After-Hours Triage AI: What Must Go to a Nurse or 911

Not medical advice, not legal advice. This post is about testing phone software, not about how to treat anyone. In an emergency, call 911. Clinical content, routing rules and regulatory status must be owned by your licensed clinicians and counsel. Evalgent makes no HIPAA or other compliance claims. Facts checked October 19, 2026.

A patient calls your clinic at 11:40 p.m. Your front-desk line forwards to a voice agent your team built. The caller says her husband "feels a pressure in his chest but he says it's nothing." What happens in the next ten seconds is the entire product. This post is for the Head of AI or product owner who runs that agent inside a clinic platform. It covers what must route to a nurse or 911, how to build the routing so it cannot drift, and how to test it before each prompt change ships.

What an after hours triage AI is allowed to do

An after hours triage AI is AI phone triage for a clinic's closed-hours calls. It sorts them by urgency, and it may front your on-call nurse line, an AI nurse triage line or a traditional after hours answering service. The safe version does three jobs and refuses a fourth.

1. Recognize. Hear red flag symptoms, even in lay words, even when the caller minimizes it.

2. Route. Send the caller down a fixed lane: 911, a crisis line, poison control, the on-call clinician, or the morning queue.

3. Record. Capture name, callback number, location and the caller's own words so a human can act.

4. Never judge. It does not diagnose, rank causes, say "that is probably nothing" or tell anyone to wait.

That fourth line matters most. A voice agent that sounds calm and fluent can talk a worried caller out of calling 911. The failure is silent: the call ends politely and the record says "message taken."

See our healthcare AI receptionist QA guide for the full call flow, and dental scheduling errors for the routine side. This post covers only the moment a call stops being routine.

The four routing lanes

Every after hours call should land in exactly one lane. The lane is decided by a short rule set that your clinical owner signs off on. The model does not improvise it.

The trigger column is an example, not a clinical protocol. Which symptoms belong in lane 1 versus lane 3 is a clinical decision. Your medical director owns it, in writing, with a version number.

Two facts anchor lanes 1 and 2. The American Heart Association says: "Call 911 if you have heart attack warning signs. It's almost always the fastest way to get lifesaving treatment." It also says that even if you are not sure, get checked out. For crisis calls, the 988 Lifeline offers 24/7 call, text and chat access, and 911 "remains the system for emergencies." The Poison Help line is 1-800-222-1222, and the same page says to call 911 if the person collapses, has a seizure, has trouble breathing or cannot be awakened.

Why minutes matter: the cost of a soft answer

Stroke gives the clearest numbers. A 2006 model in the journal Stroke estimated that a typical untreated large-vessel stroke destroys about 1.9 million neurons per minute, or about 120 million per hour. These are model-based estimates, not measurements. The direction still holds. Each minute of "let me take a message" is a minute of brain.

So escalation timing is a first-class test metric. A 20-second empathy preamble before the 911 instruction is a defect.

What the evidence says about automated triage

Neither source tests a voice agent. Treat both as warnings about the task, not scores for yours.

Symptom checkers, 2015. Semigran and colleagues tested 23 online symptom checkers with 45 patient vignettes. Per the NIH summary, the correct diagnosis came first in only 34% of cases. Triage advice was appropriate in 57% of cases overall, and in 80% of emergencies. The tools tended to be cautious, urging care when self-care would do. So about one emergency in five did not get appropriate advice.

A consumer chatbot, 2026. Mount Sinai researchers published a structured test of ChatGPT Health in Nature Medicine on February 23, 2026. Per their press release, they ran 60 scenarios across 21 specialties under 16 contextual conditions, for 960 interactions. Three physicians set the correct urgency using guidelines from 56 medical societies. The tool showed under-triage on more than half of cases the physicians judged to be emergencies. In one asthma case it noted early signs of respiratory failure and still advised waiting. Its crisis alerts to 988 appeared inconsistently, including missing when users described specific self-harm plans. The paper is here.

Three lessons carry over.

• Context changes answers. The same case got different advice under different social framing. Your callers minimize, hedge and talk for someone else.
• Fluent is not safe. A system can name the danger in its own explanation and still reassure. Judge the action, not the prose.
• Guardrails fail unevenly. A crisis banner that fires in low-risk cases and not in high-risk ones is worse than it looks on a happy-path demo.

Protocols, licensing and the line you must not cross

Scripted protocol: a clinician-authored decision sequence in which each answer maps to a fixed disposition. The AI reads it. It does not rewrite it.

The best-known telephone triage protocols are the Schmitt-Thompson set. Its publisher says the After Hours set is used by 95% of after-hours and managed-care call centers in North America, with 456 adult and 400 pediatric topics. It also says the content "can be incorporated into software and AI solutions that handle triage calls." The page does not publish licensing terms or prices. So if you want protocol content inside your agent, contact the publisher or a licensed software partner and read the terms. Do not paraphrase protocol text from memory into your prompt. That is a licensing question and a clinical-accuracy question.

Then there is the device question. FDA revised its clinical decision support guidance in January 2026. In an FDA town hall on the guidance, staff said the non-device criteria are framed around software intended to support a health care professional. They also said software that supports or recommends to a patient "would fail criterion three and would not be non-device CDS." Law-firm summaries note the guidance focuses on clinician-facing tools and gives no new policy for consumer-facing symptom checkers. It also adds time-critical decision-making to the independent-review criterion.

A patient-facing agent that recommends a level of care sits in a gray area. That is one more reason to keep the design to routing a fixed script. Whether your specific agent is a device is a question for regulatory counsel. This is not legal advice.

Many states also limit who may perform telephone triage. Ask counsel how your state's rules apply.

Build the tripwire as code, not as a prompt line

The most useful design principle in this post is asymmetric authority. Any layer may escalate a call. Only a human clinician may de-escalate one.

Concretely, run a deterministic red-flag scan on every caller turn, in parallel with the language model. If it fires, a fixed, pre-recorded script plays. The model's output for that turn is discarded. The model cannot talk the script out of firing, because it is not in the path.

Here is a simplified sketch. The patterns are illustrative and incomplete. Your clinical owner supplies the real list.

import re

# Illustrative only. A clinician owns the real list and its version.
RED_FLAGS = {
    "breathing": [r"can'?t (catch|get) (my|a) breath", r"gasping", r"blue lips|turning blue", r"not breathing"],
    "chest":     [r"chest (pain|pressure|tightness|is tight)"],
    "stroke":    [r"face (is )?droop", r"slurr", r"can'?t (lift|move) (his|her|my) (arm|leg)"],
    "unresponsive": [r"won'?t wake|not responding|passed out|unconscious"],
    "bleeding":  [r"won'?t stop bleeding|bleeding (a lot|heavily)"],
    "self_harm": [r"kill myself|end my life|suicid"],
    "poison":    [r"swallowed|overdos|took too many"],
}
NEGATED = re.compile(r"\b(no|not|never|without|denies)\b[^.]{0,25}$")

def scan(utterance: str):
    text = utterance.lower()
    hits = []
    for category, patterns in RED_FLAGS.items():
        for p in patterns:
            m = re.search(p, text)
            if m:
                negated = bool(NEGATED.search(text[: m.start()]))
                hits.append((category, negated))
    return hits

def decide(hits):
    firm = [c for c, neg in hits if not neg]
    if firm:
        return ("PLAY_SCRIPT", firm[0])   # fixed audio, no LLM text
    if hits:
        return ("CONFIRM", hits[0][0])    # one scripted question, never skip
    return ("CONTINUE", None)

Three gotchas show up in real transcripts.

• Negation is a trap. "No chest pain" and "no, his chest pain is not gone" differ by one word. When negation is detected, ask one scripted confirmation question. Never silently ignore the hit.
• Speech-to-text mangles medical phrasing. "Slurring" can become "slurring" or "sir ring." Scan streaming partials and finals, and test with accented and noisy audio. See STT entity accuracy and background noise testing.
• Lexicons never cover lay language. Add a classifier as a second tripwire. It may only escalate. It may never cancel the lexicon.

Once a lane 1 script starts, make it uninterruptible except for one thing: a short repeat on request. Callers say "hello?" and "what?" under stress. A barge-in that restarts the call flow wastes the seconds you are testing for. See barge-in and interruption handling.

Escalation timing: a worked latency budget

Escalation speed is measurable. The table below uses illustrative assumptions, not measurements from any product. Replace each with your own p95.

The fixed path starts speaking almost 1.2 seconds earlier in this example. It is also deterministic, so the budget has no long tail from the model. Measure time from the end of the caller's red-flag phrase to the first audio of the instruction. Our guide to time to first audio covers the measurement itself.

There is a second timer: what happens if the caller goes silent after a red flag. The line may have dropped, or the person may have collapsed. Your clinical owner decides the rule. A common design choice is to repeat the instruction once, then try a callback and page the on-call clinician. Whatever you pick, test it with silence, because silence is the case demos skip.

What to test: a matrix, not a checklist

Red-flag handling fails where phrasing, audio and context interact. Build a matrix of symptom categories against conditions, and run it as simulated calls.

Categories (from your clinical owner's lane 1 and 2 list): breathing, chest, stroke signs, unresponsive, severe bleeding, self-harm, poisoning, plus the pediatric and obstetric items your practice sees.

Conditions to cross with every category:

• Plain statement versus minimized ("probably nothing, but").
• Caller describes someone else ("my mother is acting strange").
• Negation and correction ("no chest pain, wait, actually yes").
• Lay phrasing and slang, not clinical terms.
• Accents, fast speech, a crying or whispering caller, background TV or traffic.
• Caller interrupts the script or asks "what?" mid-instruction.
• Spanish and other languages your patients use.
• Caller changes subject mid-call: the red flag appears in turn six of a refill request.

Then add the opposite panel. Include non-emergency calls that sound alarming ("my chest is sore from the gym") to measure over-escalation. Over-triage is a cost, since it burns nurse time and trains staff to ignore pages. It is not a safety failure, and the two should never be traded off in one number.

For accents and noise, our guides to accent robustness and guardrail testing cover the generic mechanics. For handoff mechanics, see escalation accuracy and handoff loops.

Metrics, thresholds and sample size

Score the action the call took, not the transcript prose. The scorecard below uses suggested starting thresholds. They are not standards. Your clinical owner sets the real ones.

Red-flag recall is the share of lane 1 and 2 test calls where the correct script played. Report it per category, never as one blended number. A blended 98% can hide a category at 80%. Every missed emergency is a false negative, so count those separately.

Sample size. Zero misses in n calls does not prove a zero miss rate. The "rule of three" gives a rough 95% upper bound of 3/n for the true miss rate after n clean trials. This is standard statistics, shown here as a worked example.

If your target is "under 1% per category," you need about 300 clean calls in each category, across conditions. For eight categories, that is roughly 2,400 simulated calls per release candidate. A single miss resets the argument: fix the cause, then rerun the full category.

Because the sample is synthetic, say so. Simulated callers test your routing logic and your audio handling. They do not tell you how real patients will phrase things. Production monitoring covers that gap.

How to test an after hours triage AI before every release

1. Freeze the protocol. Get the lane definitions, red-flag list, scripts and disposition rules from your clinical owner, with a version number. Test against that version only.

2. Generate scenarios from the flow. Cover every state, branch and hard constraint in the prompt, plus the coverage gaps. Add the matrix conditions above.

3. Build caller profiles. Vary accent, pace, interruption level, response delay, background noise and language. Include a silent caller and a crying caller.

4. Call the real path. Dial the agent over phone, SIP or WebRTC, so audio, endpointing and telephony effects are in play. Do not call the model directly.

5. Score from the audio. Check that the right script played, how fast, and that no forbidden phrase was spoken. Forbidden phrases include any diagnosis, "it's probably," "nothing to worry about," and "you can wait."

6. Gate the release. Block any change with a single lane 1 or 2 miss. Review failed calls with a clinician.

7. Re-run on every change. Prompt edits, model swaps, STT changes and voice changes all count. See shipping prompt changes safely.

8. Monitor live calls. Score every after-hours call, then review the lane 1 and 2 calls and a sample of lane 4 calls for missed red flags.

Evalgent works with teams to set this up for a first agent. It generates test scenarios from the agent's prompt and flows, and runs simulated callers over phone, SIP or WebRTC with the caller profiles above. It judges from the audio, not only the transcript, which matters here because breathing, distress and a caller who says "I'm fine" while gasping are not in the text. Verdicts carry evidence and can be human-reviewed. For the transcript-versus-audio argument, see transcript vs audio evaluation.

Monitoring real after-hours calls

Simulated testing finds what you thought of. Production finds what you did not. Callers will use phrases no one wrote down.

Evalgent's production monitoring takes call recordings your team pushes, transcribes them, maps them to scenarios and judges them. It flags policy failures, tool-call failures, latency spikes and PII leakage, with fix recommendations. For this use case, two custom metrics earn their place on every call: "red flag mentioned and lane 1 or 2 script not played," and "page or transfer tool call failed." The second is the silent killer. The agent said "I'm alerting the nurse" and the page API returned an error. See detecting silent tool failures.

Feed every miss back into the matrix as a new test. That loop is how the red-flag list grows from your callers' real language.

Where this fits in your healthcare stack

After-hours triage is the highest-severity call type in a clinic. Treat it separately from scheduling and refills. Prescription lines have their own risks, covered in prescription refill AI calls. The general healthcare view is in voice agent testing for healthcare and the regulated policy test cases. Animal clinics have a parallel problem, which is covered in veterinary AI receptionists.

This post does not address privacy law or HIPAA. If your agent handles protected health information, your counsel and security team must review that separately.

Frequently asked questions

Can an AI safely triage patients after hours?

Only in a narrow sense. A voice agent can recognize red-flag words, read a clinician-approved script, and route the call. It should not assess, diagnose or reassure. Independent tests of consumer tools, including a 2026 Mount Sinai study, found missed emergencies. Keep the design to routing, and test it hard.

Which symptoms must an after hours triage AI send to 911?

Your medical director decides the list. Typical lane 1 candidates include not breathing, unresponsiveness, chest pressure, stroke signs and severe bleeding. The American Heart Association says to call 911 for heart attack warning signs, even when unsure. The AI should not weigh these. It should read the script immediately.

Does an after hours triage AI need Schmitt-Thompson protocols?

No rule says it must. But a scripted, clinician-authored protocol is safer than model improvisation. Schmitt-Thompson content is widely used by nurse triage services, and its publisher says it can be built into software and AI. Licensing terms are not public, so contact the publisher or a licensed partner.

Should the AI ever say symptoms are not serious?

No. Reassurance is a clinical judgment, and an agent that sounds confident can talk someone out of seeking care. Test for forbidden phrases such as "it's probably nothing" and "you can wait." The safe alternatives are routing to the on-call clinician or giving the next-business-day message path.

How many test calls do I need per symptom category?

The rule of three says zero misses in n calls gives about a 3/n upper bound at 95% confidence. For an under-1% miss bound, run roughly 300 clean calls per category. That is a worked estimate. Simulated calls do not replace review of real calls.

Is an after hours triage AI an FDA-regulated device?

It might be. FDA's January 2026 clinical decision support guidance centers on tools for health care professionals, and FDA staff said software that recommends to patients fails the non-device criterion. Whether your agent qualifies depends on its intended use. Ask regulatory counsel. This is not legal advice.

How fast must the AI escalate to 911 or a nurse?

There is no published universal standard. Set your own target and measure it. A pre-rendered script can begin in under a second after the caller stops speaking, as the illustrative budget above shows. Measure the time from the end of the red-flag phrase to first audio, at p95, not the average.

What should the AI do if a caller mentions suicide or an overdose?

Read a fixed script. For suicidal thoughts, direct the caller to call or text 988, which offers 24/7 support, and to call 911 for immediate danger. For poisoning, give Poison Help at 1-800-222-1222, and 911 if the person collapses or has trouble breathing. Test these paths in every language you serve.

The bottom line

An after hours triage AI should recognize, route and record, and it should never diagnose or reassure. Prove it with per-category red-flag recall, a measured time to the 911 instruction, and a zero-miss release gate on every change.