HHS issues RFI on autonomous AI agents in clinical workflows, signaling 2027 rulemaking

The HHS RFI is the opening move in what will likely become the defining federal regulatory conversation for AI in healthcare in 2027. The agency is explicitly asking the field to help scope the problem — what counts as autonomous, where it is being deployed, what trigger conditions should force human review, and how liability should flow when an autonomous agent takes an action that leads to harm. The structure of the RFI tells the industry what the eventual rule is going to be about.

Four of the RFI’s question clusters are worth tracking. First, the scope-of-practice interaction cluster asks how autonomous AI agents performing clinical-adjacent work (triage, patient outreach, medication reconciliation, prior-authorization submission) should be regulated given that each state’s professional licensure framework assigns those activities to specific professions. The answer the agency lands on will determine whether the vendor must configure the agent to the licensure scope of the clinician who deploys it, or whether the agent operates under a federally-defined scope that pre-empts state licensure.

Second, the documentation accountability cluster asks how an autonomous agent’s actions should appear in the patient record. Current practice varies: some vendors insert agent-authored notes with a prominent AI flag; others treat the agent output as a draft that a clinician must sign; others log the agent action in a separate audit trail that is not part of the clinical record. Each approach has downstream implications for billing, malpractice defense, and quality measurement.

Third, the human-in-the-loop trigger cluster asks what conditions should move an autonomous workflow into mandatory human review. The RFI explicitly flags clinical escalation, scope boundary conditions, model uncertainty, and patient preference as candidate triggers but is open on the right set. The answer will shape vendor product design across the autonomous-AI category.

Fourth, the liability cluster asks whether existing malpractice and product-liability frameworks are adequate for autonomous AI agents, or whether a new liability allocation (shared across the vendor, the deploying institution, and the supervising clinician, in defined proportions) is needed. This is the question with the most direct impact on vendor insurance costs, health-system procurement risk, and the overall economics of the category.

Vendors should treat the comment period as a mandatory engagement. The organizations that respond substantively — with real deployment data, named failure modes, and proposed definitions — will shape the eventual rule. Those that stay silent will be regulated by the frameworks their more-engaged competitors propose.