Healthcare and care services: AI-assisted intake and visit records, delivered with privacy design
AI now drafts the first pass on referral intake, visit notes and patient messages in healthcare and care services, with your privacy lead making the final call before anything reaches a record. Netbase takes on that capability, data platform engineering and assurance, and its published WhatsApp assistant is the closest proof of the messaging discipline underneath it.
Submit a project See custom product engineeringReviewed by Huy Nguyen (David), CEO · Updated 14 Oct 2026
Which workflows does a first project usually touch?
Clinics, home-care agencies, care homes and digital health start-ups share five administrative workflows, and a first project should own one of them end to end.
- Scheduling and reminders. Appointment or visit slots, carer availability, cancellations and the reminder that reduces missed visits. In home care the schedule is also a route, so travel time belongs in the rules.
- Referral and intake. A referral letter, a self-referral form or a call arrives; someone checks eligibility and decides who sees the person first.
- Visit and encounter records. What was done, by whom, when and with what outcome; for a care agency this is the record the family may later ask to see.
- Consent and data-sharing preferences. Who agreed to what, for which purpose, and when the agreement must be checked again.
- Billing, claims or commissioning returns. An insurer claim or a commissioner's return, built from the records above.
Documents that move between these steps, such as referral letters, care plans and discharge summaries, follow the approval patterns on document and approval workflows.
Who are the actors, and what do they need?
want to book, rearrange and understand what happens next without a phone queue.
want the record to take less time than the visit, often on a phone with poor connectivity.
carry the hardest rules: skills, continuity of carer, travel, legal limits on working hours.
ask for visibility, and the system must know when they are entitled to it.
want evidence that visits happened and records were kept.
decides what may be collected, where it may be stored and who may see it.
The pressure most operators describe: administration grows faster than care hours, and every workaround, such as a shared spreadsheet, becomes an undocumented copy of health data.
Where does AI change the workflow, and where does Netbase take it on?
Referral intake, scheduling and patient messaging are moving to AI-assisted drafting with a named person confirming the result, and Netbase embraces each new capability as it appears.
A related Netbase record shows the build shape: for a client who is not named, Netbase built a WhatsApp Business AI chatbot with intent and conversation-flow handling, an LLM API (GPT-4 in the stack) and CRM synchronisation for lead capture and workflow automation, delivered in milestones from design and prototype to documentation and support over four to eight weeks. The WhatsApp chatbot record shows the build shape of a booking assistant; a healthcare version adds a consent notice and a designed human hand-over. Netbase has also delivered anonymised client AI projects including retrieval-based knowledge assistants, document AI and MLOps pipelines, and works with commercial and open-source AI models chosen per project. AI should not diagnose, triage or advise on treatment unless your regulatory adviser has classified that feature and a clinical safety process covers it.
-
Referral and intake
Document AI extracts fields from a referral letter for a person to confirm, and retrieval over your own care protocols gives the reviewer the rule that applies. This is Data and AI Platform Engineering: a consented data pipeline and a retrieval index, not the source record itself.
-
Scheduling and patient messaging
An assistant answers booking questions, drafts an intake summary for a human to confirm, and routes a message to the right team, through AI Workflow Automation.
-
Clinical-safety style evaluation
Any assistant touching patient data needs an evaluation set, a privacy test and a red-team pass before release, which is Quality, Security and AI Assurance: standing gates a release must pass, not a one-off audit.
-
Hosting and data residency
Consented health data and every AI provider in the chain need a named hosting region and access model, which is Cloud Platform and DevOps Engineering.
Which regulatory questions belong with your advisers?
Software suppliers do not answer these; your privacy counsel or regulatory adviser does. Put them in writing first.
-
Are we a HIPAA covered entity or business associate, and does the vendor need a business associate agreement?
- Why it changes the design
- Decides whether the vendor may touch protected health information and what safeguards the contract requires
- Official starting point
- 45 CFR Part 164, Subpart C security standards (eCFR, accessed 2026-09-28)
-
Is this health data a special category under GDPR, and on which condition do we process it?
- Why it changes the design
- Sets the lawful basis and where data may be hosted
- Official starting point
- Regulation (EU) 2016/679, Article 9 (EUR-Lex, accessed 2026-09-28)
-
Will the system access NHS patient data or systems?
- Why it changes the design
- That access requires the Data Security and Protection Toolkit; version 9 for 2026-27 was released 8 September 2026
- Official starting point
- NHS England DSPT site (accessed 2026-09-28)
-
Does any feature perform a medical purpose, such as triage scoring or dose calculation?
- Why it changes the design
- That can be regulated as a medical device, which changes validation and release
- Official starting point
- FDA, Software as a Medical Device (accessed 2026-09-28)
-
Which system is the record of truth, and does it expose a standard interface?
- Why it changes the design
- An HL7 FHIR interface makes this an integration; without one it is a migration
- Official starting point
- HL7 FHIR specification (accessed 2026-09-28)
Settle data before any of this is built: collect the minimum necessary fields, since free-text notes are where unexpected health detail accumulates; build and test on synthetic records, with production access named, logged and time-limited; make every record change attributable to a person; and decide the hosting region with the privacy lead, checked for every AI provider too.
Netbase security practices include secure code review and version control, role-based access control, MFA for admin dashboards, contributors under NDA, and NDAs and DPAs on request. Its compliance practices are GDPR alignment for data privacy in Europe, HIPAA-aligned methodologies for healthcare data handling, and CCPA compliance for clients with U.S. customer bases. These are practices, not certificates, and they never stand in for your organisation's own compliance. The data security and compliance guide lists the access questions in full.
Where does each job route to a Netbase capability?
Match each job to the capability that owns it, then combine two for a first milestone.
Data and AI Platform Engineering
Data and AI Platform EngineeringAI Workflow Automation
AI Workflow AutomationQuality, Security and AI Assurance
Quality, Security and AI AssuranceCloud Platform and DevOps Engineering
Cloud Platform and DevOps EngineeringCustom Product Engineering
Custom Product EngineeringWhat does a worked first project look like?
A hypothetical home-care agency runs visits from a spreadsheet and a group chat. Carers message changes, a coordinator re-keys them, and the monthly commissioner return takes several days to reconcile.
- Milestone one replaces the spreadsheet with a visit schedule that knows carer skills and travel time, and sends visit changes to the carer's phone.
- Milestone two adds an electronic visit record: arrival, tasks completed, notes, departure, captured offline and synchronised later.
- Milestone three produces the commissioner return from those records, plus a read-only family view governed by recorded consent.
Real service-user data enters only after the privacy lead signs off hosting and access; until then the team tests on synthetic records.
Where does outsourcing fit, and where does it not?
Good fit
- Administrative workflows: scheduling, intake, visit records, consent, returns
- A portal beside an existing health record that exposes an interface
- Replacing spreadsheets and chat groups that hold health data
- Firms like professional services with a health-adjacent line
Another route fits better
- A clinical system you must buy, where configuration is the job
- A medical device feature without a regulatory adviser engaged
- Advice on your own legal compliance, which belongs to counsel
- Front-line support volume, where customer support automation is narrower
Custom product engineering for a bounded release outcome
One defined release of your product, built to named outcomes and handed over with acceptance evidence.
Learn More
Cloud platform and DevOps engineering: one platform for apps and AI workloads
Infrastructure as code, CI/CD, inference hosting, observability and cost controls for apps and AI workloads.
Learn More
Data and AI platform engineering: one foundation your workflows share
Pipelines, retrieval indexes and model operations your AI and analytics workflows can share.
Learn More
What experience can Netbase bring to a care workflow?
Netbase has delivered projects for healthcare clients who are not named, and their project details stay private. The published Work record closest to a care workflow is the WhatsApp assistant above, which shows the messaging and hand-over discipline a booking or intake assistant needs. The method on this page, one workflow at a time with synthetic data until the privacy lead signs off, is how Netbase scopes any regulated data flow. The regulatory table above is a list of questions for your advisers, not clinical advice. Evidence labelling is on the methodology page.
Netbase designed and built an AI chatbot on WhatsApp Business that handles intents and conversation flows and keeps lead and customer data in step with the client's CRM, delivered in milestones from prototype to knowledge transfer.
Keep ReadingWhich delivery risks are specific to this sector?
-
Consent recorded once, never re-checked
Preferences change; the system must know when a family member's access lapses.
-
Real data in test environments
A copied production database is a frequent cause of privacy incidents during a build.
-
Integration assumed, not confirmed
Teams plan around an interface and discover the licence or access was never granted.
-
Scope drifting into clinical judgement
A helpful scoring feature can turn an administrative tool into a regulated product.
-
Rostering rules left in one coordinator's head
Continuity, skills and working-time limits must be written down in discovery.
Netbase's delivery lifecycle runs from discovery and strategic alignment through team assembly and architecture planning, agile execution with outcome-based milestones, modular components, training and rollout to ongoing support; in this sector discovery closes when the privacy lead has signed off the data rules.
Common questions
The WhatsApp assistant record, with its intent handling, LLM stack and CRM synchronisation for lead and workflow automation.
No. Netbase follows HIPAA-aligned methodologies, a practice statement, and your own compliance remains your organisation's responsibility.
Yes, for most of the build. Synthetic records cover design and testing, and production access, where needed, is named and approved by your privacy lead.
Only if it exposes an interface you are licensed to use, such as HL7 FHIR. Confirm access in discovery first.
Netbase JSC's head office is in Hanoi, Vietnam, and it is the company's only office.
Yes. Every service on this site is delivered remotely from Hanoi, and Netbase has worked with clients in 80 countries. Delivery communication is in English, with weekly reviews and a named project manager.
Netbase takes on projects in any industry where the work can be delivered remotely and accepted by milestones. The industry pages describe the approach sector by sector, and the Work records show delivered projects.
Payment is by bank transfer to the company account of Netbase JSC or through PayPal Business. The payee is always Netbase JSC, the company that operates OutsourcingVN.
Talk to Huy Nguyen (David), Founder and CEO of Netbase JSC: message him on WhatsApp at +84 937 869 689 or email project@netbasejsc.com. You can also send your brief through the project request form. Say which workflow or system the project concerns and what has to stay unchanged; the first step is a discovery conversation, and scope and milestones are agreed after it.
Start with one workflow and your data rules
Bring one workflow, the people who touch it, and your adviser's answers above. Related sectors include real estate and construction and financial services and fintech; all sectors are under industries. The build route is custom product engineering. OutsourcingVN is operated by Netbase JSC and is Netbase's own outsourcing-services platform; submit a project when the brief is ready.
Sources
- US Code of Federal Regulations, 45 CFR Part 164 (HIPAA privacy and security standards)
- Regulation (EU) 2016/679 (General Data Protection Regulation)
- NHS England, Data Security and Protection Toolkit
- US Food and Drug Administration, Software as a Medical Device
- HL7 International, FHIR specification