AI Agents in Medical Billingand the Revenue Cycle

Before any conversation about agents, get the denominator right. The strongest primary denial data available in 2026 comes from KFF's March 2026 analysis of 2024 ACA Marketplace claims: 19% of in-network claims were denied, with a range from 3% to 36% across individual insurers. Out-of-network denials ran 37%, and 20% of all claims were denied.

The reason breakdown matters more than the headline. KFF found 36% of denials were coded "other" or unspecified, 25% were administrative, 13% were for an excluded service, 9% were for a missing prior authorization or referral, and only 5% were medical necessity. Read that as a buy-list: the administrative and missing-authorization categories are exactly where deterministic pre-submission checks work. The medical-necessity category is not, and no agent will change that.

Then the number that should reorganize your priorities: fewer than 1% of denied in-network claims were appealed — roughly 262,982 appeals against approximately 85 million denials. Where patients or providers did appeal internally, insurers upheld their original decision 66% of the time, meaning about 34% were overturned.

The Medicare Advantage picture is different, and the difference is a denominator, not a discrepancy. KFF's January 2026 analysis found 52.8 million prior-authorization determinations in 2024 — 1.7 requests per enrollee — of which 4.1 million (7.7%) were denied in full or in part. Only 11.5% of those denials were appealed, but 80.7% of the appeals that were filed were overturned. Traditional Medicare, for contrast, ran 625,000 prior-authorization reviews (about 0.02 per enrollee) with a 22.9% denial rate.

There is a bigger gap in the evidence base, and it is worth stating plainly because most RCM vendor decks paper over it: there is no 2026 primary provider-side denial benchmark. The most recent public edition of the Optum Revenue Cycle Denials Index is the 2024 edition, which found 41% of denials originate in patient access. The widely circulated "11.8% initial denial rate in 2026" traces only to vendor blogs with no primary publication behind it. Do not put it in a board deck, and be suspicious of anyone who does.

For the cost of the adjudication process itself, the best primary figure is Premier Inc., though it is 2023 data with no published update: claims adjudication cost providers $25.7 billion in 2023, up 23% year over year, of which $18 billion was potentially wasted on claims that should have paid on submission. Average adjudication cost per claim rose to $57.23 from $43.84. Premier also reported that roughly 70% of denials are ultimately overturned, typically after three review rounds of 45 to 60 days each.

Denial and adjudication benchmarks available to a practice administrator in 2026, with the denominator and the caveat attached to each.

The appeal gap is the arbitrage. A denial category where fewer than one in a hundred denials is contested, and where the contests that do happen win most of the time, is not an AI problem — it is a capacity problem that AI happens to be good at.

— Frenchy Digital revenue cycle principle

Every serious revenue cycle automation decision comes down to one question repeated ten times: for this specific workflow, is the work deterministic enough that a machine can do it, and is the failure mode cheap enough that a machine getting it wrong is recoverable? The table below is the version of that analysis we run in every healthcare discovery engagement.

Note the fourth column. Most vendor material describes what a tool does well and stops there. The realistic error mode is the column that determines whether you need a human review queue, how big it needs to be, and what the compliance exposure looks like when it fails at 2 a.m. on a Saturday.

Revenue cycle workflow map — agent capability, retained human judgment, and the failure mode to design against. Frenchy Digital, 2026.

Eligibility is the highest-confidence place to spend first, for three reasons that have nothing to do with how impressive the technology is. The input is structured (270/271 transactions and payer portals). The rule set is explicit. And the failure mode is caught downstream at scrubbing or at the front desk rather than at a payer audit.

It also targets the right denial categories. In KFF's Marketplace data, administrative denials (25%) plus missing prior authorization or referral (9%) account for about a third of all denials — and both are substantially upstream problems. Optum's 2024 index reaching the conclusion that 41% of denials originate in patient access points the same direction from the provider side.

• Batch verification 3–5 days out: Runs the full upcoming schedule against payer sources, so a coverage termination surfaces while there is still time to reschedule or collect.
• Day-of re-verification: Coverage changes between booking and visit more often than most practices measure. A second check the morning of the appointment catches the delta.
• Structured deltas, not raw dumps: The useful output is 'this patient's plan changed, deductible remaining moved from $400 to $1,900, secondary is now active' — not a 271 payload pasted into a note.
• Prior-auth requirement detection: Cross-references the scheduled CPT against the payer's policy so the authorization request starts days earlier, not at check-in.
• Escalation to a human on ambiguity: Any conflict between two payer sources, any partial response, and any coordination-of-benefits question goes to a person. That queue is a feature, not a failure.

The honest limitation: an agent cannot fix bad payer data. If the payer returns stale or incomplete coverage information, the agent will report it confidently, because it has no independent way to know it is wrong. Design your workflow so a surprising result triggers verification rather than action.

Claim scrubbing and coding get bundled together in vendor demos, and they should not be. Scrubbing is a rules problem: NCCI edits, payer-specific edits, modifier and unit validation, demographic and coordination-of-benefits consistency, missing authorization numbers. Those are checkable against a source of truth, so an agent can run them at volume and be audited afterward.

Coding is a judgment problem. It requires reading documentation and deciding what was actually done. That is a different risk class, and the evidence base is far weaker than the marketing suggests.

The standard 2026 architecture is the right one: auto-accept high-confidence output, route everything below the threshold to a human. What matters is that you own the threshold, that the override rate is visible, and that the queue is staffed. A confidence threshold nobody tunes and a queue nobody works is a rubber stamp with extra steps.

On the coding standards themselves: CPT Appendix S, introduced in 2021, classifies AI-enabled services as assistive, augmentative or autonomous by the degree of physician override, and at the May 2026 CPT Editorial Panel meeting revisions were accepted replacing "machine" with "software output(s)". The AMA is developing a framework for Clinically Meaningful Algorithmic Analyses. Appendix S is a taxonomy, not a payment schedule. CPT 2026 carried 418 editorial changes effective January 1, 2026 — 288 new, 84 deleted, 46 revised — but the core office and outpatient evaluation and management codes 99202–99215 were unchanged; the notable restructuring was in remote patient and therapeutic monitoring.

If the numbers in section one are right, this is where the money is. Under 1% of denied in-network Marketplace claims get appealed. In Medicare Advantage, 11.5% of denials get appealed and 80.7% of those appeals win. The binding constraint in almost every independent practice is not appeal-worthiness — it is that nobody has the hours to work the queue.

That is a capacity problem, and capacity problems are what agents are genuinely good at. Split the work into two distinct halves and the risk profile becomes manageable.

1. 1.Triage — a good agent job: Normalize CARC and RARC codes into categories that mean something to your practice, cluster by payer, provider, CPT and root cause, and rank the worklist by recoverable dollars against days remaining on the appeal window.
2. 2.Root-cause attribution — agent-assisted, human-confirmed: The agent proposes 'this cluster is a registration problem at the Tuesday clinic' or 'this payer changed its policy in March.' A human confirms it, because acting on a wrong root cause is expensive.
3. 3.Drafting — a good agent job: Pull the relevant note excerpts, cite the payer's own published policy and the specific denial reason, assemble the attachments, version each attempt so the second-level appeal knows what the first one argued.
4. 4.Review and signature — human, always: Nothing goes to a payer that a person has not read and approved. This is not a courtesy; it is the control that makes the rest of the workflow defensible.
5. 5.Filing and deadline ownership — human, with a named owner: Every denial with an appeal deadline gets an owner, a countdown, and an escalation path. A flag in a dashboard is not an owner.
6. 6.Escalation to external review — human judgment: Deciding to take a case past internal appeal, and deciding which denials reveal a contract problem rather than a claim problem, is administrator work.

Two regulatory tailwinds help here, and both are narrower than they sound. CMS-0057-F (89 FR 8758) has required, since January 1, 2026, that impacted payers decide expedited prior authorizations within 72 hours and standard requests within 7 calendar days — those timeframes exclude qualified health plan issuers on the federal exchanges and exclude drugs — and that every denial state a specific reason. Impacted payers published prior-auth metrics for the first time on March 31, 2026. A specific denial reason is materially better raw material for an agent than a generic code.

The limits: the rule binds Medicare Advantage organizations, state Medicaid and CHIP fee-for-service and managed care, and qualified health plan issuers on the federal exchanges — not commercial or ERISA plans and not Original Medicare fee-for-service. And the FHIR-based Prior Authorization, Provider Access and Payer-to-Payer APIs do not go live until January 1, 2027. Until then, most payer integration is still portals and clearinghouse transactions. The only provider-facing obligation is an Electronic Prior Authorization attestation measure for MIPS eligible clinicians beginning with the CY2027 performance period and 2029 payment year.

On the prior-auth burden itself, the primary source is the AMA's 2025 prior authorization survey (n=1,000, released May 2026): 13 hours per week of physician and staff time, 40 prior authorizations per physician per week, and 40% of physicians with staff working exclusively on prior authorization. Ninety-five percent report care delays, 79% report patients abandoning treatment, and 94% say prior authorization contributes to burnout. Insurers covering 257 million Americans pledged reform effective January 1, 2026, and AHIP self-reported an 11% reduction in prior authorizations — but that is payer self-reported, and only 33% of physicians in the AMA survey expect the pledge to make a meaningful difference.

Patient balance follow-up and payment posting sit at opposite ends of the risk spectrum, which is why they are worth treating in the same section. One is low technical risk and high reputational risk. The other is the reverse.

Patient balance follow-up is straightforward automation — sequenced statements and reminders across SMS, email and voice, payment-plan offers inside a policy you define, self-service payment links, and hardship routing. The technical failure modes are minor. The reputational ones are not: dunning a patient whose balance the practice already agreed to write off, or contacting through a channel the patient revoked, damages a relationship in a way no collection is worth. Every conversation about hardship, charity care or a disputed balance goes to a human immediately, and the agent's job is to route quickly rather than to persuade.

Payment posting is the opposite. Auto-posting clean 835 remittances is nearly ideal agent work — structured input, checkable output, high volume. But the dangerous error is quiet: an agent that classifies an underpayment as a contractual adjustment makes a revenue leak disappear from every report you run. The control is a variance check against your contracted rate on every posted line, with anything outside tolerance routed to a person. Unmatched cash, credit balances, refunds and takebacks stay human — they touch the general ledger.

• Contract-rate variance flags: Every posted line compared against the fee schedule you negotiated. Underpayments that post silently are the most common invisible leak in a practice's revenue cycle.
• Credit balances stay human: Refunds, takebacks and credit balance resolution carry compliance obligations that do not belong in an automated queue.
• Consent and channel state: The agent must respect revoked channels, do-not-contact flags, and any active financial-hardship status. Store that state where the agent reads it, not in a note field.
• Write-off boundaries in policy, not in prompt: Thresholds for adjustment and write-off belong in a rules layer the practice controls and can audit — not embedded in model instructions.
• Reconciliation reporting a human reads weekly: Posted versus expected, by payer, every week. If nobody reads it, the automation is running unsupervised regardless of what the org chart says.

Start with the fact most vendors skip: there is no reimbursement line for any of this. In the CY2026 Medicare Physician Fee Schedule final rule, CMS solicited comment on paying for software-as-a-service algorithms under the fee schedule, acknowledging that they are "not well accounted for" — and finalized no general AI payment pathway. CPT Appendix S is a taxonomy, not a payment schedule. The New Technology Add-on Payment program is inpatient-only and irrelevant to an outpatient practice's economics.

So AI revenue cycle tools are cost-side plays. Every dollar of return has to come from labor you stop spending or cash you would otherwise have written off. There are five levers, and each one has a precondition that has to actually be true in your practice.

The five ways a revenue cycle agent can pay for itself, and the precondition attached to each.

Now the arithmetic, with every input labeled by provenance. Treat the model below as a worked example against stated assumptions — not a benchmark, and not a promise.

Illustrative year-one model for a practice at $4M net collections. Substitute your own numbers — the structure is the point, not the totals.

A few provenance notes, because these figures get laundered constantly. The fully-loaded in-house biller range of $60,000–$80,000 including benefits and software is a vendor-published figure, widely repeated and directionally reasonable, but not a government statistic. The primary anchor is the Bureau of Labor Statistics median for medical records specialists, which includes billing and coding roles: $50,250 in 2024. Model with the loaded figure and cite the BLS one.

Similarly, the "cost to collect at or below 2% of net collections" best practice is universally attributed to HFMA but is relayed through secondary and vendor sources rather than a confirmed HFMA primary publication; the working convention is that 2–3% means room to improve and above 4% is a red flag, with most practices landing between 2% and 4% of net patient revenue. Outsourced RCM at 4–10% of net collections (most commonly 4–9%, with high-complexity specialties at 10–12%, or $3–$12 per claim) is vendor-sourced but consistent enough across providers to plan against. Days in A/R of 36 days for better performers and 47 days for the broader sample comes from the MGMA 2024 Cost and Revenue Survey as relayed by secondary sources. A clean claim rate above 95% is an industry convention, not a regulatory mandate, and A/R over 90 days is conventionally held under about 13–14%.

One primary figure is worth keeping in front of a board: MGMA reports that support staff salaries and benefits run about 25% of total practice revenue — roughly half of overhead — with median investment to support one physician FTE at $343,128 in Q4 2025. MGMA also found automation is the top 2026 cost-cutting move at 36%, ahead of hiring freezes at 18%. That is the context in which this decision is being made across the market.

In February 2026 the HHS Office of Inspector General published its Medicare Advantage Industry Segment-Specific Compliance Program Guidance. It contains the single most citable federal statement to date on AI in the revenue cycle: the guidance explicitly names, as a potentially abusive practice, querying physicians via electronic medical record platforms — including prompts generated by artificial intelligence algorithms — to add risk-adjusting diagnoses.

Querying physicians via electronic medical record platforms, including prompts generated by artificial intelligence algorithms, to add risk-adjusting diagnoses.

— HHS-OIG, Medicare Advantage Industry Compliance Program Guidance, February 2026

Read that carefully, because it is narrower and more consequential than the headlines suggested. It does not prohibit AI prompts. What it does is place an AI feature whose measurable effect is to raise risk scores inside a named enforcement risk area — which means the question at audit stops being "did the diagnosis have clinical support?" and becomes "can you show how this suggestion was generated, who reviewed it, and how long they spent?"

That connects directly to the second idea an administrator needs: automation bias is a compliance failure, not a productivity metric. The enforcement theory taking shape is that a "human in the loop" who accepts roughly 85% of AI suggestions at half a second per chart is not performing review in any meaningful sense. The defense is not a policy document asserting that review occurs. It is evidence.

The minimum control set for an AI-assisted revenue cycle in 2026, mapped to what an auditor will actually ask to see.

The rest of the federal picture is more stable than the vendor discourse suggests. Any AI vendor whose product creates, receives, maintains or transmits electronic protected health information is a business associate, and a signed BAA is required — including flow-down to subprocessors, which in practice means the model provider behind the product. Note the language: no organization is "HIPAA-certified," because no such certification exists. The correct terms are a HIPAA-compliant posture, a signed BAA, and documented Security Rule safeguards.

The HIPAA Security Rule NPRM (90 FR 898, RIN 0945-AA22, published January 6, 2025, comments closed March 7, 2025) is still proposed. It has moved to the Unified Agenda's long-term actions with a projected final action of July 2027 — the agency's own non-binding estimate. The 2003 Security Rule is what governs an AI agent touching ePHI today. As proposed, the update would eliminate the "addressable" versus "required" distinction, mandate multi-factor authentication and encryption of ePHI at rest and in transit, require an annually updated asset inventory and network map, an annual compliance audit, vulnerability scanning every six months, annual penetration testing, and 72-hour restoration of critical systems. Plan for it; do not represent it as a current obligation.

Two more items belong on an administrator's radar. First, enforcement is getting better instrumented: the DOJ's 2026 National Health Care Fraud Takedown featured AI and data analytics prominently, and the Health Care Fraud Unit's Data Fusion Center, run with HHS-OIG and the FBI, is now standing infrastructure. Second, the professional-body position is unambiguous: the AMA's House of Delegates adopted policy in June 2026 holding that AI is an assistive tool rather than an autonomous decision-maker, requiring transparency and physician oversight wherever AI is used in patient care, and opposing autonomous or semiautonomous AI as a substitute for physician review in coverage determinations.

One practical due-diligence shortcut: if the AI feature is embedded in certified health IT, the ASTP/ONC Decision Support Interventions criterion (§170.315(b)(11)) requires developers to publish source attributes — 31 of them for predictive interventions, covering development details, fairness, external validation, quantitative performance and maintenance schedule. Those obligations bind certified EHR developers rather than practices, but the published transparency data is a ready-made vendor due-diligence artifact you did not have to ask for.

A limitations section is not a disclaimer. It is the part of a vendor evaluation that saves you the most money, because every item below is something a well-run pilot will surface and a well-run sales process will not.

• Prove their own accuracy: No independent benchmark exists for autonomous coding or denial prediction. Every published figure is vendor-produced. The only honest test available to you is a shadow-mode run against 90 days of your own adjudicated claims.
• Generalize outside structured specialties: Autonomous coding is consistently reported as viable in radiology, pathology and the emergency department because the work is high-volume and templated. A multi-specialty outpatient practice does not share those properties.
• Fix bad payer data: An eligibility agent reports what the payer returns. If the 271 response is stale or partial, the agent will state it with full confidence, because it has no independent source to check against.
• Survive payer portal changes: Most payer integration in 2026 is still portals and clearinghouse transactions. CMS-0057-F's FHIR APIs do not arrive until January 1, 2027, and only for impacted payer types — not commercial or ERISA plans, not Original Medicare fee-for-service.
• Own a deadline: An agent can surface, prioritize and draft. It cannot be accountable. A denial queue with no named human owner and no escalation path will lose appeals to timely-filing windows regardless of how good the drafting is.
• Turn appeal volume into recovery: KFF found insurers upheld 66% of internal appeals in the ACA Marketplace. Filing more appeals is not the same as recovering more money — you need win rate by payer and by denial reason, not appeal count.
• Resolve medical-necessity denials: Only 5% of Marketplace denials were medical necessity, and that 5% requires clinical judgment, documentation the agent did not create, and frequently a peer-to-peer conversation.
• Replace review: Automation bias is the failure mode that turns a compliant workflow into an enforcement exposure. If your override rate is near zero and your review time is near zero, you have automated the rubber stamp, not the work.
• Practice medicine: These are administrative and documentation workflows operating under human review. An agent does not determine medical necessity, does not make clinical decisions, and is not a licensed professional. That boundary belongs in your scope document, your system prompts, and your tool allowlists.

Revenue cycle AI is a crowded 2026 market with unusually weak evidence standards, which makes vendor selection more consequential than platform selection. These are the questions we put in front of every healthcare client during discovery — including the ones who ultimately hire someone else.

The Frenchy Digital red-flag checklist for revenue cycle AI vendor evaluation, 2026.

If the metrics that define success are not in the contract, the engagement will be measured on activity dashboards. Activity is not collection.

— Frenchy Digital buyer's principle

Frenchy Digital is a senior-led, Black-owned Los Angeles agency that builds administrative automation for healthcare practices. Here are the bands we scope against, with the assumptions behind each tier.

Frenchy Digital 2026 cost bands for healthcare revenue cycle automation.

Senior-led delivery is priced at $150–$225 per hour, with ongoing retainers from $2,500 to $9,500 per month depending on the number of live workflows and the depth of the compliance program. Every engagement carries a 30-day post-launch warranty, and you receive a written scope and fixed-price phased proposal within 5 business days of the discovery call.

A note on sequencing spend: the discovery and workflow audit exists precisely so you do not buy a build you do not need. In a meaningful minority of engagements, the audit's recommendation is to fix a payer contract, a registration script or a scheduling policy first — and to revisit automation once the underlying process produces data an agent can act on.

The order matters more than the tooling. This sequence puts the most deterministic, lowest-clinical-risk workflows first, so the practice builds the audit-log and override-tracking discipline on low-stakes work before applying it anywhere near a diagnosis code.

A 12-month revenue cycle automation sequence for an independent practice — Frenchy Digital, 2026.

Month zero is not optional. Without a documented baseline, you cannot distinguish an agent that improved your collections from a quarter with a favorable payer mix, and you will have no defensible answer when your board asks what the $65,000 bought. Capture first-pass acceptance rate, denial rate by payer and CARC, appeal rate, appeal win rate, days in A/R, A/R over 90 days, cost to collect, and staff hours by task — before anything is switched on.

For context on adoption: the AMA's 2026 Physician Survey on Augmented Intelligence (n=1,692, fielded January 15 to February 2, 2026) found 81% of physicians now use AI in practice, up from 66% in 2024 and 38% in 2023, with roughly 70% seeing AI's value in automating the drivers of burnout — documentation, chart review and prior authorization. The question in 2026 is no longer whether to adopt. It is which workflow, in what order, and under what controls.

If you take four things from this piece: the appeal gap is the largest single opportunity in your revenue cycle and the numbers supporting that are primary and recent. There is no reimbursement for any of these tools, so the entire business case is labor and recovered cash. The OIG has named AI-generated diagnosis prompts as a risk area, which makes documented human review a control rather than a courtesy. And the evidence base for vendor accuracy claims is thin enough that a shadow-mode pilot against your own claims is the only test worth trusting.

Start with eligibility. Measure before you build. Keep a named human on every deadline. And treat any vendor who cannot name the denominator behind their headline statistic as the answer to a question you were about to spend six figures on.