Why the Send Button Is Not the Safety System
AI-drafted patient-portal messages are the subject of this series. The central question is not whether a large language model can produce a polished reply, but whether a health system can use that draft to make patient communication faster without weakening clinical judgment, patient trust, or safety. Readers should come away able to distinguish a draft from a clinical decision, recognize the limits of a final clinician send action, and judge what additional controls are needed.
That distinction matters because a portal message is easy to underestimate. It may be a refill request, a question about a side effect, or a concern about a test result. The message is short and asynchronous, but the answer can influence what a patient does next: waits, calls the office, changes behavior, seeks urgent care, or assumes that nothing important is happening. When an AI system proposes the wording, it enters a communication pathway that already carries clinical responsibility. The technology does not have to make an autonomous diagnosis to create risk. It only has to make an incomplete or poorly calibrated answer look ready to send.
The attraction is real: inbox burden meets a scalable draft
Patient portals have become routine infrastructure for outpatient care. They let patients ask questions, request refills, report symptoms, and manage ongoing treatment between visits. They also create a large stream of work in the clinician in-basket. The studies considered here describe that growth as a contributor to administrative burden and burnout, which explains why health systems are interested in tools that can produce a first draft while a clinician remains responsible for the response.
The appeal is practical. A clinician who would otherwise begin with a blank screen can start with a proposed answer, edit it, and return to the patient sooner. A qualitative study of 40 patients found that many participants understood this bargain. They often viewed portal messaging as a way to obtain a resolution or quick information, not as a substitute for the interpersonal depth of an office visit. In that setting, a draft that helps a busy clinician respond may look like a benefit to both sides: less effort for the clinician and less waiting for the patient.
But “less effort” is not a single, self-explanatory outcome. A draft can reduce the cognitive work of composing a response while leaving the total time unchanged. The primary-care simulation study notes earlier reports of reduced cognitive burden without significant reductions in time, and the studies here do not provide a randomized comparison showing that draft assistance universally speeds care. More importantly, automation changes the kind of attention the clinician must supply. The clinician is no longer only constructing an answer; they are evaluating an answer that has already been made coherent, specific, and easy to accept.
That shift is why the subject cannot be treated as a writing feature. The relevant question is not whether the generated text is grammatical or more courteous than a hurried human reply. It is whether the communication still does the clinical work that the patient’s situation requires. A concise refill confirmation may be adequate. A reply to a worrying symptom or an ambiguous result may need a different level of explanation, a safety net, or a different channel altogether. The draft’s apparent completeness can conceal the fact that these requirements were never recognized.
The hidden question is what the reviewer can still miss
The strongest reason to distrust the send button as a complete safety system comes from a simulation of clinician review. Twenty practicing primary care physicians were asked to respond to 18 patient-portal messages in a simulated electronic health-record environment. Four AI-generated drafts contained errors. Two were objective problems: a medication name was incorrectly spelled, and advice about when to receive a COVID-19 vaccination after infection differed from current guidance. Two were potentially harmful omissions: a message mentioning leg swelling and red spots did not direct the patient urgently enough toward evaluation for a possible blood clot, and a message about a vomiting child who was drinking excessively and having urinary problems did not address the possibility of diabetic ketoacidosis.
These are not all the same kind of defect. The typo is visible once noticed. The outdated guidance is a factual error that requires current knowledge. The other two failures are more revealing because the drafts offered plausible responses while omitting the action or urgency that mattered. A reply can acknowledge a symptom, offer a benign explanation, and recommend routine follow-up while still failing to tell a patient that the situation may require urgent assessment. Clinical safety therefore includes more than avoiding false statements. It includes recognizing what is missing, how serious the situation may be, and what the patient should do next.
The physicians’ review did not reliably close that gap. Each erroneous draft was insufficiently addressed by 13 to 15 of the 20 participants. Between 35% and 45% of the erroneous drafts were submitted entirely unedited. Participants missed an average of 2.67 of the four erroneous drafts, only one participant sufficiently addressed all four, and all but one sent at least one simulated response that still contained an error. These figures describe a small, deliberately constructed simulation—not the error rate of every clinical deployment—but they are enough to challenge a common assumption: the presence of a clinician at the release step does not demonstrate that the clinician detected and corrected the defect.
The same participants generally viewed the drafts favorably. Ninety-five percent said the drafts were helpful for responding to the messages; 80% agreed that they reduced cognitive workload; 90% agreed that they trusted the tool’s performance; and 75% agreed that the drafts were safe to use. A positive impression and a missed error can coexist. In fact, the impression that the draft is useful may be part of the reason a reviewer does not challenge it deeply. A fluent answer reduces friction, resembles an expected response, and allows an overextended clinician to move on to the next message.
The patient evidence makes the tension sharper rather than resolving it. In interviews, patients generally accepted AI drafting when a clinician reviewed, corrected, and approved the message. They wanted a human to remain accountable even when they regarded the portal as a transactional channel. That expectation is reasonable: the patient may not care who typed the first sentence, but they do care who stands behind guidance that reaches them. Yet the clinician simulation shows that “reviewed by a clinician” can describe a formal workflow without guaranteeing effective scrutiny. Accountability has to be made operational, not merely attached to a name or a button.
A more accurate mental model than “AI plus send”
A safe way to think about AI-drafted patient-portal messaging begins by separating four questions that are often collapsed into one. First, does the reply fit the patient’s purpose, clinical stakes, uncertainty, and preferred channel? Second, has a clinician actively checked the content, including what is absent, and taken responsibility for the decision to release it? Third, is there an independent way to surface errors that a fluent draft or busy reviewer may overlook? Fourth, can the patient understand how AI was used and who reviewed the message, while the organization monitors what happens afterward?
These questions are connected. Patient fit determines what “complete” means. Clinical review determines who is accountable for the meaning of the response. An independent checker can make omissions and workflow violations more visible, but it cannot decide every clinical nuance on its own. Disclosure can make the accountability arrangement honest and legible, but it cannot make an unsafe message safe. Monitoring is what allows an organization to discover whether the arrangement works beyond the moment of release: whether responses are timely, whether patients feel understood, whether miscommunication or disparities appear, and whether review is meaningful in practice.
The diagram’s important feature is not the number of boxes. It is the location of the send action. Sending is a transition in a larger system, not evidence that the preceding reasoning was adequate. A robust workflow may stop a draft, request correction, route a serious question to a phone call, or require additional review. It may also use patient feedback and safety reports to change the prompts, interface, routing rules, or review expectations. A system that can only produce a draft and release it has no meaningful response to uncertainty except hope that the reviewer notices it.
This framing also prevents two premature conclusions. The first is that any use of AI in portal messaging is inherently a loss of human care. Patients in the qualitative study often valued the efficiency of the channel and did not demand interpersonal warmth in every online exchange. The second is that a clinician send button makes the system safe by definition. The simulation provides evidence against that shortcut, while the patient interviews explain why clinician accountability remains important. The practical challenge is to preserve the benefit of assisted communication while designing the surrounding system so that responsibility, context, and error detection are visible and enforceable.
Once the problem is framed this way, the next question is more precise than “Can AI write a good message?” It is: when a proposed answer enters a clinician’s inbox, what work does it remove, what work does it create, and what kinds of judgment become easier to skip? The answer begins with the message’s lifecycle—from the patient’s question to the draft, the review, and the action that follows.