The Visit Does Not Retry

Every reliability pattern in enterprise AI assumes the request can be sent again. Retries, fallbacks, circuit breakers, graceful degradation: the entire vocabulary describes a world where the input survives the failure and the system gets another attempt. The exam room breaks the assumption. A patient describes her chest pain once, in her own words, with her own pauses, at 9:14 on a Tuesday. If the capture fails, there is no second request to send. A failed API call retries. A patient visit does not.

So here is the test, and the rest of this essay is the argument for running it. Take any ambient scribe, unplug the clinic's router, and run a visit. At the end, what does the clinician hold: a draft, a transcript, a recording, or an apology? The answer is the product's floor, and the floor is the product.

The object under discussion is the ambient scribe, the fastest-adopted generative AI in healthcare: it listens to the visit, transcribes it, and drafts the note a clinician reviews. The average primary care exam runs about eighteen minutes in the largest analysis, twenty-one million visits. Everything the system will ever know about the encounter passes through the room exactly once. The note can be regenerated, re-prompted, improved by next quarter's model. The audio cannot. The only irreplaceable thing in the pipeline is the recording of the patient's own words.

The Network Is a Planned Casualty

Healthcare already operates as if the network fails, because it does, at length, on the record. In February 2024 the Change Healthcare attack took down a clearinghouse touching somewhere between a third and a half of US medical claims, and the outage ran for weeks while practices took out emergency loans to make payroll. In May 2024, ransomware locked Ascension, 140 hospitals, out of its own EHR, with the last sites restored after more than a month. Clinicians described charting on paper like the 1980s, lab results going missing, a nurse nearly giving the wrong medication because the barcode check was down. These were the two largest healthcare outages in a single year, and both were absorbed by paper.

The federal government plans for this. HHS preparedness guidance tells practices to keep downtime kits, paper forms, and ideally a second internet provider, because network loss is an expected operating condition, like weather. Hospitals run scheduled downtime drills. There is a form for charting when the chart is gone. Read that guidance with a scribe in mind and the question writes itself: the EHR has a downtime form, so what is the downtime form for the scribe? If the answer is the clinician goes back to typing, the product fails back to the exact administrative drag it was bought to remove, on the practice's worst day.

The Quiet Failure Is Worse

The catastrophes make the argument legible, but the ordinary failures make it daily. The corner exam room with one bar of Wi-Fi. The rural clinic on a single internet provider. The afternoon the connection slows until the scribe app spins, and the clinician, mid-visit, makes the only rational choice and starts typing. No incident gets filed. The visit was not lost, only the capture. The note gets written at nine that night, from memory, which is the precise after-hours drag the scribe was bought to end. The worst failure in clinical AI is the one that looks like nothing happened.

Put the Network After the Capture

So order the failure modes on purpose. When everything works, the clinician gets a reviewed draft. One rung down, a transcript to pull from. One rung further, the floor: a recording that becomes a draft when the system recovers. The rung that should not exist is nothing. Where the audio goes first is what sets the floor. If the audio leaves the room before transcription, the network sits in the capture path, and a dead connection means no audio, no transcript, no note, a clinician reconstructing a conversation from memory. If the device in the room records, transcribes, and drafts locally, and the network only carries finished work later, the same outage produces a delayed export instead of a lost visit.

Put the network in the path of the sync, not the path of the capture.

The sync can wait an hour. The export to the EHR can wait. The billing batch can wait overnight. The cloud is fine for everything that can wait, and almost everything in a practice can. The visit is the one thing in the building that cannot.

The Phone Objection

The obvious reply is that a phone records offline, so why does any of this need dedicated hardware. The better cloud scribes already concede the principle: when the connection drops, the app buffers audio on the phone and uploads later. That is local capture, and it is the right instinct. Three gaps remain. The buffer protects the recording, not the work: transcription and drafting still wait for the network, fine for one visit, useless by the nineteenth on a downtime day. The buffer lives on a consumer phone that now holds visit audio in a pocket, off the practice's inventory and outside its access review. And the buffer is the least tested path in the product, exercised exactly when everything else is failing, which is how a degraded afternoon turns into a clinician typing without anyone deciding it. A phone that records is a voice memo. The product is the draft.

This is the bet behind the appliance we build. AGIMAN records the visit, transcribes, and drafts on hardware inside the practice, and the clinician reviews before anything leaves. The network carries approved exports, not live audio. On the day the internet dies at 9:05, the 9:14 visit is captured, the draft is on the box, and the clinician reviews it the same hour. The compliance argument for keeping audio inside the walls is made in Where the Scribe Runs. This essay's claim is narrower: the same architecture is the reliability design, and it raises the floor from a memory to a draft.

A local box is not automatically reliable, and the same discipline applies to it. An appliance can fail. It needs its own pre-use check, its own monitoring, a spare in the drawer, and a tested answer to what happens when someone unplugs it. Degrading to a recorder only counts if the recorder is tested like the parachute it is. The argument is not that hardware is dependable and the cloud is not. The argument is about which failures are recoverable. A failed sync recovers on its own. A failed capture is permanent.

One Question for Any Vendor

A practice evaluating any scribe, ours included, should ask for the demonstration, not the roadmap. Unplug the router and run the visit. What does the clinician hold at the end: a draft, a transcript, a recording, or an apology? The answer is the floor, and the floor is what the practice stands on during its worst week, when the clearinghouse is down, the EHR is on paper forms, and the one device that could still be working is the box in the room with one job: do not lose the visit.

Reliability talk in software loves the nines. A clinic does not experience nines. It experiences one conversation, at 9:14, that will never happen again. The visit does not retry. Build like it.