Agentic-AI Healthcare Systems

• Agentic-AI Healthcare is defined as a class of LLM-centered systems that plan multi-step actions, coordinate specialized agents, and enable externally verifiable clinical workflows.
• These systems integrate explicit state management, iterative validation, and multi-agent design to optimize patient communication, multimodal diagnosis support, and operational governance.
• Empirical benchmarks and advanced orchestration patterns, such as hierarchical oversight and blockchain-based verification, demonstrate both their potential and current implementation challenges.

Agentic-AI Healthcare denotes a class of LLM-centered systems that do not merely generate text but plan multi-step actions, invoke tools and APIs, maintain memory, coordinate specialized agents, and produce externally verifiable effects within clinical and administrative workflows. Across the recent literature, the term encompasses systems for patient communication optimization, multimodal diagnosis support, imaging analysis, clinical prediction, care coordination, longitudinal monitoring, and operational governance. The central distinction from reactive or single-shot LLM use is structural: agentic systems add orchestration, explicit state, iterative validation, and controlled action, often under human oversight and policy constraints (Vatsal et al., 4 Feb 2026, Zhi et al., 1 Dec 2025, Ranisch et al., 18 Feb 2026).

1. Conceptual foundations and boundaries

The contemporary literature defines agentic AI in healthcare through autonomy, coordination, memory, and action. In this framing, agents own scoped roles, exchange structured artifacts, invoke external tools during reasoning, and update behavior from outcomes rather than producing one-off outputs from a single prompt. Several papers contrast this with conventional generative AI, which is described as reactive, stateless, and optimized for plausible language rather than grounded execution. One survey formalizes this shift as movement from conditional sequence generation toward a policy over internal state, planning, memory, action execution, collaboration, and evolution; another emphasizes that agentic systems become active participants in clinical workflows rather than consultative text generators (Luo et al., 29 Sep 2025, Yan et al., 16 Jun 2026, Zhi et al., 1 Dec 2025, Ranisch et al., 18 Feb 2026).

A recent empirical review of 49 studies provides a quantitative frame for what is actually implemented. External Knowledge Integration is common at approximately 76% Fully Implemented, while Event-Triggered Activation is approximately 92% Not Implemented and Drift Detection & Mitigation approximately 98% Not Implemented. Multi-Agent Design is the dominant architectural pattern at approximately 82% Fully Implemented, whereas orchestration layers are often only partial. Across task categories, information-centric capabilities such as Medical Question Answering & Decision Support lead, while Treatment Planning & Prescription remains substantially under-implemented (Vatsal et al., 4 Feb 2026). This distribution indicates that the field is stronger at grounded advising and simulation-backed evaluation than at continuously adaptive, event-driven, safety-critical execution.

Another survey organizes the design space along two orthogonal axes: Knowledge Source and Agency Objective. On that basis it distinguishes four archetypes—Latent Space Clinicians, Emergent Planners, Grounded Synthesizers, and Verifiable Workflow Automators—each balancing creativity, reliability, autonomy, and safety differently. This taxonomy is significant because it places healthcare agents on a spectrum from implicit parametric reasoning to explicit evidence-grounded workflow execution rather than treating all “AI agents” as a single technical class (Zhi et al., 1 Dec 2025).

2. Architectural patterns and orchestration logics

A prominent architectural lineage is the Data-Information-Knowledge-Wisdom hierarchy. PAME-AI instantiates four specialized agent-units corresponding to Data, Information, Knowledge, and Wisdom, turning raw patient-messaging experiments into validated claims and then into deployable message portfolios. The Data layer validates schemas and randomization; the Information layer computes statistics, p-values, confidence intervals, and descriptive facts; the Knowledge layer evaluates explicit hypotheses with theoretical and empirical support; and the Wisdom layer synthesizes validated knowledge into new message strategies. Its formal integration operator is given as $W_\ell: \{O^{(K)}_k\} \rightarrow M_{new}$, making generated interventions traceable to upstream knowledge artifacts (Luo et al., 29 Sep 2025).

Hierarchical oversight is another recurring pattern. Tiered Agentic Oversight arranges agents into three tiers modeled on clinical hierarchy—initial assessment, specialized review, and expert consultation. Each agent emits an opinion tuple $$s_{i,t} = (r_{i,t}, c_{i,t}, \delta_{i,t}, \eta_{i,t})$$ containing risk level, confidence, rationale, and escalation flag, while inter-tier gating determines whether a case advances upward. The framework couples intra-tier deliberation with inter-tier accept/reject decisions, and its ablations attribute safety gains to this adaptive escalation structure rather than to simple ensemble size alone (Kim et al., 14 Jun 2025).

A third pattern treats reasoning itself as a revisable graph over time. In the temporal graph-of-reasoning framework for multimodal healthcare, nodes encode reasons or hypotheses with timestamps and provenance, edges encode dependencies, and graph operations explicitly allow backtracking, deletion, and merging as new evidence arrives. Multimodal inputs are fused at different time points, and multiple specialist agents contribute graph updates that are then cross-validated before a final recommendation is reviewed by a primary doctor. This architecture is designed for temporally evolving cases rather than isolated diagnostic snapshots (Mitra, 15 Sep 2025).

Other systems tighten orchestration through explicit verification substrates. A blockchain-monitored multi-agent architecture couples LangChain-based perception–reasoning–action loops with Hyperledger Fabric chaincode that verifies agent identity, policy constraints, consent, and safety bounds before execution. Formally, it decomposes the loop into perception, reasoning, action proposal, verification under policy $\pi$, and execution only if verification succeeds. By contrast, the multilingual privacy-first MCP prototype uses Model Context Protocol routing, strict JSON schemas, RBAC, AES-GCM field-level encryption, and tamper-evident audit logging as the orchestration substrate, while Unified Agent Lifecycle Management extends orchestration to fleet governance through identity registries, PHI-bounded memory, runtime policy enforcement, kill-switches, and decommissioning controls (Jan et al., 24 Dec 2025, Shehab, 25 Sep 2025, Prakash et al., 22 Jan 2026).

3. Principal clinical and operational applications

One well-specified application area is patient communication. PAME-AI addresses prescription-notification messaging as a high-dimensional optimization problem in which message tone, framing, brevity, authority attribution, and context are explored through DIKW-guided agent reasoning rather than bandits or reinforcement learning. The system synthesizes rules such as prioritizing medical urgency, age category, condition type, and geography, and it uses a controlled exploitation/exploration portfolio to generate and test new variants (Luo et al., 29 Sep 2025).

Clinical decision support is another central domain. In a physician-trust study, an agentic model dynamically called image analysis modules, clinical calculators, and up-to-date literature and guideline search while exposing intermediate execution steps and tool outputs. Physicians compared these traces with reasoning-only and direct-answer baselines on multimodal cases spanning diagnosis, lab-test recommendations, and treatment planning. The explicit visibility of tool calls, self-corrections, and evidence provenance is presented as a distinct feature of agentic clinical reasoning rather than merely better prompting (Yan et al., 16 Jun 2026).

Autonomous urgent-care delivery extends this logic from advice to end-to-end encounter management. Doctronic, described as a cloud-native modular system with more than 100 LLM-powered agents, autonomously conducts history-taking by text chat, generates a differential diagnosis, drafts an assessment and plan, and produces a SOAP note before a board-certified clinician evaluates the same patient. The architecture is reported as multi-agent and end-to-end, although the paper does not disclose the proprietary controller logic or tool integrations in detail (Hayat et al., 27 Jun 2025).

Medical imaging has become a particularly rich application site for agentic systems. TissueLab uses an LLM orchestrator, tool factories across pathology, radiology, and spatial omics, editable HDF5 memory, guideline retrieval through MCP, and clinician-in-the-loop refinement to answer questions about staging, prognosis, and treatment-relevant measurements. The orchestrator does not process raw images directly; instead, it composes directed acyclic workflows over modular tools such as nuclei segmentation, volumetric segmentation, cardiac cine-MRI parsing, and spatial-domain clustering (Li et al., 24 Sep 2025).

Broader care settings are also represented. A review of elderly care describes LLM-based agents combined with multimodal sensing and autonomous decision-making for personalized health monitoring, cognitive care, environmental management, and care coordination. A separate multi-agent framework for disabilities and neurodivergence organizes Meal Planner, Reminder, Food Guidance, and Monitoring agents through a Blackboard/Event Bus, explicitly tying multimodal accessibility and privacy-aware support to healthy eating and daily routines. An end-to-end medical data inference framework extends agentic design into clinical ML operations, automating ingestion, anonymization, feature extraction, model matching, preprocessing, inference, and interpretability over tabular and imaging data (Khalil et al., 20 Jul 2025, Jan et al., 27 Nov 2025, Shimgekar et al., 24 Jul 2025).

4. Empirical performance and benchmark evidence

Empirical evidence for agentic healthcare spans optimization, trust, diagnostic safety, and benchmark performance. In PAME-AI’s two-stage messaging experiment, Stage 1 involved 444,691 encounters across 13 variants and Stage 2 involved 74,908 encounters across 20 tested variants. The default baseline click-through rate was 61.27%, while the best-performing generated message, efficiencyTech, achieved 68.76%, corresponding to a 7.49 percentage-point gain and a 12.2% relative improvement. The paper also reports that authority-based and urgency or task-completion framings outperformed social proof, and that older patients showed approximately 12% higher baseline engagement (Luo et al., 29 Sep 2025).

For physician trust, the agentic model’s reasoning trace was preferred in 84.13% of 315 multimodal cases, with the treatment-planning subset reaching 89.57%. Behavioral reliance also favored the agentic model, which received Rank 1 in 48.9% of cases, compared with 32.1% for the reasoning-only ablation and 19.0% for the direct-answer baseline. At the same time, the study reports objective task accuracy of 34.9% and measurable over-reliance on incorrect agentic outputs in 23.9% of cases, making trust calibration an empirical concern rather than a solved property of transparent tool use (Yan et al., 16 Jun 2026).

In urgent-care telehealth, Doctronic’s top diagnosis matched the clinician’s primary diagnosis in 81% of 500 consecutive encounters, top-4 concordance reached 95.4%, treatment plan consistency was 99.2%, and no clinical hallucinations were observed. Expert review of discordant cases judged AI performance superior in 36.1%, human performance superior in 9.3%, with many remaining cases judged equivalent but under-recognized by the LLM adjudicator. These results are framed as concordance rather than ground-truth correctness because no prospective outcome data were collected (Hayat et al., 27 Jun 2025).

Safety-oriented diagnostic orchestration has also been evaluated under deterministic gates. The OLDCARTS plus semantic-entropy framework for mitigating premature diagnostic handoff and silent hallucination achieved 49.3% diagnostic precision on 150 simulated cases, an absolute improvement of 11.3 percentage points over an unconstrained baseline at 38.0%. Mean OLDCARTS completeness increased from 2.400/8 to 6.667/8, and completeness showed a statistically significant negative correlation with semantic entropy, $r = -0.181$, $p = 0.027$, suggesting that more structured intake was associated with lower diagnostic disagreement (Srivastava et al., 16 Jun 2026).

In imaging, TissueLab reports state-of-the-art comparisons against end-to-end VLMs and other agentic systems across clinically meaningful tasks. On colorectal depth of invasion it achieved Pearson $\rho = 0.843$, MAE = 2.047 mm, RMSE = 3.091 mm, and 100% task success; on lymph-node counting it achieved accuracy = 0.919 and weighted F1 = 0.926; on guideline-aligned metastasis classification, accuracy = 0.931 and F1 = 0.939; on 3D chest CT fatty liver, accuracy = 0.848 and F1 = 0.870; and on kidney glomerulus counting integrating spatial omics with histology, accuracy = 98.4%. Its active-learning loop raised colon neoplastic cell detection IoU from 10.1% to 88.9% and accuracy to 94.9% within 10–30 minutes (Li et al., 24 Sep 2025).

At the benchmark level, HealthAgentBench provides 54 end-to-end tasks across 7 categories, including EHR format conversion, X-ray report correction, clinical trial matching, CT abnormality classification, pathology tumor area selection, EHR event modelling, and EHR data-quality auditing. The strongest and most cost-effective agent, Codex GPT-5.5, achieved only approximately 42% task success rate, with especially low performance on imaging and on tasks combining large search spaces with compositional reasoning. This benchmark positions current frontier agents as capable in some research-style EHR pipelines yet still far from dependable general healthcare autonomy (Liu et al., 30 Jun 2026).

5. Safety, privacy, governance, and the problem of trust

The safety and compliance literature consistently argues that agentic autonomy in healthcare is inseparable from explicit control layers. A HIPAA-oriented framework inserts a Policy Decision Point and Policy Enforcement Point into the agent loop, combines Attribute-Based Access Control with a hybrid PHI sanitization pipeline, and maintains immutable audit trails. On 500 notes containing 2,350 PHI instances, the hybrid regex plus BERT pipeline achieved precision 99.4%, recall 97.6%, and F1 98.4%, while policy matching accuracy reached 99.1% across 200 simulated requests with mean decision latency of 12.3 ms (Neupane et al., 24 Apr 2025).

Other work moves from compliance gating to execution gating. The blockchain-monitored perception–reasoning–action architecture stores only hashes and metadata on-chain, uses permissioned Hyperledger Fabric contracts for action approval, and logs observation hashes, action metadata, and post-execution effects immutably. In 50 trials, mean latency with blockchain was 1.82 s versus 1.42 s without blockchain, throughput was approximately 45 transactions per second versus approximately 55 baseline, and 14 unsafe actions were blocked by chaincode. This configuration is presented as suitable for healthcare monitoring scenarios in which action approval must be auditable and policy-compliant (Jan et al., 24 Dec 2025).

A stricter zero-trust deployment model has also been reported for nine autonomous agents in production. The architecture combines gVisor kernel-level isolation, credential-proxy sidecars that prevent raw secret exposure, per-agent network egress allowlists, and a prompt-integrity framework with trusted metadata envelopes and untrusted-content labeling. Over 90 days, an automated security audit agent discovered and remediated four HIGH severity findings, including credential exposure in .bashrc and world-readable configuration files. The design is explicitly mapped to six healthcare-relevant threat domains: credential exposure, execution abuse, network egress exfiltration, prompt-integrity failures, database access risks, and fleet configuration drift (Maiti, 18 Mar 2026).

Governance extends beyond a single agent or runtime. Unified Agent Lifecycle Management proposes five control-plane layers—identity and persona registry, orchestration and cross-domain mediation, PHI-bounded context and memory, runtime policy enforcement with kill-switch triggers, and lifecycle management linked to credential revocation and audit logging—to address agent sprawl, unclear accountability, and persistent tool permissions. Its proposed KPIs include ownership coverage, revocation time, policy-decision logging rate, orphan-agent count, PHI-minimization rate, control-drift rate, and agent-related incident rate (Prakash et al., 22 Jan 2026).

Trust, meanwhile, is treated as both a usability benefit and a safety risk. The physician-trust study shows that transparent tool use, visual ROI grounding, proactive self-correction, and calculator invocation increase both cognitive trust and behavioral reliance, yet over-reliance on incorrect outputs persists. The ethics literature expands this further by arguing that agentic AI may transform decision authority, patient empowerment, confidentiality norms, and the patient–physician relationship itself, potentially producing new forms of “computer paternalism” if autonomy and consent are poorly designed (Yan et al., 16 Jun 2026, Ranisch et al., 18 Feb 2026).

6. Limitations, controversies, and future directions

Across the literature, several limitations recur. Many systems remain strong on process proxies and weak on longitudinal outcomes. PAME-AI optimizes click-through and engagement rather than adherence or clinical endpoints, and its knowledge agents primarily test predefined hypotheses. The trust study finds improved physician trust despite only 34.9% objective accuracy, and Doctronic reports concordance with clinicians rather than prospective patient outcomes. HealthAgentBench, by contrast, shows that end-to-end success remains low even for frontier agents, with major difficulty in multimodal imaging and in search-heavy environments (Luo et al., 29 Sep 2025, Yan et al., 16 Jun 2026, Hayat et al., 27 Jun 2025, Liu et al., 30 Jun 2026).

Technical failure modes are also well documented. The deterministic diagnostic framework identifies premature diagnostic handoff and silent hallucination as distinct hazards, but it also notes residual incompleteness under turn budgets, entropy false positives and negatives, and the limited suitability of OLDCARTS for psychiatry, pediatrics, dermatology, ophthalmology, and obstetrics. TissueLab’s performance is bounded by underlying segmentation and classification tools, and its co-evolution still depends on clinician feedback. The end-to-end medical inference framework notes that embedding-based matching can fail on ambiguous headers, preprocessing is rule-based and static, and cloud-based anonymization creates data-sovereignty concerns (Srivastava et al., 16 Jun 2026, Li et al., 24 Sep 2025, Shimgekar et al., 24 Jul 2025).

At the field level, the seven-dimensional taxonomy identifies underdeveloped areas that are especially consequential for clinical deployment: event-triggered activation, human-in-the-loop gating, robust error recovery, drift detection, reinforcement-based adaptation, fairness auditing, privacy-preserving mechanisms, and executable compliance constraints. This suggests that the central bottleneck is no longer only whether LLM agents can reason, but whether they can sustain safe, monitored, policy-compliant operation under real distribution shift and organizational complexity (Vatsal et al., 4 Feb 2026).

Future directions in the corpus are correspondingly structural. Proposed lines include integrating reinforcement learning or adaptive experiments into messaging optimization, adding richer uncertainty quantification and specialty-specific intake schemas, formal verification of chaincode policies, neuro-symbolic architectures that reconcile parametric and external knowledge, causal reasoning modules, dynamic event-triggered activation, and prospective trials linking trust or autonomy to patient outcomes (Luo et al., 29 Sep 2025, Srivastava et al., 16 Jun 2026, Jan et al., 24 Dec 2025, Zhi et al., 1 Dec 2025). A plausible implication is that progress in Agentic-AI Healthcare will depend less on larger base models alone than on better orchestration, stronger memory and provenance control, audited action spaces, and institution-specific governance capable of converting agentic competence into clinically acceptable autonomy.