Run a personal health agent over FHIR records
Open Claw for Healthcare: What a Fully Autonomous Personal Health Agent Actually Looks Like. Task: Open Claw for Healthcare: What a Fully Autonomous Personal Health Agent Actually Looks Like We are finally at a moment where the idea of a personal healthcare agent is no longer science fiction but we are also dangerously close to getting it wrong. Open agents, frontier models, and healthcare-specific AI offerings are converging fast. The question is no longer whether AI can help us navigate healthcare. The real question is: how do we give AI meaningful access to our health data without giving up control, privacy, or safety? That problem not the model is the hard part. Why Open Claw Matters (and Why It’s Not Ready) When Peter creator of Open Claw joined OpenAI, it caught attention for obvious reasons. This is someone who sold a PDF tool for $100M, then went on a streak of dozens of failed experiments before one went viral. Open Claw is iteration number 44. That alone should tell you something important. Open Claw is not a consumer-ready product. It’s rough. It’s unsafe by default. It assumes you know what you’re doing. But that’s exactly why it matters. For motivated tinkerers and technical users, Open Claw unlocks something we’ve never had before: a persistent, tool-using agent that can act on your behalf across systems. When paired with models like Claude from Anthropic, the power becomes obvious very quickly. In my previous article, I showed how using my own health data I was able to build dashboards, longitudinal views, and research-backed insights that no provider could realistically deliver in a 15-minute visit. Not because they don’t care. Because the system is not designed for synthesis. AI is. The Real Bottleneck: Access, Not Intelligence Healthcare AI does not fail because models aren’t smart enough. It fails because data is locked behind workflows that assume humans not agents are the actors. FHIR APIs exist. Patient access rights exist. TEFCA exists. But none of these were designed with autonomous agents in mind. QR codes, SMART links, portals, PDFs these are all human-shaped interfaces. AI doesn’t fit. So I treated this as an engineering problem, not a policy debate. Step One: A Guardrail Proxy Between Agents and Health Data I gave Claude Code a simple challenge: Design a vendor-neutral guardrail layer that allows an AI agent to safely access FHIR data without exposing raw PHI. The result was surprisingly solid: Automated PHI reduction (masking, truncation, stripping identifiers) Automated PHI reduction (masking, truncation, stripping identifiers) Immutable audit logs Immutable audit logs Step-up authorization for writes Step-up authorization for writes Human-in-the-loop confirmation for clinical actions Human-in-the-loop confirmation for clinical actions Tenant isolation Tenant isolation Medical disclaimers injected at read time Medical disclaimers injected at read time This guardrail proxy sits between Open Claw and any FHIR server. Every request passes through it. No exceptions. This is how you maintain context without overexposure. You don’t give the model everything. You give it just enough, and you stay in the loop. Step Two: Owning the Data (Literally) Most people think “health data” means a portal download. That’s not enough. I created a personal FHIR server. Not a startup platform. Not a shared cloud. A private instance. Here’s what went into it: Epic patient-access FHIR data from two health systems Epic patient-access FHIR data from two health systems Additional clinical records not available via TEFCA Additional clinical records not available via TEFCA Pharmacy data Pharmacy data Insurance history and claims via Flexpa using the CARIN Alliance IG (Coverage + EOBs) Insurance history and claims via Flexpa using the CARIN Alliance IG (Coverage + EOBs) Family data, scoped and separated Family data, scoped and separated Everything normalized to FHIR. Everything query able. Everything auditable. Once you do this, something important happens: you stop seeing healthcare as fragmented encounters and start seeing it as a system. What Happens When an Agent Has This View? This is where it gets real. My Open Claw agent doesn’t just summarize data. It: Prepares for appointments Prepares for appointments Drafts follow-up messages Drafts follow-up messages Fills out forms Fills out forms Writes insurance appeals Writes insurance appeals Tracks longitudinal trends Tracks longitudinal trends Flags cost issues before they explode Flags cost issues before they explode Case in point: my colonoscopy.; tools: OpenClaw. Human role: The original post does not say how a person stayed involved.; limitations: OpenClaw is described as rough, unsafe by default, and requiring technical expertise. The workflow depends on complex integrations with Epic, Flexpa, and HAPI FHIR, which may have access or compatibility issues. Security risks like prompt injection and over-permissioning are significant. Human approval is mandatory for clinical and financial actions to maintain safety and control..
Tools
Published on Agent Work Atlas:
Overview
Open Claw for Healthcare: What a Fully Autonomous Personal Health Agent Actually Looks Like
Workflow
Open Claw for Healthcare: What a Fully Autonomous Personal Health Agent Actually Looks Like We are finally at a moment where the idea of a personal healthcare agent is no longer science fiction but we are also dangerously close to getting it wrong. Open agents, frontier models, and healthcare-specific AI offerings are converging fast. The question is no longer whether AI can help us navigate healthcare. The real question is: how do we give AI meaningful access to our health data without giving up control, privacy, or safety? That problem not the model is the hard part. Why Open Claw Matters (and Why It’s Not Ready) When Peter creator of Open Claw joined OpenAI, it caught attention for obvious reasons. This is someone who sold a PDF tool for $100M, then went on a streak of dozens of failed experiments before one went viral. Open Claw is iteration number 44. That alone should tell you something important. Open Claw is not a consumer-ready product. It’s rough. It’s unsafe by default. It assumes you know what you’re doing. But that’s exactly why it matters. For motivated tinkerers and technical users, Open Claw unlocks something we’ve never had before: a persistent, tool-using agent that can act on your behalf across systems. When paired with models like Claude from Anthropic, the power becomes obvious very quickly. In my previous article, I showed how using my own health data I was able to build dashboards, longitudinal views, and research-backed insights that no provider could realistically deliver in a 15-minute visit. Not because they don’t care. Because the system is not designed for synthesis. AI is. The Real Bottleneck: Access, Not Intelligence Healthcare AI does not fail because models aren’t smart enough. It fails because data is locked behind workflows that assume humans not agents are the actors. FHIR APIs exist. Patient access rights exist. TEFCA exists. But none of these were designed with autonomous agents in mind. QR codes, SMART links, portals, PDFs these are all human-shaped interfaces. AI doesn’t fit. So I treated this as an engineering problem, not a policy debate. Step One: A Guardrail Proxy Between Agents and Health Data I gave Claude Code a simple challenge: Design a vendor-neutral guardrail layer that allows an AI agent to safely access FHIR data without exposing raw PHI. The result was surprisingly solid: Automated PHI reduction (masking, truncation, stripping identifiers) Automated PHI reduction (masking, truncation, stripping identifiers) Immutable audit logs Immutable audit logs Step-up authorization for writes Step-up authorization for writes Human-in-the-loop confirmation for clinical actions Human-in-the-loop confirmation for clinical actions Tenant isolation Tenant isolation Medical disclaimers injected at read time Medical disclaimers injected at read time This guardrail proxy sits between Open Claw and any FHIR server. Every request passes through it. No exceptions. This is how you maintain context without overexposure. You don’t give the model everything. You give it just enough, and you stay in the loop. Step Two: Owning the Data (Literally) Most people think “health data” means a portal download. That’s not enough. I created a personal FHIR server. Not a startup platform. Not a shared cloud. A private instance. Here’s what went into it: Epic patient-access FHIR data from two health systems Epic patient-access FHIR data from two health systems Additional clinical records not available via TEFCA Additional clinical records not available via TEFCA Pharmacy data Pharmacy data Insurance history and claims via Flexpa using the CARIN Alliance IG (Coverage + EOBs) Insurance history and claims via Flexpa using the CARIN Alliance IG (Coverage + EOBs) Family data, scoped and separated Family data, scoped and separated Everything normalized to FHIR. Everything query able. Everything auditable. Once you do this, something important happens: you stop seeing healthcare as fragmented encounters and start seeing it as a system. What Happens When an Agent Has This View? This is where it gets real. My Open Claw agent doesn’t just summarize data. It: Prepares for appointments Prepares for appointments Drafts follow-up messages Drafts follow-up messages Fills out forms Fills out forms Writes insurance appeals Writes insurance appeals Tracks longitudinal trends Tracks longitudinal trends Flags cost issues before they explode Flags cost issues before they explode Case in point: my colonoscopy.
Reported result
The source does not provide measured outcomes or success metrics for the agent's performance. It describes a specific case where the agent helped identify a billing error regarding a colonoscopy, but no quantitative results are reported. The author notes the system is not consumer-ready and remains unsafe by default. Verification of actual efficacy requires a labeled acceptance check on specific tasks.
Human role
The original post does not say how a person stayed involved.
Limitations
OpenClaw is described as rough, unsafe by default, and requiring technical expertise. The workflow depends on complex integrations with Epic, Flexpa, and HAPI FHIR, which may have access or compatibility issues. Security risks like prompt injection and over-permissioning are significant. Human approval is mandatory for clinical and financial actions to maintain safety and control.
Try it
Act as a technical consultant helping me set up a personal health agent. I have access to Epic patient data, pharmacy records, and insurance claims via Flexpa. I want to use OpenClaw with Claude to aggregate this into a private HAPI FHIR server. First, design a guardrail proxy that masks PHI and logs all access. Then, configure the agent to draft an insurance appeal for a recent [replaceable: specific medical procedure] where I suspect a billing error. Before sending any draft or making any changes, present the output to me for manual review. Do not execute any write operations without my explicit confirmation. Start by outlining the architecture and the specific data fields to be masked.
Source reports are not independently verified. Publication date is the catalog publication date, not the original article date.