The concierge in the lobby: designing patient services for AI agents

For twenty years the hospital website was the patient's front door. That is changing. On October 21, 2026, Epic launched Connectors, a feature that lets its AI agents complete tasks inside other vendors' applications. The practical effect is that patient engagement moves from pages a person clicks to services an agent calls, and the website becomes the source of truth the agent reads rather than the place the patient does the work. The job in front of health systems is governance, not graphic design.

What Epic Connectors does

Connectors let Epic's AI agents, including Emmie, its patient-facing assistant, look up information and carry out tasks inside third-party apps rather than only inside Epic. Epic's own examples are ordering a patient's meal, giving directions through a hospital, and arranging a follow-up visit. The feature uses the Model Context Protocol first, the emerging standard for how an agent talks to an outside system. Epic plans to test with health systems by the end of 2026 and to open Connectors to developers on its Epic Showroom marketplace in March 2027. Health systems decide what each Connector is allowed to read and change.

The clearest way to picture it is a change to the floor plan. The website was the front door people walked through. Now there is a concierge standing in the lobby, and the concierge only sends patients to rooms it can reach. Whichever services you have wired for an agent to call are the ones that get used. The rest sit behind a form and wait for a human who may never arrive.

Take inventory of what an agent can reach

Before a single Connector is switched on, a health system needs an honest inventory of its patient services, sorted by whether an agent can actually act on them. Scheduling, wayfinding, bill pay, and prescription refills are the obvious candidates. Each one is either a service an agent can complete or a task trapped in a web form that still needs a person.

• Reachable by an agent: anything with a defined action behind it, such as booking an appointment slot, returning a building route, or posting a payment.
• Trapped in a form: anything that exists only as a page a human reads and a field a human types into, with no service an agent can call underneath.

That inventory is the roadmap. The services on the wrong side of the line are where patients will quietly fall out of the new experience.

Consent and the audit trail travel with the patient

When an agent carries patient context into a vendor's app, the consent for that handoff has to be captured, and the record of it has to live somewhere a compliance team can find. This maps directly onto HIPAA's minimum necessary standard and onto the scope of each business associate agreement. An agent that passes more than a task requires, or that reaches a vendor whose agreement never covered this use, is a finding waiting to happen. The permission model Epic provides is the control surface. Someone has to configure it with intent, and someone has to be able to show, after the fact, what was shared and why.

Accessibility does not stop at the agent

An agent can hand a patient to a screen that was never built to be used without sight or without a mouse. WCAG and Section 1557 of the Affordable Care Act apply to whatever interface the patient lands on, not just to the page that started the journey. Routing a screen-reader user into a third-party app with an inaccessible checkout is the same failure it has always been, now one step removed and harder to see. The handoff is only as accessible as its destination.

Write the permissions before you turn it on

A short worksheet answered before enabling any Connector saves a great deal of cleanup later:

1. Which patient services can an agent call, and which are still locked inside a form?
2. When an agent passes patient context to a vendor app, who captured the consent, and where is it logged?
3. Does the agreement with that vendor cover this exact use of patient data?
4. Is the screen on the other end of the handoff accessible, tested, and owned?
5. Who on the team owns the permission list, and reviews it on a schedule?

The shift underneath all of this is quiet but large. The website stops being the main stage and becomes the structured, reliable record an agent reads before it acts for a patient. We are platform agnostic front- and back-end technologists, enabling enterprise-scale web transformation for regulated organizations, and this is the kind of change that rewards getting the governance right before the convenience ships.

Sources: Fierce Healthcare, Epic launches Connectors to link its AI tools with third-party apps; Healthcare IT News, Epic enables EHRs to communicate with other apps; HealthSystemCIO, Epic's Connectors.