcare automation vendor's standalone services were discontinued for portfolio reasons with customers reportedly given roughly 90 days to migrate, which is trade-outlet reporting rather than a company statement. Nothing public suggested that product had failed; the exposure was a cap-table risk, not a technology risk. Put continuity terms in the agreement.
11. 11.A vendor citing its own competitor listicle: Several vendors in this space run content operations that rank their competitors. Those pages are marketing, and so are the third-party "pricing" pages that quote figures no vendor has published.

Everything above is bounded by what we could verify on August 12, 2026. Here is what we could not, stated plainly, because a limitation you know about is worth more than a confident sentence you cannot check.

• The current Bright Futures edition: The file AAP serves today is the copyright 2025, February 2025 update. AAP revises annually and a 2026 edition may exist; we could not confirm it either way.
• The litigation status: We could not verify anything in American Academy of Pediatrics v. Kennedy after the CRS publication date of June 11, 2026, including any ACIP re-establishment or CDC action under Executive Order 14407. Check the docket.
• VFC operational mechanics: CDC's own provider pages return access-denied to automated retrieval. Screening documentation, ordering, wastage rules, dose-level eligibility reporting and the compliance-visit regime come from state health department pages, not a CDC primary.
• Vendor compliance postures: For several vendors we found no BAA, SOC 2 or HITRUST statement at the URLs we checked. That is a discoverability finding about the public record, not a statement about the vendor's actual controls — one vendor here publishes a trust centre that simply returned an error to our fetcher.
• Prices: One published price exists in this entire category — Weave's starting-from figure — plus two vendors that publish a pricing model without a rate. Every dollar figure you find on a third-party "pricing" page for these products is affiliate or competitor content.
• The all-party consent state list: The only consolidated lists we could locate are SEO properties. We will not publish a twelve-state list as verified; cite your own state's statute.
• Colorado's effective dates: The enrolled SB 26-189 sets January 1, 2027 for the substantive duties with a few narrow subsections effective upon passage, and published analyses of the dating differ. Read the bill at leg.colorado.gov before you rely on a date. We also found a secondary claim that the act is under legal challenge that the Colorado Attorney General's own page does not support — we do not repeat it.
• Federal AI-call disclosure: The FCC's AI-disclosure NPRM is not finalized and we found no finalization date. Federal caller-identity requirements are law; a federal "I am an AI" requirement is not, yet.
• Prompt injection through practice channels: The peer-reviewed evidence covers patient dialogue and medical imaging. We found no published study of injection through patient portal messages, referral faxes or payer portals in a live practice. Extrapolating to your fax line is reasoning, not evidence — and prompt injection is unsolved, so design for blast-radius reduction rather than prevention.

What this costs and how long it takes.These are Frenchy Digital's published engagement ranges, identical across every article in this cluster.

Senior-led delivery at $150–$225/hour; ongoing retainers $2,500–$9,500 per month; a 30-day post-launch warranty; a written fixed-price phased proposal within 5 business days of a discovery call; and full source-code and IP ownership transfers to you. Frenchy Digital is a senior-led Black-owned Los Angeles agency. Most pediatric practices with two to eight providers land in the single-workflow band for a first deployment — inbound answering plus recall list generation — and reach the multi-workflow band only when registry reconciliation and forms automation come into scope.

If you want a grounded read on whether an agent fits your practice — including an honest answer when it does not — book a free 60-minute discovery call at calendly.com/frenchydigital/discovery-call or call +1 (424) 272-5601. You leave with a written scope and a fixed-price phased proposal within 5 business days.