Prior Authorization’s Bot War Is a Medical Policy Problem

For three decades, the prior authorization industry has digitized the envelope instead of the letter. A faxed PDF became an uploaded PDF, and the document moved faster. What was inside it stayed unstructured, and interpreting it remained a human job at every step.

That gap explains most of what is happening with AI in prior authorization today. It explains why AI arrived with so much promise, why trust in it has lagged, and why the most important work for payers sits beneath the AI, in the medical policy and decision logic it depends on.

The constraint moved from capability to trust

Through the late 2010s, automation in prior authorization meant RPA and OCR. Predictive models showed promise, but they needed narrowly trained data and produced inconsistent results. Some early deployments also drew scrutiny when their denials were challenged on appeal. Generative AI removed that capability barrier, and models can now read a clinical record well enough to be useful.

What replaced it is a question of trust and accountability. For impacted payers, CMS-0057-F decision timeframes have been in effect since January 1, 2026, and the required FHIR APIs are due January 1, 2027. Meanwhile, states continue to pass their own AI rules, creating a patchwork. The window for the industry to define responsible use on its own terms is getting narrower.

AI now sits on every side of the transaction

Payers are not the only ones deploying AI. On the provider side, prior authorization automation often sits with revenue cycle management teams rather than clinical departments. Providers automating this work are responding rationally to years of administrative overhead.

On the patient side, AI shows up mostly after a denial: in appeals, external review requests, and efforts to understand coverage decisions. Plan documents and appeal rights have always been public. The barrier was the effort and expertise needed to build a competent argument, and generative AI has removed it. A well-constructed appeal now depends far less on a patient’s sophistication or ability to pay for help, and payers should expect appeals to arrive better organized and better supported.

The risk in this dynamic is what some in the industry now call a bot war: volume without progress. When provider-side tools interpret requirements without visibility into how the payer makes its determinations, submissions and challenges go up while the underlying work does not go down. More speed on both sides does not reduce friction if the decisions themselves remain open to interpretation.

Three layers, three different jobs

One way to separate the work is to think in three layers.

The first layer is information work: extracting data, summarizing a 200-page record, locating evidence, flagging missing documentation, and prioritizing worklists. AI is well suited to this layer.

The second layer is decision infrastructure. This is where a payer defines when a medical policy applies, which version is in effect, how procedure codes map to it, where exceptions and carve-outs sit, and what the clinical criteria require. Applicability alone is complex. A knee replacement may require prior authorization for one employer group and not for another under the same payer. This layer should be deterministic rather than left to interpretation by AI or by people.

The third layer is clinical judgment. Some cases will always fall outside the rules, and those cases belong to clinicians.

A simple example shows the distinction. If a medical policy requires criteria A, B, and C, AI can help find where each one appears in the clinical record. Deciding whether A, B, and C have been met should come from binary, deterministic rules. AI’s job is to help the organization understand the patient and the request, while the meaning of the medical policy stays with the rules.

Clinicians gain from this too. Much of their frustration comes from hunting for the information needed to reach a decision, and well-applied AI puts it in front of them so they can work at the top of their license. Itiliti Health’s Clinical Assistant was built for this part of the work. It locates the evidence tied to each medical policy criterion and brings it forward for the reviewer. Determinations stay with deterministic rules and with clinicians.

Overturns point upstream

When a denial is overturned, start by asking where the variability entered the process. Interpretation varies from system to system and from reviewer to reviewer, and that variation feeds appeals.

Removing it starts with medical policy structured with its full nuance intact: effective dates, state variations, carve-outs, and edge cases. It also requires a digital questionnaire mapped exactly to the medical policy’s clinical intent. This is policy fidelity, and it is what a straight Word-to-questionnaire conversion loses. The goal is consistency, meaning the same request with the same data produces the same determination every time, and the payer can show why.

Once criteria are clear and deterministic, the room for interpretation and error narrows considerably, whether the reviewer is a person or a machine.

Governance that lives inside the business

Responsible use of AI in prior authorization rests on four commitments:

• Accountability. The organization owns every decision.
• Transparency. It is clear where AI is used and where it is not.
• Clinical authority. Humans keep the final say on clinical judgment.
• Traceability. The data and logic behind each outcome can be shown.

Guardrails around a model help, but the model also has to sit inside the system the organization already uses to govern its decisions.

In practice, a growing number of organizations are choosing not to build separate AI governance tracks. They are folding AI into their existing security, compliance, and policy frameworks so it never operates apart from the processes around it. Frameworks such as the NIST AI Risk Management Framework, HITRUST’s AI Security Assessment and Certification, and URAC’s Health Care AI Accreditation are emerging as common reference points while federal and state rules continue to develop.

The clearest line is on determinations: approvals can be automated when criteria are met deterministically, and every denial should receive human clinical review.

The better question

Much of the industry’s anxiety about AI making decisions comes from placing AI on top of existing processes and systems that were never designed for consistent, explainable determinations. The more useful question is whether the medical policy underneath AI is structured well enough for any decision to be explained and repeated.

Strengthen the decision infrastructure first, and several problems get smaller together. Better upfront decisions mean fewer appeals and overturns, less concern about AI in initial determinations, and a far easier conversation with providers and members about where AI is used and why.

To go deeper on these ideas, watch the on-demand conversation between Itiliti Health and the Medical Review Institute of America (MRIoA) at itilitihealth.com/regulatory-updates-and-videos. Payers working through how to structure medical policy for consistent, explainable decisions, or or looking at where Clinical Assistant fits in their review process, can reach the Itiliti Health team at sales@itilitihealth.com.