Prior authorization is the paperwork checkpoint between a clinician's decision and a payer's payment — the requirement that a treatment, scan, or admission be approved before it happens. It is also the single most automated-against workflow in American healthcare right now, because both sides of the transaction have reached for AI at the same time. Providers are building agentic tools to assemble and submit requests; payers run algorithms to screen and decide them. This guide reads the two together, against the federal rule that now sets the rules of play and the published evidence on what these agents can actually do. As of July 2026.
Two prior authorizations, two kinds of agent
Almost every vendor conversation collapses a distinction worth keeping. There are two agents in this story, and they want opposite things.
The provider-side agent works for the clinician. Its job is to remove 13 hours of weekly staff time 4 by reading the chart, finding the documentation a payer will demand, drafting the request in the payer's format, tracking the decision clock, and — when a request is denied — drafting the appeal. Its incentive is approval and speed.
The payer-side algorithm works for the plan. Its job is to screen incoming requests against coverage criteria, flag the costly ones, and route or decide them. Its incentive is consistency and cost control. When these two systems face each other across a claim, the result can be an automated request meeting an automated denial, with a patient in the middle. The federal rule that took effect this year is the first serious attempt to govern that collision.
What the CMS-0057-F rule changes
The CMS Interoperability and Prior Authorization final rule (CMS-0057-F) was published in the Federal Register in February 2024 1. It does two things that matter for agents: it puts a clock on decisions, and it standardizes the pipes.
| Provision | What it requires | Effective |
|---|---|---|
| Expedited decision timeframe | Decision within 72 hours | 2026 1 |
| Standard decision timeframe | Decision within 7 calendar days (halved from 14) | 2026 1 |
| Specific denial reason | Payers must give a specific reason for every denial | 2026 2 |
| Public metrics reporting | Payers publicly report prior-authorization metrics; first data due March 31, 2026 | 2026 2 |
| Prior Authorization API | A FHIR-based API to exchange requests and decisions | January 1, 2027 2 |
The affected payers are Medicare Advantage organizations, state Medicaid and CHIP programs, and qualified health plan issuers on the federally facilitated exchanges 2. The API provision is the load-bearing one for automation. Today most prior authorization moves by fax, phone, and web portal — which is why an "agent" often means a system doing robotic clicking through a portal a human designed. The rule replaces that with a standard interface built on the HL7 Da Vinci Prior Authorization Support (PAS) implementation guide, whose stated goal is to let "a provider's system, at point of service, ... request authorization (including all necessary clinical information to support the request) and receive" a response 3. Standard pipes are what turn brittle screen-scraping into something an agent can call reliably — the same interoperability shift covered in our note on the model context protocol in health IT.
A clock plus an API changes the economics of automation on both sides. A seven-day standard window rewards a payer that can decide quickly and cheaply, which means more algorithmic screening. The same window rewards a provider who can submit a complete, well-documented request the first time, which means more drafting agents. The rule did not create the automation; it set the tempo it runs at.
The burden that pulls providers in
The pressure behind provider-side agents is not subtle. The American Medical Association's prior-authorization survey, fielded in late 2024 across 1,000 practicing physicians, found that practices complete an average of 39 prior-authorization requests per physician per week and spend 13 hours of physician and staff time on them 4. In that survey, 89% of physicians said prior authorization increases burnout, 93% said it delays access to care, and more than one in four — about 27% — reported that it led to a serious adverse event for a patient in their care 4. Those attitudes track the broader picture in our physician attitudes to AI tracker.
There is also a documented gap between how prior authorization is handled and how it could be. The 2024 CAQH Index put electronic adoption of prior authorization at roughly 40% — the lowest of the core administrative transactions — and estimated that moving a single manual authorization to the fully electronic standard saves providers about 14 minutes 8. Multiply 14 minutes across 39 weekly requests and the appeal of automation is obvious. The question is what the automation can be trusted to do.
What provider-side agents can do today
Here the honest answer is: draft well, decide nothing. The best current evidence is document-level. A 2026 peer-reviewed evaluation built 29 standardized nephrology scenarios — each with real coding, labeling, and guideline support — and had an LLM draft the prior-authorization letter, then scored the output against clinician review 7. The letters were strong on the surface: ICD-10 coding was correct in 79.3%, 93.1% used valid references, and 89.7% showed clinical reasoning rated "strong." They were also imperfect in exactly the ways that matter: a false statement appeared in 3.5% of letters, and errors clustered in predictable places — disease staging, citation accuracy, and omitted safety considerations 7.
Two limits keep this result modest, and the authors name both. The scenarios were "relatively straightforward" and drawn from a single specialty, and every letter came "from a single model version at a single time point" 7. Most important, the study measured document quality — it never measured whether a payer approved the request. A letter that reads well to a nephrologist and a letter that clears a plan's utilization review are different tests, and only the second one pays for care. When you see a vendor cite a drafting-accuracy number, ask for the approval-rate number; as of July 2026 that number is rarely published.
This is the register to hold agents in: a well-built submission agent is a fast, tireless drafter that still needs a clinician to catch the 3.5% and to own the signature. The human in the loop here is doing real work — verifying that a fluent letter is also a true one — because a hallucinated clinical detail in a prior-authorization request is a documentation error with a patient attached.
The payer side, and the line regulators drew
The mirror image is where the stakes climb. When a plan automates adjudication, the failure mode is worse than a wasted draft — it is a denied treatment. The evidence that this failure mode is real predates the current generation of agents. A 2022 review by the HHS Office of Inspector General examined a sample of Medicare Advantage prior-authorization denials and found that 13% of the denied requests actually met Medicare coverage rules — meaning the care would likely have been approved under original Medicare 5. The denials in that sample came before today's algorithmic screening was widespread; automation can make a screening process faster and more consistent, but it inherits — and can scale — whatever the criteria get wrong.
Regulators responded with a specific guardrail, and it is the most important sentence in this whole area. CMS's Contract Year 2024 Medicare Advantage rule requires that a medical-necessity determination be based on the individual patient's circumstances 6. CMS has clarified that an algorithm or software tool may assist a coverage determination but cannot be its sole basis: a tool "that determines coverage based on a larger data set instead of the individual patient's medical history, the physician's recommendations, or clinical notes would not be compliant" 6. Read plainly, that rule tells a payer its adjudication agent can triage and recommend, but a human must own any denial and must have looked at the specific patient. It is the payer-side equivalent of keeping a clinician on the signature — and it is enforceable.
A capability-and-limits summary
| Task | What agents can do now | Where a human stays required |
|---|---|---|
| Assemble a request | Read the chart, gather documentation, draft in payer format | Verify the clinical facts and the codes 7 |
| Submit and track | Call the FHIR PA API, watch the decision clock | Own the attestation on the submission 1 |
| Draft an appeal | Produce a structured, cited rebuttal quickly | Confirm the appeal is true and complete 7 |
| Screen incoming requests (payer) | Flag, triage, and route by criteria | A human decides any denial on the individual case 6 |
| Report metrics | Compile the public reporting the rule requires | Sign off on accuracy 2 |
The pattern across the table is consistent: agents are strong at assembly, retrieval, and speed, and weak — or legally constrained — at the moment of a consequential decision. That is the same division of labour our revenue-cycle and coding agents guide finds on the billing side of the same claims.
How to read this
Four cautions travel with everything above. First, the strongest efficiency numbers come from the administrative-burden literature, not from controlled trials of agents; a 14- minute saving per transaction 8 is a workflow estimate, not an outcome. Second, the drafting-quality evidence is early, single-specialty, and silent on payer approval 7, so it tells you an agent can write a credible letter, not that the letter gets paid. Third, the rule's timeframes and API dates are compliance milestones, and compliance dates slip; confirm the current CMS-0057-F schedule before planning around it 12. Fourth, the payer-side guardrail is a legal requirement about who decides, and it does not by itself make the underlying criteria correct — the OIG finding that 13% of denials met coverage rules 5 was a criteria-and-review problem that automation can inherit.
The useful frame is the two-sided one we opened with. Prior-authorization automation is an arms race between a provider agent optimizing for approval and a payer algorithm optimizing for cost, refereed by a federal rule that sets the clock, standardizes the pipes, and insists a human own any denial. An organization deploying an agent on either side should be able to answer one question first: at the point where this system's output becomes a decision about a real patient, who is the accountable human, and what did they see?
Sources and method
This guide synthesises the CMS-0057-F final rule and its fact sheet 12, the HL7 Da Vinci PAS interoperability standard the rule relies on 3, the AMA's late-2024 prior-authorization survey for the burden figures 4, the 2022 HHS OIG denial review 5, CMS's Contract Year 2024 Medicare Advantage rule for the individualized-determination requirement 6, a 2026 peer-reviewed evaluation of LLM-drafted authorization letters 7, and the 2024 CAQH Index for adoption and time figures 8. Every figure is drawn from the primary source cited beside it and was checked live as of July 2026. We revisit this page on a 180-day cycle and whenever CMS changes a compliance date or new denial data is published. For the method behind reading any of the underlying studies, see how to read an AI validation study.