AI Agents for Prior AuthorizationWhat to Automate in 2026

Prior authorization is the rare healthcare topic where the regulatory calendar moves faster than the technology. Most of what practices read about federal prior authorization reform in 2026 describes obligations that do not exist yet, imposed on parties that are not the practice. Getting this wrong is expensive: it is how a practice ends up paying for an integration to an API that no payer is required to expose for another year.

So start with the calendar, not the pitch deck. Here is the state of play as of August 2026, separated into what binds someone today and what is still a future or proposed event.

Prior authorization regulatory timeline as of August 2026. Sources: 89 FR 8758, CMS WISeR, 90 FR 898.

The clearest primary data on what prior authorization costs a practice comes from the American Medical Association's 2025 prior authorization survey, released in May 2026 with a sample of 1,000 practicing physicians. It is worth reading in full, because these numbers are what any automation business case has to move.

AMA 2025 prior authorization survey, released May 2026 (n=1,000). Full results in the AMA survey PDF.

Two of these deserve to be pulled out of the table. The first is 40 percent of physicians have staff working exclusively on prior authorization. That is not a productivity drag spread thinly across a team; it is a dedicated headcount line, and it is the line an automation business case is actually competing against. The second is 26 percent report that prior authorization led to a serious adverse event. That reframes the problem from an administrative annoyance into a patient-safety one, which is why the regulatory attention in 2026 is as intense as it is.

The AMA also identified the highest-burden payers by physician report: UnitedHealthcare at 75 percent, Humana at 65 percent, Anthem/Elevance and Aetna at 61 percent, Cigna at 59 percent and Blue Cross Blue Shield plans at 56 percent. If your payer mix is weighted toward the top of that list, your prior authorization workload is not a staffing failure — it is a contracting reality.

The CMS Interoperability and Prior Authorization Final Rule, CMS-0057-F, was published February 8, 2024 at 89 FR 8758 and took effect April 8, 2024. It is the most consequential prior authorization regulation in a decade, and it is also the one most frequently misdescribed to practices. It regulates payers.

Scope of CMS-0057-F. Source: CMS.

Three obligations became live for impacted payers on January 1, 2026. Expedited requests must be decided in 72 hours and standard requests in 7 calendar days — a requirement that excludes QHP issuers on the federally facilitated exchanges and excludes drugs. Denial notices must state a specific reason for the denial. And payers must publish prior authorization metrics on their public websites, with the first report due March 31, 2026 covering calendar year 2025 across nine metrics including percentage approved, percentage denied, percentage approved after appeal, and average and median turnaround time.

What is not live is the part everyone talks about. The FHIR-based Prior Authorization API, the Provider Access API, the Payer-to-Payer API, and the inclusion of prior authorization data in the Patient Access API are all required by January 1, 2027. Separately, CMS issued enforcement discretion on February 28, 2024 not to enforce the X12 278 standard against covered entities that use FHIR-based prior authorization — a useful detail if your clearinghouse contract is written around 278 transactions.

The single provider-facing element is the Electronic Prior Authorization measure for MIPS eligible clinicians, beginning with the CY2027 performance period and the 2029 payment year. It is an attestation — a yes/no answer — not a numerator-and-denominator measure. Any vendor selling you 2026 software on the strength of MIPS prior authorization scoring has the timing and the mechanics both wrong.

One more item on the horizon: the CY2027 OPPS proposed rule, published July 7, 2026 at 91 FR 41734, proposes to expand prior authorization in the hospital outpatient setting. It is proposed, not final, and should be tracked rather than planned around.

The most genuinely new development of 2026 is not a rule at all — it is a CMS Innovation Center model test. WISeR runs from January 1, 2026 through December 31, 2031 under Section 1115A authority and introduces AI- and machine-learning-assisted review into Original Medicare, which has historically had almost no prior authorization. For context, KFF counted roughly 625,000 prior authorization reviews in traditional Medicare in 2024 — about 0.02 per enrollee — against 52.8 million determinations in Medicare Advantage.

WISeR model participants by state. Source: CMS WISeR Provider and Supplier Operational Guide.

Thirteen service categories are in scope. The named list includes arthroscopic lavage and debridement for the osteoarthritic knee, vagus nerve stimulation, electrical nerve stimulators, sacral nerve stimulation, epidural steroid injections, cervical fusion, hypoglossal nerve stimulation for obstructive sleep apnea, and bioengineered skin substitutes. Inpatient-only services, emergency services, and services that would pose substantial risk to the patient if delayed are excluded.

All recommendations for non-payment are determined by appropriately licensed clinicians.

— CMS WISeR Provider and Supplier Operational Guide

That sentence is the whole design of the model, and it is the sentence to quote when someone tells you Medicare is now letting an algorithm deny care. The AI and machine-learning layer triages and prioritizes cases; a licensed clinician makes every non-payment recommendation. It is the same architecture any defensible practice-side agent should use, running in the opposite direction.

In June 2025, more than 60 insurers covering 257 million Americans pledged a set of prior authorization reforms, with the first commitments effective January 1, 2026. In 2026, AHIP and BCBSA reported progress. That progress is payer self-reported and not independently audited, and it should be read alongside what physicians say they are experiencing.

AHIP/BCBSA self-reported pledge progress set against the AMA 2025 physician survey.

Both sets of numbers can be true at once. Eliminating 11 percent of prior authorization volume — roughly 6.5 million requests — is a real reduction, and a greater-than-15-percent cut in Medicare Advantage is meaningful. It also leaves 89 percent of the volume in place, concentrated in exactly the service lines where physicians report the most friction. That is why only 33 percent of physicians expect the pledge to make a meaningful difference, and why the qualified-reviewer commitments have not yet shown up in physician experience: 24 percent report medical-necessity reviews by qualified clinicians and 16 percent report appropriately qualified peer-to-peer reviewers.

Note also the date on the pledge's electronic prior authorization commitment: standardized electronic prior authorization is targeted operational by 2027. That is the same year the CMS-0057-F FHIR APIs become mandatory. If you are planning a two-year roadmap, 2027 is the year the plumbing changes — not 2026.

While federal prior authorization policy is about timeframes and plumbing, state legislatures spent 2025 and 2026 on a narrower question: what role AI may play in a coverage determination. California moved first and most clearly.

California SB 1120, the Physicians Make Decisions Act, has been effective since January 1, 2025. It provides that AI or an algorithm may not be the sole basis to deny, delay or modify care; that medical-necessity determinations must be made by a licensed physician or other competent professional; and that the tool must weigh the individual enrollee's history and clinical circumstances rather than applying a group-level rule. The Department of Managed Health Care and the Department of Insurance audit compliance.

State and professional-body constraints on AI in coverage determinations. See the 2026 state legislative tracker and Holland & Knight's 2026 survey.

The trend line is the story. As of late July 2026, trackers counted 14 new health-AI laws across 11 states in 2026, with more than 40 bills introduced across 25 states. Seven of those states legislated specifically on AI in insurer medical-authorization decisions — Alabama, Colorado, Georgia, Illinois, Iowa, Utah and Washington. Bill numbering is inconsistent across trackers for several of them, so confirm citations with counsel before relying on a specific number in a policy document.

The professional-body position moved in the same direction. On June 10, 2026 the AMA House of Delegates adopted policy holding that AI is an assistive tool rather than an autonomous decision-maker, requiring transparency, accountability and physician oversight wherever AI touches patient care, and expressly opposing autonomous or semiautonomous AI as a substitute for physician review in coverage determinations. The AMA's preferred term throughout is augmented intelligence — assistive by design.

Everything above is context. This section is the business case.

In January 2026, KFF published its analysis of 2024 Medicare Advantage prior authorization data. Insurers made 52.8 million determinations and denied 4.1 million in full or in part — a 7.7 percent denial rate on determinations, at 1.7 requests per enrollee. Then the number that matters: only 11.5 percent of those denials were appealed, and 80.7 percent of the appeals that were filed were overturned.

Prior authorization and claim denial economics, 2024 data. Sources: KFF (January 2026, Medicare Advantage) and KFF (March 2026, ACA Marketplace).

This is where a prior authorization agent earns its keep. The work of appealing a denial is almost entirely administrative: read the denial reason, match it against the payer's published medical-necessity policy, locate the chart evidence that satisfies the criteria, draft the letter, file it before the deadline, and track the clock. None of that is clinical judgment. All of it is exactly the kind of structured, deadline-driven, document-assembly work that agents handle well and that overworked billing staff triage away first.

One supporting data point, with its age stated plainly: Premier Inc. found that claims adjudication cost providers $25.7 billion in 2023, up 23 percent year over year, with $18 billion potentially wasted on claims that should have been paid on submission, at an average adjudication cost of $57.23 per claim. Premier also reported that roughly 70 percent of denials were ultimately overturned, typically after three rounds of review of 45 to 60 days each. That is 2023 data with no published 2026 update, and it should be cited as such.

A prior authorization agent is an administrative system. It assembles documents, checks them against published criteria, submits them, watches clocks and drafts letters. It does not decide medical necessity, and it does not practice medicine. That boundary is not a disclaimer — it is the architectural requirement that makes the rest defensible.

Frenchy Digital build guidance for practice-side prior authorization agents, August 2026.

A few of these are worth expanding. Denial triage got materially easier in 2026 for CMS-0057-F payers, because denial notices must now state a specific reason. A parseable, specific reason is what turns denial classification from guesswork into rules-plus-model work, and it is the single reason a denial-triage agent is a better investment in 2026 than it was in 2024.

Payer performance intelligence is the most overlooked opportunity in this list. Impacted payers had to publish CY2025 prior authorization metrics by March 31, 2026 — including the share of denials approved after appeal and their average and median turnaround times. An agent that ingests those published metrics and joins them to your own submission history tells you which payers are worth appealing to, which are worth escalating early, and which deserve a conversation at contract renewal.

Policy versioning sounds like a detail and is not. Payer medical-necessity policies change. If you cannot demonstrate which version of a policy was in effect on the date you submitted, you lose arguments you should win. Every submission record should carry the policy version it was built against.

If the agent's output changes what a clinician decides, a clinician reviews it and the review is logged. If it changes only what a fax machine receives, ship it.

— Frenchy Digital build principle

Restraint is half of a good 2026 roadmap. These are the items where the correct decision is to scope them, contract them to a date, and not pay for them yet.

• FHIR Prior Authorization API integration (Jan 1, 2027): Impacted payers are not required to expose it until 2027. Some will move early; most will not. Contract this as a defined later phase against a named live payer endpoint, not as a 2026 deliverable.
• Provider Access and Payer-to-Payer APIs (Jan 1, 2027): Same date, same logic. The Payer-to-Payer API in particular is what will eventually reduce duplicated authorizations when a patient switches plans — genuinely valuable, and genuinely not available yet.
• MIPS Electronic Prior Authorization measure (CY2027 performance period): An attestation for the 2029 payment year, not a scored measure. There is no 2026 reporting work to prepare for, and no scoring advantage to buy.
• Standardized electronic prior authorization from the AHIP pledge (targeted 2027): A payer-reported target, not a regulatory deadline. Track it; do not build a roadmap dependency on it.
• CY2027 OPPS expansion of prior authorization (91 FR 41734, proposed Jul 7, 2026): Proposed, not final. If you operate a hospital outpatient department, watch the final rule; do not staff against a proposal.
• HIPAA Security Rule modernization (90 FR 898, projected final action 2027): Proposed, not final, and moved to the long-term agenda. But the proposed controls — MFA, encryption of ePHI at rest and in transit, an annually updated asset inventory and network map, an annual compliance audit, vulnerability scanning every six months, annual penetration testing and 72-hour restoration of critical systems — are good engineering regardless. Build to them now as design targets, not as current obligations.

A prior authorization agent touches protected health information on every transaction. That makes any vendor in the loop a business associate, and it makes a signed business associate agreement a precondition rather than a formality. The governing standard today is the existing HIPAA Security Rule. The proposed modernization at 90 FR 898 would tighten it considerably, but it is proposed, with a projected final action in 2027.

The compliance control set Frenchy Digital ships on every healthcare automation engagement.

The control that gets skipped most often is the one regulators care about most. Human-in-the-loop review is a compliance control, not a courtesy — and the enforcement theory that has emerged is that rubber-stamp review is not review. A reviewer accepting the overwhelming majority of AI suggestions in a fraction of a second is producing evidence of automation bias, not evidence of oversight. That is why override rates, per-reviewer review time and sampled QA of accepted outputs belong in the build from day one, not in a remediation project after an audit.

The adjacent risk is worth naming explicitly. In February 2026, the HHS Office of Inspector General's Medicare Advantage industry compliance program guidance named as potentially abusive the practice of querying physicians through EHR platforms — including prompts generated by artificial intelligence algorithms — to add risk-adjusting diagnoses. A prior authorization agent that nudges clinicians toward documentation that changes coding or risk adjustment is standing very close to that line. Keep the agent's job to assembling evidence that already exists in the chart, never to suggesting clinical content that does not.

And the framing that ties it together: administrative automation is not the practice of medicine. Frenchy Digital does not build products that are FDA-cleared, and we do not build agents that make clinical determinations. We build systems that get the right documents to the right payer on time, with a licensed human signing anything clinical.

Every honest business case in this category has to survive the following list. If a vendor has not raised these with you, they are selling rather than scoping.

• There is no reimbursement for this: In the CY2026 Medicare Physician Fee Schedule final rule, CMS only solicited comment on paying for SaaS and software algorithms under the PFS, noting they are not well accounted for. No general AI payment pathway was finalized. Ambient scribes, AI coding and AI denial tools are cost-side ROI plays. NTAP is inpatient-only and irrelevant to outpatient practice economics.
• Accuracy claims in this market are vendor-published: No independent benchmark exists for AI accuracy on prior authorization, denial triage or autonomous coding. Treat figures like 'denials cut from 18% to 3%' or '4–7x productivity' as marketing until someone shows you a methodology. Ask for a pilot measured on your own data instead.
• There is no current primary provider-side denial-rate benchmark: The most recent public Optum Revenue Cycle Denials Index is the 2024 edition, which found 41 percent of denials originate in patient access. Circulating '11.8% initial denial rate in 2026' figures trace only to vendor blogs. Do not build a business case on them.
• The rework-cost figures are unsourced: The widely repeated '50–65% of denials are never reworked, at $25–$118 per rework' is universally attributed to MGMA, but no primary MGMA publication is locatable. If it appears in your business case, label it as commonly attributed rather than verified.
• The 80.7% overturn rate is a self-selected subset: Practices appeal what they believe is winnable. The overturn rate on the 88.5 percent of Medicare Advantage denials that were never appealed is unknown, and is very likely lower. The gap is real; the ceiling is not the same number.
• Payer channels break without notice: Portal-driven and fax-driven submission paths change layout, authentication and required fields with no advance notice. Any automation that scrapes or drives a portal needs monitoring, alerting and a manual fallback queue, and the maintenance cost is ongoing rather than one-time.
• The AHIP progress figures are self-reported: They are not independently audited. Set them against the AMA physician survey rather than treating either as the complete picture.
• Automation bias is the top compliance risk: The failure mode is not a wrong output; it is a correct-looking output accepted without review at scale. This is a process and measurement problem, and it does not get solved by a better model.

None of this argues against automating prior authorization. It argues for automating it with measured baselines, a pilot on your own denial data, and a business case built on the labor line — the 13 hours per week and the 40 percent of practices with staff working exclusively on prior authorization — rather than on a vendor's accuracy chart.

Here are the bands Frenchy Digital uses to scope healthcare automation work in 2026, with the scope assumptions behind each tier. These are our figures, not industry averages.

Frenchy Digital 2026 scoping bands for prior authorization and healthcare workflow automation.

Senior-led delivery is priced at $150–$225 per hour. Ongoing operations run $2,500–$9,500 per month depending on scope, and cover payer-channel monitoring, policy-change tracking, override-rate reporting and model or prompt updates. Every engagement includes a 30-day post-launch warranty, and you receive a written scope with a fixed-price phased proposal within 5 business days of the discovery call.

For the return side of the model, use your own labor line rather than a vendor multiplier. MGMA reports that support staff salaries and benefits run roughly 25 percent of total practice revenue — about half of overhead — and that the median investment required to support one physician FTE reached $343,128 in Q4 2025. MGMA also found automation is the top 2026 cost-cutting move at 36 percent of groups, ahead of hiring freezes at 18 percent. Against that, BLS put the 2024 median wage for medical records specialists, which includes billing and coding roles, at $50,250; fully loaded cost including benefits and software is commonly cited at $60,000 to $80,000 per year, though that loaded figure is vendor-relayed rather than primary.

Prior authorization is the most heavily marketed corner of healthcare AI in 2026, and the regulatory confusion described at the top of this article is actively useful to a certain kind of vendor. Here is the checklist we give prospects, including the ones who go on to hire someone else.

The Frenchy Digital buyer's checklist for prior authorization automation, 2026.

Ask one question in every vendor call: which named payer has a live prior authorization API today, and what happens to my workflow if the answer is none? The answers separate the teams who have shipped from the teams who have read a press release.

— Frenchy Digital buyer's principle

Frenchy Digital is a senior-led, Black-owned Los Angeles agency building administrative automation for medical practices, clinics and healthcare operators. Here is what an engagement looks like.

• Discovery that quantifies your own gap: A 60-minute structured call followed by a workflow audit. We measure your prior authorization volume, denial rate and appeal rate by payer against your own data — not a national average — and put the number in writing.
• Written scope in 5 business days: A fixed-price phased proposal within 5 business days of the discovery call. Phases are priced individually so you can stop after any one of them.
• Compliance controls designed in, not bolted on: Signed BAA before any data moves, minimum-necessary handling in prompts and logs, audit logging on every action, and human review checkpoints with override-rate telemetry from the first sprint.
• Senior engineers only: We do not staff junior engineers on regulated healthcare work. Senior-led delivery at $150–$225 per hour, which is materially below national consultancy rates for the same seniority.
• A written limitations statement: Every delivery includes an explicit statement of what the agent does not do and must never decide. It is what your compliance officer will ask for, and it is what keeps the clinical boundary enforceable.
• 30-day post-launch warranty: Included on every engagement, followed by an optional retainer at $2,500–$9,500 per month covering payer-channel monitoring, policy-change tracking and override-rate reporting.
• You own everything: Full source code, prompts, policies, documentation and infrastructure accounts transfer to your practice at delivery. No vendor lock-in, and no hostage data.

Book a free 60-minute discovery call or call +1 (424) 272-5601. You will leave the call with a clear read on which parts of your prior authorization workflow are worth automating in 2026 and which are worth waiting for.

The regulatory ground under prior authorization is genuinely moving, but it is moving on a schedule that is easy to read once you separate the layers. Payers are the regulated party in 2026. The plumbing changes in 2027. Your practice's only direct federal obligation is an attestation that starts in CY2027. And the state layer is converging, quickly, on a single principle: a licensed human makes the coverage call.

That leaves a clear answer to the question this article set out to answer. Automate the administrative half of prior authorization now — documentation assembly, medical-necessity pre-checks against published payer policy, submission and status tracking, denial triage, appeal drafting and deadline management — because none of it depends on a rule that has not landed yet. Wait on the API layer. Never automate the clinical judgment.

And build the business case on the appeal gap. Eleven and a half percent of Medicare Advantage denials were appealed in 2024; eighty and seven-tenths percent of those appeals were overturned. That is the clearest, best-sourced arbitrage in practice operations right now, and it is available without waiting for a single regulatory deadline.