Healthcare Chatbot Development: Improve Patient Engagement

A chatbot that handles patient intake touches health data from the first message, so the build decisions that matter most get made before anyone designs a conversation. Healthcare chatbot development comes down to three questions: will patients use it, may your infrastructure hold what they type, and does the software drift into regulated territory. This guide takes them in that order.

Where healthcare chatbot development earns its place first

Patient intake is the safest place to start, and it's the one use the research we read actually measured. In a 2022 experiment in Frontiers in Digital Health, 206 US adults completed the same 21-question social-needs assessment twice, once with a chatbot and once with an online form.

Measure	Chatbot	Online form	What it tells you
Preferred by	69.9%	30.1%	Most participants chose the chatbot
Net Promoter Score	24	13	The chatbot earned more recommendations
Median completion time	212.5 seconds	123.0 seconds	The conversation costs the patient time

Patients liked the chatbot better and took longer with it. That's a fair trade for a long or sensitive questionnaire and a poor one for a thirty-second reschedule.

Read the result with its limits attached. Participants came from Amazon Mechanical Turk rather than from patient populations, few were over 60, and the chatbot asked one question at a time with progress tracking, so the authors say the preference may not come from the conversational style alone. Some participants also raised privacy concerns about the chatbot.

Several of the authors are tied to Doxy.me and to companies that integrate the chatbot tested. The study measured experience, not whether the data collected was any better.

Engagement after intake is a separate question for healthcare chatbot development, and our piece on patient engagement strategies for modern healthcare covers what else gets patients to act. A bot on your public site doubles as a marketing tool, which we cover in how healthcare chatbots convert visitors into patients.

Does your chatbot need a business associate agreement?

If it handles protected health information and you're a covered entity or a business associate, yes: every cloud service that stores or processes that information needs to be HIPAA eligible and covered by a signed agreement. AWS states the rule for its own platform in its HIPAA Eligible Services Reference, updated October 15, 2026. Customers agree not to use the listed services for PHI without first entering into an AWS business associate agreement.

The same page lists Amazon Bedrock, so a language model hosted there can sit inside a compliant account. It also says customers stay responsible for their own HIPAA compliance under a shared responsibility model, and that unlisted services can share an account only if they don't process or store ePHI. Eligibility covers the platform. Configuration, access control and everything built on top is yours to get right.

The practical exercise in healthcare chatbot development is a map of everywhere a message travels. Each of these is a place PHI can land, and each needs the same answer about eligibility and agreements, from whichever provider you use:

• the host that runs the language model
• stored chat transcripts and logs
• analytics and error-tracking tools
• the SMS or messaging gateway
• the connection to scheduling or records systems

Analytics and error tracking are the ones teams forget. They get added late and can end up receiving the full text of a message.

When does a healthcare chatbot become a medical device?

The question arises when a chatbot starts recommending clinical action. FDA revised its Clinical Decision Support guidance on January 6, 2026, and Polsinelli's summary of the update says FDA won't enforce device requirements for software that gives a healthcare professional a single recommendation, provided it's the only clinically appropriate option and the software meets the other criteria.

The loosening is narrow. The four criteria are unchanged, time-critical decisions still carry a higher risk of being treated as a device, and the guidance doesn't explain how FDA decides what counts as the only appropriate option. FDA issued it without seeking public comment.

That guidance concerns software advising healthcare professionals. A bot that talks to patients about symptoms is a different design, and we found no source covering it, so get a regulatory opinion before the conversation design is fixed. Narrowing the scope at the start costs less than retrofitting it later.

What patients should shape before you build

Test the conversation with patients before committing to it, because published guidance on involving patients in healthcare chatbot development is thin. A 2023 scoping review in the Journal of Participatory Medicine covered 16 studies of text-based chatbots for healthy eating, physical activity and mental wellness, and only three described patient involvement in enough detail to be scored on a standard checklist.

The authors call for more systematic reporting and more active patient involvement in development. Their review covered only simple text or voice chatbots, so it speaks for those and nothing broader.

So put a clickable prototype in front of real patients, older ones included, and watch where they stall and where they ask for a person.

Surface matters as well. We designed and built OptimalMD's website, members portal and mobile app end to end, as our OptimalMD case study describes. A chatbot in any of those three would meet a different patient: an anonymous visitor, a logged-in member, someone on a phone.

What to build first

Scripted flows before generated answers

Start with flows where you've reviewed every possible reply: intake questions, appointment booking, reminders. Add generated answers once transcripts are logged under the controls from your data map and a person reviews them.

The FDA summary above is the reason for the order. The closer a bot gets to recommending action, the more scrutiny follows.

Put the bot where patients already log in

A chatbot inside an existing patient portal inherits authentication, so it knows who it's talking to and can work with their appointments. Our overview of patient portal development covers what that surface takes to build.

A standalone widget on a public site launches faster but can't identify the patient. Keep it to general questions and booking requests.

Treat healthcare chatbot development as one project

The chat layer, the compliance setup, the connections to your other systems and the agreements behind them depend on each other, and splitting them across vendors is how gaps open. Teams building AI and automation features and teams building apps and SaaS products both end up in this work, and our complete guide to healthcare software development covers the wider build.

Begin with intake inside the portal, and have whoever owns compliance sign off the data map before the first line of conversation is written.

Frequently asked questions

Do patients prefer a chatbot to an online form?

In the Frontiers experiment, most participants preferred the chatbot, though it took longer to complete. The sample came from Mechanical Turk rather than from patients, so treat it as a signal to test with your own patients.

Is Amazon Bedrock HIPAA eligible?

AWS lists Amazon Bedrock on its HIPAA Eligible Services Reference. You still need a signed AWS business associate agreement and a configuration that meets HIPAA requirements.

Is every healthcare chatbot a medical device?

Whether software is a device depends on what it does. FDA's Clinical Decision Support guidance sets four criteria and the January 2026 update left them unchanged, so get regulatory advice for any bot that recommends clinical action.

Cover photo by erwinbosman on Pixabay