The Prior Authorization Agent

Prior auth is the administrative tax on care — payer-specific rules, clinical evidence buried in notes, and a fax machine at the end of it. An agent that assembles the packet without ever making the clinical call.

Prior authorization is where clinical intent goes to wait. A clinician decides a patient needs a procedure, a medication, or a device. Before it can happen, someone has to determine whether that payer requires authorization for that service under that plan, find the criteria, locate the supporting clinical evidence in the chart, assemble it into the format the payer wants, submit it through whichever channel that payer uses, and then chase it.

The clinical decision took minutes. The administrative wrapper around it takes days, and the people doing it are usually nurses and clinical staff who would rather be doing something else.

This is the single most requested agentic build we see in healthcare, and for good reason. It is high volume, highly repetitive, deeply rule-driven, and — critically — the automatable part is administrative, not clinical.

The boundary we do not cross

Let us be direct about this before anything else, because it determines the whole design.

This agent does not decide whether care is appropriate. It does not judge medical necessity. It does not approve, deny, or recommend approval or denial. Those are clinical and payer determinations, and an AI system inserting itself into them is both an ethical problem and a regulatory one.

What the agent does is the paperwork: determine whether authorization is required, find the payer's stated criteria, locate evidence in the record that speaks to those criteria, assemble it, submit it, and track it. The clinician's judgement is the input, not the output.

Every build we do in this domain draws that line explicitly, and we would push back on a scope that did not.

Why it is hard

Requirements are payer-specific and volatile. Whether a service needs authorization depends on the payer, the specific plan, the procedure code, the site of service, and sometimes the patient's history. Payers change these lists on their own schedule.

The criteria are prose. Medical policy documents are long PDFs describing what evidence a payer expects. They are not structured, they are not consistent between payers, and they are updated without much fanfare.

The evidence is unstructured. The fact that a patient has failed conservative therapy for six weeks is in a progress note, phrased however the clinician phrased it. Structured fields cover some of what is needed and never all of it.

The channels are archaic. Some payers have modern APIs. Many have portals. A meaningful number still take faxes. A real system has to handle all three without pretending the last one does not exist.

How the agent is built

The agent assembles and submits; it never judges medical necessity. Documentation gaps surface before submission, which is where most avoidable denials come from.

Determine requirement. Given the ordered service, the patient's coverage and the site of service, the agent determines whether authorization is required. This is a lookup against payer rules that we keep current, not a model guess.

Retrieve criteria. The agent pulls the applicable medical policy and extracts the specific evidentiary requirements — what the payer says it needs to see.

Find evidence. The agent searches the clinical record against each criterion: relevant diagnoses, prior treatments and their durations and outcomes, imaging and lab results, clinician documentation. Each element it finds is linked to its source in the chart. Each criterion it cannot satisfy is reported as a gap.

Assemble. The agent builds the packet in the payer's expected structure, with the evidence attached and the criteria mapped to their support.

Review. A clinical staff member reviews the assembled packet before it goes anywhere. The agent presents what it found, what it could not find, and what it inferred, with everything traceable back to the chart.

Submit and track. Through the payer's actual channel. The agent then monitors status, handles requests for additional information by assembling the response, and escalates denials to staff with the payer's stated reason mapped against what was submitted.

The gap report is the sleeper feature. Knowing before submission that the record does not document the conservative-therapy trial the payer requires lets a clinician address it now, rather than discovering it through a denial two weeks later. A large share of avoidable denials are documentation gaps, not clinical disagreements.

Privacy is a design constraint, not a checklist item

This agent handles protected health information, which changes how it gets built.

Data access is least-privilege and scoped to the specific authorization in flight. Every access is logged with purpose. PHI boundaries are explicit — what leaves the environment, what model processes it, and under what agreement. Retention is bounded and deliberate. Where a client's posture requires it, we build so that PHI does not transit a third-party model at all.

These constraints shape architecture from day one. Retrofitting them onto a working prototype is how organisations end up with a compliance problem wearing an innovation badge.

What we measure

Turnaround time from order to submission. Staff touch time per authorization. First-pass approval rate. Denial rate attributable to documentation gaps, which should fall sharply if the gap detection is working. Evidence retrieval precision and recall against a clinician-labelled set — recall matters more here, because missing supporting evidence causes a denial.

And we watch the review-override rate. If clinical reviewers routinely change what the agent assembled, the agent is not ready, regardless of how good the throughput numbers look.

Where the value actually lands

The honest pitch for this build is not that it is clever. It is that a nurse who spends a third of their week on authorization paperwork gets that time back, and patients wait days less for care that was already decided on.

That is a boring, large, entirely administrative win. It is available now, it does not require anyone to trust an AI with a clinical judgement, and it is the kind of thing we would rather build than a demo that impresses in a boardroom and never touches a patient.

We build administrative and operational agents for healthcare — prior auth, claims and denials, revenue cycle, scheduling, referrals. Describe your workflow in the console or run /estimate.