Referral and clinical letter processing

• Every new referral is read as soon as it lands in the e-RS worklist: the question being asked, history, medicines, results and attachments, in a one-screen summary for the clinician who triages it.
• The referral is checked against the specialty's own approved referral criteria, and missing information, such as a required blood test or image, is flagged before the consultant opens it.
• The AI suggests a priority and a clinic, showing its reasons and the criteria it relied on. The consultant accepts, changes or ignores the suggestion, and records the triage outcome themselves.
• Routine referrals whose wording matches the specialty's published urgent criteria are flagged to the triaging clinician the same day, not at the next triage session.
• Incoming letters are read, matched to the patient, given suggested codes and routed to the right team. Letters that ask the trust to do something are flagged to the named clinician.
• Clinicians make every triage and clinical decision. The AI never accepts, rejects, returns or downgrades a referral, and never answers an advice and guidance request.

• NHS EnglandDCB0129 and DCB0160 clinical safety
  →

  If the trust builds the tool, it is the manufacturer under DCB0129 as well as the deploying organisation under DCB0160. That means a named clinical safety officer, a hazard log and a clinical safety case before the pilot. Missed urgent features and misfiled letters are the top hazards. The standards are under review, so expect revised versions.

• MHRASoftware and AI as a medical device
  →

  Reading, summarising and routing for a clinician to review sits at the lower-risk end. Suggesting a clinical priority is the part most likely to make the software a medical device, because the MHRA's software guidance treats triage as a sign of a possible medical purpose. Write the intended purpose down, get a regulatory view in discovery, and be ready to launch summaries and routing first if priority suggestion needs a device route.

• NHS EnglandThe e-Referral Service and the RTT rules
  →

  Only a clinician accepts, returns or redirects a referral. The AI reads e-RS through application-restricted API access, which is read-only. Triage outcomes and advice and guidance replies need user-restricted access under the clinician's own NHS Care Identity Service 2 (CIS2) login, so the platform itself stops the AI recording a decision. NHS England has asked for advice and guidance to run through e-RS from July 2026 (October 2026 where a third-party service is used).

• NHS EnglandDigital Technology Assessment Criteria (DTAC)
  →

  If any part is bought rather than built, the supplier completes the updated DTAC form, which replaced the old one in spring 2026, alongside its clinical safety, DSPT and data protection evidence.

• ICOUK GDPR, the Data Protection Act 2018 and the Caldicott principles
  →

  Referrals and letters are special category health data. That means a DPIA before the pilot, processing in UK regions, collecting only what's needed, a clear retention period, and a contract that stops providers training their models on your data. The priority is a suggestion to a clinician, not a solely automated decision, which keeps the design clear of the strict limits that still apply to special category data under the amended UK GDPR.

• NHS EnglandData Security and Protection Toolkit (DSPT)
  →

  Acute trusts complete the CAF-aligned toolkit. The new system, its cloud services and its suppliers are covered in the trust's 2026-27 (version 9) submission, with the API connections and service identities in the trust's asset register.

On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →

• A clinical lead in each specialty owns its referral criteria, with change control. The AI is re-tested whenever criteria change.
• An exception queue for letters the AI can't match to a patient with confidence, owned by the medical records team.
• Override reasons captured when a clinician changes the suggested priority, and reviewed weekly with the clinical safety officer.
• A weekly audit of a sample of triaged referrals, including every referral that was later upgraded.
• A named owner for every prompt and model, with change control like any other clinical system.
• Clinicians and secretaries trained before go-live, including what the AI can't see: anything not in the referral.

1. 3–4 weeks

   Discovery

   Map today's referral and letter flows, measure the baseline, confirm e-RS API access and what the EPR supplier allows, and get a regulatory view on intended purpose.

2. Gate · must be true to passBaseline agreed, intended purpose written, clinical safety officer named, DPIA and hazard log started, e-RS onboarding begun.

3. 8–10 weeks

   Pilot

   Two specialties, in shadow mode: the AI summarises and suggests, clinicians triage as normal, and the two are compared.

4. Gate · must be true to passSummary accuracy and override rate within agreed limits, no missed urgent features in the audit, clinical safety case signed off.

5. 4–6 weeks

   Production

   Summaries and routing go live in the pilot specialties, with monitoring, support and a rollback plan.

6. Gate · must be true to passMonitoring, support model, rollback plan and clinician training in place.

7. Ongoing

   Scale

   Add specialties one at a time, then extend the same pattern to advice and guidance and to inter-provider transfers.

8. Gate · must be true to passEach new specialty passes the same pilot gate, with its own criteria signed off.

R ResponsibleA AccountableC ConsultedI Informed· not involved

Where I'd fit

1. 1

   Goes wrong

   The demo used typed referral forms. Real referrals include scanned letters, photos and results tables.

   How the design avoids it

   Pilot on last month's real referrals and letters, every channel and every attachment type.

2. 2

   Goes wrong

   The priority suggestion drifts into a clinical decision, and the tool becomes a medical device without anyone deciding it should.

   How the design avoids it

   A written intended purpose, suggestions drawn from each specialty's own criteria, and a regulatory view before the pilot.

3. 3

   Goes wrong

   Consultants accept suggestions without reading the referral.

   How the design avoids it

   Short, specific summaries with links to the source, an override-rate measure, and an audit of every referral later upgraded.

4. 4

   Goes wrong

   A letter is filed against the wrong patient because the match looked close enough.

   How the design avoids it

   A confidence threshold set with the medical records team, and a person to confirm every uncertain match.

5. 5

   Goes wrong

   The design assumes the AI can write triage outcomes into e-RS.

   How the design avoids it

   Confirm the e-RS access modes in discovery. The AI reads; the clinician records the outcome under their own login.

1. Late 2026–2027
   The review of DCB0129 and DCB0160 (consultation closed 11 September 2026) is expected to bring revised clinical safety standards.

   Keep the hazard log and safety case structured and current, so moving to the new versions is an update, not a rewrite.

2. 2027
   Following the National Commission into the Regulation of AI in Healthcare, the MHRA plans draft guidance on changes to AI devices, a 2027 consultation on how AI devices are qualified and classified, and a full roadmap in spring 2027.

   Write the intended purpose down now, keep priority suggestion a separable feature, and review both against the new guidance as it lands.

3. March 2027 and March 2029
   NHS England's RTT milestones: 70% of patients waiting under 18 weeks by March 2027, and 92% by March 2029.

   Measure referral-to-triage time from day one. It's waiting time the patient experiences but rarely sees reported.

4. By 2028/29
   NHS England expects acute trusts to be onboarded to the NHS Federated Data Platform and using its core products for elective recovery.

   Design referral data to feed the same waiting list the trust will use for elective recovery, not a separate one.

5. By December 2028
   The Health Bill, now in the Lords, would give the legal basis for the Single Patient Record. The government's target is to launch it in the NHS App by December 2028.

   Build on national standards such as FHIR and the e-RS API, so the AI can read a fuller record when it becomes available.