For health systems and provider groups
Your clinicians have capacity this week and patients are being told six weeks. Both facts are true at once, and the distance between them is not clinical — it is a queue somebody stopped working on Thursday afternoon, and nobody found out until the patient stopped calling.
A referral arrives by fax, portal, direct message or an outside record system, and it lands in a work queue. Somebody has to read it, confirm the coverage, obtain the authorisation if one is required, reach the patient, offer a time the patient can take, and get it on the right calendar. Any one of those steps stalling stalls the whole thing, and the patient experiences all of it as silence.
The patient calls to check. They wait on hold, get a menu, reach somebody who does not have the record, and are told a callback will come. The callback is a task in a system nobody has time to drain. So they call again, which generates another task, which makes the queue longer — the volume grows because the queue is slow, and the queue is slow because the volume grew.
Meanwhile the schedule has gaps. Not because demand is low, but because the work of converting demand into a booked appointment is manual, uneven and quietly unowned. A no-show empties a slot at nine in the morning and there is no time to fill it by ten.
And the staff doing this are the reason it works at all. They are also leaving. The people who knew which payer needs which form, which clinic will take a same-week add-on, and which patients need a phone call rather than a portal message — that knowledge walks out and the queue does not care.
A patient who cannot get through does not file a complaint. They go somewhere else, and the loss appears nowhere except in a volume number somebody explains at the end of the quarter.
Between a referral arriving and a patient being booked, most of the elapsed time is waiting in a queue rather than work being performed — and no role, system or report owns that waiting.
Every individual step in access is already somebody’s job. The queue between the steps is nobody’s. That is why adding staff produces less relief than expected: more capacity applied to steps that were never the slow part, while the waiting stays exactly where it was.
It is also why the reporting feels unhelpful. Systems report what they did — referrals received, appointments booked, authorisations submitted — and none of them reports how long a patient sat between those events, because no single system watched the whole path.
Which means the honest first move is not to hire, not to buy, and not to reorganise. It is to measure the waiting: where a referral sits, how long, what it is waiting for, and how often it ages past the point where the patient gives up. That number tends to surprise people who have run these operations for years, and it is the only basis on which the next decision should be made.
And it is the number that makes the staffing argument winnable, because "we are busy" is a claim and "eleven days of the fourteen were waiting, here is where" is a finding.
Time from referral received to appointment booked — measured by elapsed days decomposed into work, wait and blocked time, against your own baseline taken before anything changes.
Referrals that age out without ever being worked — measured by the count ageing past your own threshold, before and after, by service line.
Schedule gaps that go unfilled after a cancellation — measured by time from slot opening to slot refilled, and the count never refilled.
Authorisations that fail because a step was missed — measured by denials attributable to a missing or late authorisation step, traced to the step.
Patients who call more than once for the same request — measured by repeat contacts per request, which is the cleanest available proxy for whether the first one worked.
What your access staff spend the day doing — measured by time on hold-and-chase work versus time on patients who need a person, sampled the same way before and after.
Where leakage is actually happening — measured by referrals received against appointments completed, by referring source and service line.
any clinical outcome, any clinical decision, and any improvement in care quality. Nothing here triages acuity, advises a patient, or touches a clinical judgement. This is the administrative path a patient travels before and around care, and claiming more than that in this setting would be both wrong and unsafe.
This works inside your electronic health record and your scheduling system through their documented interfaces. Nothing is migrated out, no parallel patient record is created, and your system of record stays the system of record — a second place where patient state lives is a patient-safety problem, not an integration shortcut.
Interoperability uses the standards your systems already speak, and where an interface does not exist for a step, that gap is reported as a gap rather than worked around by automating a screen. A screen-scraped workflow breaks silently at the next vendor upgrade, and in this setting it breaks on a patient.
Access follows your directory. Somebody removed there is removed here, without a second list for a manager to remember during a busy week.
Where the work involves protected health information, a Business Associate Agreement governs it, and the obligations attach because that agreement exists. We do not claim HIPAA certification, and no vendor honestly can: HHS does not certify business associates and a business associate cannot certify itself. Any vendor telling you otherwise is telling you something about their diligence rather than their compliance.
Minimum necessary is an access design rather than a training slide. An operated team working one queue sees the records that queue requires and not the rest of your patient population, and the boundary is enforced where it cannot be forgotten.
Every action against a patient record carries a receipt: what was done, by whom, under what authority, at what time. Your privacy office can read that record without asking us to produce it, which is the point — an audit trail you have to request is an audit trail you do not really have.
Operational access is not permission to train. Patient data does not become material that improves anything serving another organisation. That is architectural, and it is the sentence your privacy officer will want in the agreement rather than on a page.
There are four reviews here, not one, and the clinical stakeholder is the one most often engaged too late. Bring them in at scoping. The boundary that matters to them is simple and worth stating early: nothing clinical is decided, and anything approaching a clinical judgement escalates to your staff.
For privacy and security the reviewable questions are the usual ones — what is reachable, under what authority, retained how long, returned how on exit — and each has a written answer available before anything is connected.
Where an obligation depends on the deployment or the data class, it is marked applicability-gated rather than presented as already in force. Your compliance office is trained to notice the difference, and a vendor page that blurs it is the one that makes the review longer.
A single access queue in a single service line — referral intake, authorisation follow-up, or cancellation backfill — observed first, with no authority to contact a patient or alter a record.
The observation phase is read-only and it is the most valuable part. It produces the decomposition of elapsed time for that queue: how much was work, how much was waiting, what the waiting was for, and how many requests aged past the point where the patient gave up. Most access operations have never seen that number for their own queue.
Some health systems should stop right there. If observation shows the constraint is a payer response time or a clinic template nobody will change, that is a real finding, and it is one you can act on internally without a vendor.
If you continue, the first delegation is narrow and reversible: one repetitive step, with a written authority grant, a stopping condition agreed in advance, and clinical escalation defined before a single patient is contacted.
It does not, and that boundary is written into the scope before anything connects. Nothing here triages acuity, advises a patient, or makes a clinical judgement — anything approaching one escalates to your staff by rule rather than by exception. What is delegated is administrative: confirming coverage, chasing an authorisation, reaching a patient to offer a time. If a step in your queue cannot be cleanly separated from clinical judgement, it stays with your clinicians.
The honest answer is that no vendor is, because HHS does not certify business associates and a business associate cannot self-certify. What exists is a Business Associate Agreement, which is what actually creates the obligation, plus the access model, the audit trail and the architecture documentation your privacy office can review. A vendor who answers that question with a yes has told you something useful about them.
Observation does not require an integration project. It requires read access through the interfaces your system already exposes, scoped to one queue, which is a materially smaller request than a build. Writing anything back is a separate decision made later and per step. If the read for that queue genuinely cannot be granted, that is a real constraint and it is better established in week one than in month seven.
Usually because the work was moved before it was understood, so the vendor inherited an unmeasured process and optimised the part they could see. The sequence here is deliberately the other way round: measure the queue first, in your systems, with nothing delegated. If the measurement does not show where the time goes, nothing should be handed over — and that is a legitimate outcome of the first phase.
They will assume it because it is usually true, so saying otherwise is not enough on its own — the scope has to show it. The work that gets delegated first is hold-and-chase: waiting on a payer portal, resubmitting a form, calling a patient who does not answer. Your experienced access staff are the ones who know which clinic takes a same-week add-on, and spending their day on hold is the actual waste. Tell them what is being measured and let them tell you where it jams; they already know.
It returns to you in a documented format on a timeline written into the agreement before you start, and the operating record — every action, its authority and its timestamp — comes with it. Nothing is retained to improve a service for another organisation. Exit terms are part of the initial scoping documents rather than a negotiation you have when the relationship is already strained.