AI for Doctors in 2026: Evidence Lookups, Charting and Prior Auth

AI can now answer evidence questions with citations, draft visit notes from the room's audio, prepare inbox replies and write prior authorization letters for you to check. It can't examine a patient, carry your license or make a tool safe for patient data. You still review every output, and HIPAA still applies.

A vendor's page sells you its one product. This guide follows the clinic day instead: which kind of AI fits each moment, what the trials measured, which questions to settle before a patient detail leaves your EHR, and the part of a physician's week where a general assistant like Merlin fits, which is outside the chart.

How doctors use AI today, and what nobody has shown yet

Physicians have adopted AI quickly. A Harvard Medical School and Brigham and Women's study in JAMA, published October 15, 2026, followed about 950,000 US physicians, PAs and NPs on OpenEvidence. Monthly users went from 355 in January 2024 to 703,265 in June 2026, across 270 million queries, and treatment and management decisions dominated the 51.9% of sampled queries about clinical decision-making (Harvard Medical School).

That study covers one platform, three of its co-authors work for OpenEvidence, and it doesn't measure whether patients did better. The authors name that as the next step. The American Medical Association's 2026 survey points the same way on adoption: 81% of physicians reported using AI in practice, up from 38% in 2023, while 88% worried about skill loss (Healthcare Innovation on the AMA survey). Wide use shows doctors find these tools worth opening. It doesn't yet show they improve care, and we have no accuracy figure to give you for evidence lookups, so open the cited paper before you rely on an answer.

Which AI fits which moment in a clinic day

Each category of clinical AI touches patient data differently, so sort tools by the moment they serve before comparing brands.

Who buys also differs. Abridge pitches health systems and payers, and says 300+ health systems trust it (Abridge). Microsoft publishes no price for Dragon Copilot and points you to a contact link (Microsoft). Freed lists plans for individual clinicians, from $39 a month depending on plan and billing, with a free week to try it, though EHR push and coding sit on its higher Premier plan (Freed pricing). In a hospital, IT probably decides for you.

What the ambient scribe trials measured

Randomized evidence on ambient scribes shows modest gains and uneven time savings, so treat vendor time claims with care. In a UCLA trial of 238 outpatient physicians across 14 specialties, published in NEJM AI, Nabla cut time in note by 9.5% against usual care, while Microsoft's DAX Copilot showed no significant change (1.7% lower). Physicians used the scribes in 33.5% and 29.5% of visits, so most visits ran without one (NEJM AI abstract).

The most striking burnout result comes from a weaker study design. A JAMA Network Open quality improvement study of 263 clinicians at six US health systems reported burnout falling from 51.9% to 38.8% after 30 days, and 0.90 fewer hours of after-hours documentation. It compared pre- and post-surveys of the same clinicians, so other changes over that time can't be ruled out, and clinicians rated patient understandability of care plans from notes slightly lower afterward (JAMA Network Open).

The UCLA authors also reported that clinically significant inaccuracies turned up occasionally with both products and call for ongoing vigilance. A note you sign is your documentation, so read each one against what happened in the room, especially medication doses, laterality and anything the patient said only once.

Patient messages: useful drafts, with a review cost

Inbox drafting has shown modest gains so far, and someone still has to read each draft. At one New York City health system, 75 health care professionals used AI drafts at an overall rate of 19.4%, turnaround improved by 6.76%, and the number of steps required rose slightly. Drafts were also generated for the 80% of messages that never got a reply at all (npj Digital Medicine).

Quality isn't the main obstacle. In an NYU Langone study of In Basket messages, primary care physicians rated AI replies about equal to human ones on accuracy, but the AI replies ran 38% longer and read at an eighth-grade level against a sixth-grade level for clinicians (summary of the JAMA Network Open paper). If you adopt drafting, cut for length and plain language before you press send.

Prior authorization: where a letter generator earns its place

Prior auth is the clearest admin target because the volume is so high. In the AMA's survey of 1,000 physicians, fielded in December 2025, practices averaged 40 requests per physician each week, with 13 hours of physician and staff time spent managing them (Medical Economics). Doximity says Ask can generate appeal letters and prior authorizations and is free on desktop and mobile (Doximity Ask).

A generated letter depends entirely on the chart facts and payer criteria you feed it, so check that each prior therapy, date and citation in it is real before it goes out. The payer side is changing too. Under the CMS prior authorization rule, Medicare Advantage, Medicaid and CHIP payers must decide urgent requests within 72 hours and standard ones within 7 calendar days, and those payers plus federal exchange plans must offer a prior authorization API from January 1, 2027 (CMS).

Five checks before patient data enters an AI tool

A vendor that handles protected health information (PHI) for your practice is a business associate under HIPAA, and you need that vendor's assurances in writing. The definition covers anyone who creates, receives, maintains or transmits PHI on your behalf (45 CFR 160.103), and the assurances must be documented in a contract or similar written agreement (45 CFR 164.502(e)). HHS applies the same logic to cloud services in its cloud computing guidance. Ask your privacy officer or counsel about your own setup; this page isn't legal advice.

1. Find the signed agreement, not the badge. "HIPAA compliant" on a homepage isn't a business associate agreement (BAA) between that vendor and your practice. OpenEvidence, for example, says covered entities that enter PHI agree to its BAA, and that users remain responsible for their inputs (OpenEvidence). Freed lists an organization-wide BAA as an admin feature without saying which plans get it (Freed), so ask.
2. Check your employer's policy. A personal account can sit outside what your hospital allows. OpenEvidence's terms say your use is also subject to your employer's or organization's policies (terms).
3. Follow the data past the first vendor. Google's BAA covers listed Workspace services, says customers without one must not use PHI in those services, and excludes third-party apps and add-ons (Google). An AI app you connect to a Workspace mailbox isn't covered by Google's agreement.
4. Don't assume a prompt is de-identified. The HIPAA safe harbor removes 18 kinds of identifier, including all date elements except the year, geography smaller than a state, and record numbers, and you can't have actual knowledge that the remainder could identify someone (45 CFR 164.514). "58-year-old admitted March 3 in a small town with a rare sarcoma" fails that test.
5. Settle recording consent. Federal law generally allows recording with one party's consent (18 U.S.C. 2511), while California requires all parties to consent for confidential communications (Penal Code 632). Tell patients before a scribe runs, whichever state you practice in.

What stays with the licensed physician

State medical boards regulate physicians rather than software, so AI use doesn't move accountability away from you. The Federation of State Medical Boards' 2024 guidance keeps professional responsibility with the licensee, and the group says physicians should answer for harm from inappropriate reliance on AI (STAT). A few specific rules are worth knowing:

• FDA and decision support. In short, software stays outside the device definition only if it doesn't analyze images or signals, supports a health care professional, and lets that professional independently review the basis for its recommendations (21 U.S.C. 360j(o)). FDA explained its current reading in January 2026 guidance. Tools that read images or waveforms can be regulated devices, so check their clearance status.
• Bias in decision tools. Under Section 1557, covered entities have a continuing duty to make reasonable efforts to identify and mitigate discrimination risk from patient care decision support tools that use protected characteristics as inputs (45 CFR 92.210).
• California patient messages. Physician offices using generative AI for clinical communications must give a notice and a way to reach a human, unless a licensed provider read and reviewed the message. A medical assistant's review doesn't count, and appointment or billing messages fall outside the rule (Medical Board of California).

Where Merlin fits, and why it stays away from patient data

Merlin, our Mac assistant for email, calendar and recorded calls, should not be used with protected health information. Merlin doesn't state HIPAA compliance, and its privacy policy and terms don't mention a BAA, so treat it as outside your covered workflow. It isn't a scribe, an EHR add-on or a decision support tool, it doesn't answer phones, and it has no place in clinical decisions.

That limit matters more than usual because of how Merlin works. It reads your connected Gmail and calendar accounts, including in the background, uploads audio to a transcription service on paid plans, and keeps transcripts and notes with your Merlin account. So connect only a Google account that holds no patient mail or patient names in calendar events. If your only Google account has them, Merlin isn't for you. If you run telehealth on the same Mac, turn off Automatically detect meetings and Remind me a minute before a meeting in Settings → Preferences → Meetings so it doesn't offer to record a visit, and never press record on one.

What's left is the admin of being a physician rather than treating patients. On a Mac with a clean Google account, these parts help:

• Committee and department email. A direct email that has waited 2 to 30 days on your reply lands in Merlin's People panel, like the division chief asking about next quarter's call schedule or a co-author waiting on your edits.
• Meetings with no patients in them. When a credentialing or practice partner meeting is about 10 minutes off, Meeting Brief summarizes the earlier threads with those people. Merlin can capture those calls on your Mac, and paid plans add transcripts.
• Dates you can't miss. Ask for a reminder about your license renewal, DEA registration or board certification deadlines, and it arrives on the day you set.
• Contracts and conferences. Ask for a reply to a recruiter or conference organizer, and it sits on a card in chat until you confirm it. Routines, the jobs you schedule Merlin to run alone, can act without that card, so keep them to summaries.

Before connecting anything, review which apps already have access to your account with our guide to Google's security settings. If booking a single committee call takes a dozen emails, a scheduling app may solve that on its own.

A sensible order for adopting AI in your practice

Start where no patient data is involved, and add the rest once the paperwork is done.

1. Ask your compliance office what's already approved. Your health system may have a licensed scribe or an EHR drafting feature you can turn on.
2. Use evidence lookups with no identifiers. Ask general clinical questions, then open the cited paper before you act on the answer.
3. Pilot one scribe for a limited period. Sign the BAA first, tell patients, and measure after-hours charting against your own baseline rather than trusting a brochure.
4. Try a letter generator on your most repetitive denial. Pick one drug or procedure, keep a template of the chart facts it needs, and read every letter.
5. Write down what's allowed. A one-page list of approved tools and banned inputs gives your MAs and front desk something to follow.