Many specialty medicines start with a form. A doctor's office faxes two or three pages to the patient support service a drug maker runs, called a hub, and a person there types the form into a system, checks the signatures and calls the office about whatever is blank. Until that is finished, nobody can start work on the patient's insurance.
Read this if you lead patient services or hub operations, work on an intake team, act as a privacy officer, audit or pay for hub intake, or are deciding whether to automate the reading. No background needed.
Imagine you are the intake team lead at Northwind Patient Support, the hub for a mid-size biotech's three specialty brands. It is 7:42 on a Wednesday morning, October 7, 2026, and a six-page fax comes in from Wrenfield Gastroenterology in Chicago. Marisol Verano, who has ulcerative colitis, is starting a specialty medicine called Veltrimab.
The doctor has signed, and the form looks finished. On page 1, section 2, though, the line where Marisol signs and dates her permission to share her health records, called an authorization, is empty. This office leaves it empty on 21 of its 64 forms, because staff fax the form before the patient signs at check-out.
Page 2, what the form says
Diagnosis box
Ulcerative colitis
Code written
K50.90
Member ID
NWH 4417 2093
The rest of the packet
Prescription, chart note
Ulcerative colitis
K50 means
Crohn's disease
Printed card
NWH 4471 2093
Three itemsOne fax backa blank signature and date, a code the office must confirm itself, and two swapped digits you settle from the card.
Careful intake catches all three before anyone types 31 fields, and before a colleague calls a health plan with the wrong member ID and the wrong disease.
The hub enrollment form: its signatures, its rules and why it still arrives by fax
What is in a packet, what a blank line means under federal rules, which checks a machine can settle, what the published numbers do and do not show, and how intake teams work today. If you have never seen an enrollment form, start here.
01 · In plain words
What happens between a doctor's signature and a hub's first phone call
A doctor decides a patient needs a specialty medicine, usually an expensive injected or infused drug for a long-term disease such as ulcerative colitis, psoriasis or rheumatoid arthritis. The prescription alone rarely gets it to the patient. The health plan will want proof, the pharmacy may be a special one, and the first dose may need planning. So many makers of these medicines pay for a support service, called a patient hub, that does the legwork for the patient and the doctor's office.
The hub cannot begin until it knows who the patient is, who the doctor is, what is being prescribed and which insurance applies. That information arrives on an enrollment form the maker prints for each brand. The office fills it in, the patient signs one part, the doctor signs another, and someone at the front desk feeds it into a fax machine with copies of the insurance cards and a page from the chart.
At the hub, a person called an intake specialist picks up that fax. She works out where one patient's pages end and the next begin, types the fields into the hub's system, checks each signature and tick box against the rules for that brand's form, and then, very often, faxes the office to ask for what is missing. Only when the packet is whole does the case go to the colleague who calls the health plan.
That desk work is hub enrollment form processing. It looks like clerical work, and most of it is. It also decides how soon the patient hears from anyone, whether the hub may lawfully use what it was sent, and whether the next person starts with the right disease and the right member number.
From a prescription to benefits verification: enrollment in five steps
The doctor prescribesThe office picks the brand's enrollment form, or an electronic version, and fills it in.
Patient and prescriber signThe patient signs an authorization and often a text consent. The prescriber signs the prescription.
The hub reads and checks the formThe packet is split, read, checked and chased. This guide is about this step.
The case opensThe complete record goes into the hub's system, with follow-up dates and a named case manager.
Benefits verification startsA specialist finds out what the plan covers. That work has its own guide on this site.
The people, offices, plans and brands in this guide's example are fictional.
A signature that binds someone else, a box that needs a signature, and two more surprises at the fax line
The authorization mostly binds the sender
HIPAA, the federal health privacy rule, writes its authorization requirement for covered entities: health plans, clearinghouses (which convert billing data between formats) and most providers. A drug maker is not on that list. The signature chiefly lets the doctor, plan or pharmacy release records to the hub.1,2
A ticked box may not be a consent
Federal phone rules define written consent as an agreement "bearing the signature of the person called". A ticked text-message box above an empty signature line has no signature yet.3
A vendor says most forms lack it
One hub technology vendor wrote in 2021 that 62% of hub enrollments are submitted without HIPAA authorization. It named no study, and no independent figure exists that we could find.4
A valid number can still be wrong
The check digit on a prescriber's National Provider Identifier catches most typing slips. It says nothing about whether the number belongs to the doctor who signed. Only the public registry can say that.5,6
Hub, authorization, NPI, fax-back: the four words on every intake desk
Hub
A support service, run by a drug maker or a contractor, that helps a patient and office start a specialty medicine and stay on it.
Authorization
The patient's signed permission under HIPAA, the federal health privacy rule, for named people to share named health information for a stated purpose.
NPI
National Provider Identifier: the ten-digit number every US health care provider who bills electronically holds.
Fax-back
The hub's reply to the office, listing what is missing or needs confirming. It often goes with the page to sign.
What a specialty patient enrollment packet holds, and which page answers which question
In shortA packet is the maker's form plus whatever the office attaches. No federal rule sets its layout, so each brand has its own version. The same question is often answered on more than one page, which helps when two pages disagree.
The heart of a packet is the brand's enrollment form, typically two or three pages. In this guide's sample it has sections for the patient, insurance, the diagnosis, the prescriber, clinical history, the site where the drug will be given and the prescription itself. Some forms add a "quick start" request: free product while coverage is pending, signed separately by the prescriber.
Around the form sit the attachments. A demographic sheet printed from the office's records holds the address, phone number and insurance on file, and sometimes a Social Security number the hub never asked for. A copy of the insurance card, front and back, supplies the member ID and the routing numbers a pharmacy needs: the BIN and the PCN. A chart note describes the visit. Reading all of these together is what lets a person spot a problem no single page shows.
The member ID and the diagnosis each appear on more than one page, so pages can disagree
Where the sample packet answers each question. Your brand's form will differ.
Why the same form comes back in four shapes: fax, eForm, e-signature, portal
The channel changes what can go wrong. A fax brings handwriting, skewed pages, several patients' pages in a single transmission and blank fields no system stopped anyone from leaving. An electronic form can refuse to submit with a required field empty, and can carry an electronic signature, which federal law says may not be denied effect solely because it is electronic.7 A portal adds login and identity questions. A hub usually takes all four at once, so intake runs a paper process and an electronic one side by side.
An office's choice is seldom about the hub. A large share of US physicians exchanged records with outside providers only by fax, mail or e-fax in the latest federal survey we could find (section 9). A hub that closes its fax line loses those offices' patients.
The Social Security number nobody asked for
Demographic sheets are printed from practice systems, and those systems may print everything. Some forms, this guide's sample among them, ask offices to black out the number before faxing, and some offices do. A hub that receives one now holds something it has no use for, so a sensible internal rule is to mask it on arrival and keep no copy. Write that rule down as your hub's policy; we found no federal rule on hub intake that says it in those words.
03 · Who HIPAA binds
Doctor's office, hub vendor, drug maker: who HIPAA binds when an enrollment form is faxed
In shortHIPAA binds covered entities and their business associates. The doctor's office usually is one, the drug maker usually is not, and a hub vendor can be either or neither depending on its contract and what it does. Settle which of these you are, for each flow of data, with counsel, in writing.
People say "HIPAA applies to the hub" as if it were one thing. The rule's own definitions, in the 2025 edition of the Code of Federal Regulations, are narrower. A covered entity is a health plan, a health care clearinghouse, or a provider who transmits health information electronically in a covered transaction, such as a claim.2 A business associate is someone who handles protected health information, the rule's term for health information that identifies a person, on behalf of a covered entity for a regulated function.2
Being a drug maker puts a support program's sponsor on neither list.
Three consequences follow. The doctor's office needs a reason to send the form: treatment and payment disclosures have a permission of their own, and anything else needs an authorization.8,1 A hub vendor working on behalf of a specialty pharmacy may be its business associate, with direct duties. And information that reaches a maker under an authorization can fall outside HIPAA altogether, which is why the rule makes the form warn the patient about that.1
A May 2026 review of three insulin assistance programs found none gave HIPAA protection to data the manufacturer held.9 Those are assistance programs, a close cousin of hubs, and the sample is small.
One fax crosses three legal positions before the case opens
Our reading of the rules, for a common arrangement. Yours may differ.
1The office holds the record
A provider that bills electronically is a covered entity. It may disclose for treatment and payment, and otherwise needs a valid authorization.
Doctor's office
2The fax leaves
The form carries a diagnosis, a drug and an insurance number. Whatever basis the office relies on, it applies now, before the hub has read a word.
Doctor's office
3The hub receives
A vendor acting for a covered entity is a business associate for that work. Acting only for a maker, it may be neither, and contract and state law govern.
Hub vendor
4The maker sees data
A maker is outside HIPAA's definitions unless it also runs something inside them, such as a pharmacy. The authorization's redisclosure warning speaks to this.
A provider that bills electronically is a covered entity. It may disclose for treatment and payment, and otherwise needs a valid authorization.
Doctor's office
The fax leaves
The form carries a diagnosis, a drug and an insurance number. Whatever basis the office relies on, it applies now, before the hub has read a word.
Doctor's office
The hub receives
A vendor acting for a covered entity is a business associate for that work. Acting only for a maker, it may be neither, and contract and state law govern.
Hub vendor
The maker sees data
A maker is outside HIPAA's definitions unless it also runs something inside them, such as a pharmacy. The authorization's redisclosure warning speaks to this.
Drug maker
"No information flows until it is signed" is a hub's policy, and a sensible one
Hubs handle a blank authorization in two broad ways. One vendor wrote in 2021 that "many hubs require patient authorization before access initiation begins", and that this delays benefits verification by 4 to 5 business days; the same post, written to promote that vendor's product, says access services can begin before the authorization is gathered.4
As of November 3, 2026 we found no statement from the US health department, HHS, that answers squarely when an office may send an enrollment form to a manufacturer's hub with no authorization, or when a hub may begin.
A rule of "stop until signed" starts late. By the time anyone sees the blank line, the office has already sent the diagnosis and the insurance number, and the rule cannot undo that. It governs what the hub does next. So write the policy as what your hub does, and let your privacy officer and counsel set it for each brand and each arrangement.
By the time a hub sees a blank line, only the next steps are still its to decide
Our reading of what a stop-until-signed rule can reach.
Already doneYours to decide
Can a hub's rule reach it?The diagnosis and insurance number leaving the officeAlready doneThe form reaching the hubAlready doneAnyone calling the patientYours to decideContacting the health planYours to decidePassing the record furtherYours to decide
The diagnosis and insurance number leaving the office
Already done
The form reaching the hub
Already done
Anyone calling the patient
Yours to decide
Contacting the health plan
Yours to decide
Passing the record further
Yours to decide
Where the "minimum necessary" standard stops
HIPAA asks covered entities and business associates to limit protected health information to the minimum necessary for the purpose. The same paragraph lists exceptions, including disclosures to a provider for treatment and disclosures made under an authorization.10 A fax-back that repeats only what the office needs is good practice in every case. It is the legal test in some cases and not in others, which is worth knowing before you describe it to an auditor.
State privacy law can ask for more than the federal form
California's Civil Code section 56.11 sets a form for medical authorizations: handwritten or in at least 14-point type, clearly separate from other language on the page, and signed with a signature that serves no other purpose.11 A single-signature form that also carries text consent deserves a hard look there.
Washington's My Health My Data Act exempts HIPAA-protected information and some information intermingled with it held by covered organizations, so a maker's data outside HIPAA has to be assessed against it.12 Other states have their own rules. A national hub keeps a state-by-state answer, and this guide does not try to be one.
04 · The authorization, line by line
The HIPAA authorization on an enrollment form, line by line, under 45 CFR 164.508
In shortA valid authorization has six core elements and three required statements. If an element is left blank the document is defective, and so it is not valid. A blank signature or date therefore means there is no valid authorization to rely on; what stops next is your hub's policy (section 3). Section 164.508 was last amended in January 2013.
The text below comes from the 2025 edition of the Code of Federal Regulations, revised as of October 1, 2025, and the section's last amendment was published January 25, 2013.1 The rule requires at least these parts:
Paragraph
What it requires
The plain test at the intake desk
(c)(1)(i)
A description of the information, "in a specific and meaningful fashion"
Does it say which information, such as diagnosis and prescription?
(c)(1)(ii)
Who may make the disclosure: a name, or a class of persons
"My health care providers, health plans and pharmacies" names a class.
(c)(1)(iii)
Who may receive it: a name, or a class of persons
Does it name the hub, and its service providers if they will see the data?
(c)(1)(iv)
A description of each purpose
Enrollment, checking benefits, prior authorization (a plan's advance approval of a drug): each stated use.
(c)(1)(v)
An expiration date or an expiration event
A date, or an event tied to the person or the purpose.
(c)(1)(vi)
The person's signature and the date. A personal representative's signature also needs "a description of such representative's authority"
Both lines filled. A representative also states the relationship.
(c)(2)(i)
The right to revoke in writing, plus the exceptions and how to do it, or a reference to the covered entity's privacy notice
Does it say how, as well as that?
(c)(2)(ii)
Whether treatment, payment, enrollment or eligibility can depend on signing
"My treatment does not depend on signing" is the common wording.
(c)(2)(iii)
The risk that information may be disclosed again and "no longer be protected"
Is the warning there, in plain words?
Paraphrased from 45 CFR 164.508(c); quoted words are the rule's own.1 The right-hand column is our own working test, written for this guide.
Paragraph (b)(2) is the one to pin above the desk. An authorization is not valid if it "has not been filled out completely, with respect to an element described by paragraph (c)". It is also invalid if it has expired, is known to have been revoked, or contains material information known to be false.1 So a checker needs to look past the signature line: a form with a signature but no date is defective in the same way.
Three further rules touch how forms are built. The form must be in plain language. Where a covered entity seeks the authorization it must give the person a copy of the signed form. And a covered entity must keep the signed authorization, for six years from when it was created or last in effect, whichever is later.1,13
One more needs care: paragraph (b)(3) says an authorization "may not be combined with any other document" to make a compound authorization, with stated exceptions. Whether a page that also holds a prescription or a text consent crosses that line is a question for your counsel. Putting the authorization on its own page is one way to avoid the question.
The sample form carries seven of the nine required parts; one is thin and one is blank on this case
The fictional Veltrimab form and Marisol's copy, against 45 CFR 164.508(c). A working comparison, and a legal review is still your counsel's.
Blank on this caseThin wordingPresent
On the sample formWhich informationPresentWho may disclosePresentWho may receivePresentPurposePresentExpiration, two years after signingPresentSignature and dateBlank on this caseRight to revoke: says in writing, and neither how nor the exceptionsThin wordingTreatment does not depend on signingPresentWarning about redisclosurePresent
Fictional example from this guide
Show the numbers
On the sample form
Which information
Present
Who may disclose
Present
Who may receive
Present
Purpose
Present
Expiration, two years after signing
Present
Signature and date
Blank on this case
Right to revoke: says in writing, and neither how nor the exceptions
Thin wording
Treatment does not depend on signing
Present
Warning about redisclosure
Present
When a daughter signs: personal representatives on the enrollment form
Many specialty patients are older, sick or young. Under the rule, a person with authority under state law to make health care decisions for an adult must be treated as that adult's personal representative for the relevant information.10 The form asks for the relationship because the rule asks for a description of authority.1 Writing "daughter" tells the hub what she says she is. Whether that gives her authority in that state is a judgment for a person, so a careful checker sends this one to a person every time.
When the authorization also covers marketing
HIPAA's definition of marketing excludes communications about a drug currently prescribed for the person, as long as any payment to the covered entity is reasonably related to the cost of making the communication.14 Where a covered entity's marketing does involve payment from a third party, the authorization must say so.1 Hubs that want to send other brand material need a separate look at this.
05 · Text consent
Text-message consent on a hub enrollment form: the phone rules, and what changed in 2025 and 2026
In shortTexting is governed by the Telephone Consumer Protection Act (TCPA), a separate law with a separate idea of signature. An opt-out by "stop" must be honored within a reasonable time, ten business days at most. A broader "revoke all" rule waits until January 31, 2027, and since June 2025 district courts in enforcement cases are not bound by the Federal Communications Commission's (FCC's) reading of the Act.
The phone rule, 47 CFR 64.1200 in its 2025 edition, works in layers, set out in the table below.3 Written consent is defined with care: "an agreement, in writing, bearing the signature of the person called", naming the phone number, with a clear disclosure that signing is not required as a condition of buying anything. An electronic signature counts if federal or state law recognizes it.
Automated or prerecorded call to a mobile phone
What the rule asks for
Any such call
Prior express consent
One that advertises or telemarkets
Prior express written consent
A "health care" message by or on behalf of a covered entity or its business associate
Prior express consent; the written kind is excepted
Paraphrased from 47 CFR 64.1200(a)(1) and (a)(2).3
Which layer applies depends on what the text says and who sends it. A refill reminder from a covered entity differs from a brand message from a maker. Few intake teams can make that call, and they do not need to. They need a clean record: which number, which wording, signed when. A strict hub treats the tick box as meaningful once the signature line on the same form is filled, and sends no texts until then.
The authorization text has held since 2013, while the phone and security rules are still moving
Jan 25, 2013Authorization rule last amended
78 FR 5699 is the last change listed under 45 CFR 164.508.
Jan 6, 2025HIPAA Security Rule rewrite proposed
90 FR 898. Still a proposal.
Apr 2025First delay of "revoke all"
The cross-channel part of the phone rule moved to April 11, 2026.
Jun 20, 2025McLaughlin v. McKesson
In enforcement cases, district courts are not bound by the FCC's reading of the TCPA. A fax case.
Jan 6, 2026Second delay
FCC order DA 26-12 moves "revoke all" to January 31, 2027.
Nov 2026Today
164.508 unchanged. Stop-word opt-outs apply now.
Jan 31, 2027"Revoke all" due
An opt-out from one type of message would then reach all that caller's robocalls and robotexts on unrelated matters, unless the FCC changes the rule first.
Jul 2027Security Rule final action listed
A target in the federal agenda, with no date set in a rule.
The opt-out words a hub must act on, and the ten-business-day clock
Since the revocation rule took effect, each of these replies counts as a reasonable way to revoke, and other wording counts if a reasonable person would read it that way.
stopquitendrevokeopt outcancelunsubscribe
A request must be honored "within a reasonable time not to exceed ten business days", and a sender may not name one exclusive way to revoke.3 So an opt-out typed in reply to a reminder has to reach the record the intake form created.
One part of that rule is delayed: the part that makes an opt-out from one type of message apply to all future robocalls and robotexts from that caller on unrelated matters. An FCC bureau order of January 6, 2026 moved it from April 11, 2026 to January 31, 2027, citing "the possibility the Commission may modify the existing requirement" in a pending rulemaking. The order leaves every other revocation rule as it was.15 We found no later order as of November 3, 2026.
McLaughlin, June 2025: what a Supreme Court fax case means for text consent
In McLaughlin Chiropractic Associates, Inc. v. McKesson Corp., decided June 20, 2025, the Court held that in civil enforcement proceedings a district court is not bound by the FCC's interpretation of the Act. The court must decide what the law means under ordinary principles of statutory interpretation, "affording appropriate respect to the agency's interpretation".16 The case was about unsolicited faxes, and the opinion decides nothing about text messages or consent.
Everything further is commentary. One law firm's reading for health care is that courts may now reach different answers on consent, and even on whether a text is a "call", and that an organization may want to collect written consent for every text.18 That advice is one firm's. It fits an enrollment form well, since the form is the moment when the signature is available.
06 · Checks with a right answer
The NPI check digit, ICD-10 code against box, and other form checks that need no clinical opinion
In shortMany intake checks are arithmetic or lookups, and they can run on every form. A few look like arithmetic and turn out to be judgments. Sorting the two apart is the first design decision of any automation.
The NPI check digit, worked through by hand
An NPI is nine digits plus a check digit, and NPIs were first issued starting with 1 or 2. The check digit is worked out from the other nine with a digit-summing method called the Luhn formula, calculated as if the card-issuer prefix 80840 sat in front. Leaving the prefix out comes to adding a constant 24.5 The Centers for Medicare & Medicaid Services (CMS), which publishes the formula, gives this example number.
Identifier: 1 2 3 4 5 6 7 8 9. Double every other digit, starting from the rightmost.
9→18 · 8 · 7→14 · 6 · 5→10 · 4 · 3→6 · 2 · 1→2
Add the individual digits: 1+8 + 8 + 1+4 + 6 + 1+0 + 4 + 6 + 2 + 2 = 43. Add the constant: 43 + 24 = 67. Subtract from the next number ending in zero: 70 − 67 = 3.
So the valid number is 1234567893. Swap the last two digits to 1234567839 and the same sum asks for a 6, so the number fails. That is the slip the formula is good at.
A pass shows only that the number is well formed. The second step is the public NPI Registry, where a number leads to a name, a specialty and a practice address.6 Test data is a trap here. A made-up number that passes the check digit can belong to a real provider, so anyone building sample forms should query the registry as well.
K50 or K51: a diagnosis code that contradicts its own tick box
ICD-10-CM, the US diagnosis code set, gives Crohn's disease category K50 and ulcerative colitis category K51. Each category carries an Excludes1 note against the other, which tells a coder the two are not coded together. These come from CMS's own FY 2027 code files, for the code year that began October 1, 2026; that year's addenda list no change to K50 or K51.19
The conflict, side by side · a fictional form
A form with this conflict
Box ticked
Ulcerative colitis
Code written
K50.90
What each code means
K50.90
Crohn's disease, unspecified, without complications
K51.90
Ulcerative colitis, unspecified, without complications
So a form with the ulcerative colitis box ticked and K50.90 written has a contradiction anyone can see. What it does not have is a right answer the hub can pick. Perhaps the box is wrong. Perhaps the code is. The chart note may lean one way, and the decision still belongs to the doctor. The checker's job is to show the conflict and send it back to the office.
Check digits and form versions can run alone; a representative's authority and any consent question go to a person
Our placement of common intake checks, from the rules above. The horizontal axis is how far a rule settles the answer.
Cost of a wrong call →
A person decides
A person confirms
Spot check
Automate
RepresentativeSignature presentConsent questionMember ID vs cardCode vs boxNPI in registryForm versionNPI check digit
Member IDs, form versions and the checks that look easier than they are
A printed card and a handwritten form usually disagree because someone copied it badly, so the printed card is usually right. Yet family members carry different suffixes, and people change plans; the card in the chart may be last year's. Showing both values to a person costs seconds and avoids silently overwriting what a doctor's office wrote.
Form versions are easier. Every form carries a code in its footer, and a maker retires old ones when wording changes. A hub decides how long to accept an old version; there is no federal rule on the length of that window.
Matching a reply to the right case is harder than it sounds. An office's return fax may carry nothing but a signed page. Good practice is two identifiers, such as the office's fax number and the patient's date of birth, and never a name alone: two patients at one practice can share a name.
07 · Where the errors come from
How often people mistype a hub form, and which gaps send a packet back to the office
In shortNo public study measures error rates at hub intake. The closest evidence, from clinical research data, puts careful single keying near 3 errors per 1,000 fields. Most returned forms have a different cause: something was never written at all.
Two kinds of failure share this desk. Keying errors are ones the hub makes: a transposed digit, a date in the wrong box. Gaps are ones the office makes: a blank line, a missing card. The evidence for each is thin.
For keying, the best synthesis we found covers clinical research, not hubs: a 2025 meta-analysis of 93 papers published from 1978 to 2008. Single data entry had a pooled error rate of 0.29% of fields, double entry 0.14%, optical scanning 0.74%, and abstraction, reading values from medical records by hand, 6.57%.20 Hub intake sits somewhere between keying and abstraction, since a person both reads handwriting and decides what it means.
Reading from a record by hand was about 23 times as error-prone as single keying in clinical research
Pooled error rate per field, 93 papers published 1978 to 2008. Clinical research data, used here as the nearest available comparison.
To see what those rates mean, take the sample hub in this guide: 31 fields a form and about 10,000 forms a month. At the single-keying rate that is 10,050 × 31 × 0.29%, about 900 wrong fields a month; at the double-entry rate, about 440. These are illustrations carried over from another field. A form read from handwriting could do worse. Your own second-reader sample would tell you more than either.
Authorization, prescriber signature, cards: what the sample hub chases
For gaps, the published evidence is one vendor's 62% for missing authorization, and it comes without a method.4
One vendor says 62 in 100 hub enrollments arrive without a HIPAA authorization
62 in 100
hub enrollments submitted without HIPAA authorization, in a sponsored 2021 post by a hub technology vendor. No study or dataset is named. Treat it as a claim to test against your own forms.
hub enrollments submitted without HIPAA authorization, in a sponsored 2021 post by a hub technology vendor. No study or dataset is named. Treat it as a claim to test against your own forms.
62 of 100
Inside this guide's fictional hub, 39% of forms arrived needing something. The chart shows its counts for one week. Your own order may differ, and finding it takes an afternoon with a sample of fax-backs.
In the sample hub the patient's signature causes more chasing than any other gap
Items missing or needing confirmation, one week, 1,980 forms. Fictional hub data, for scale and order only.
Patient authorization unsigned214
Prescriber signature missing131
Insurance cards not attached118
ICD-10 code does not match the box64
Member ID differs from the card59
No mobile phone or email41
Old form version33
Representative relationship missing19
Fictional example from this guide
Show the numbers
Item
Value
Patient authorization unsigned
214
Prescriber signature missing
131
Insurance cards not attached
118
ICD-10 code does not match the box
64
Member ID differs from the card
59
No mobile phone or email
41
Old form version
33
Representative relationship missing
19
Why an office keeps leaving the same line blank
Gaps cluster by office, and the causes are mundane. The medical assistant faxes the form from the exam room and the patient signs at check-out, an hour later, if at all. A new front-desk hire uses the old form stored on the shared drive. The prior authorization coordinator knows the card is in the system and sees no reason to copy it.
Chasing these one at a time treats each gap as a surprise. A note to that one office, with that office's own counts, fixes the cause, and intake leads who keep those counts know exactly which office to call.
08 · What a delay means
How long an incomplete enrollment form holds up a specialty patient, and how little of that is measured
In shortPublished day counts come mainly from vendors and describe different things, so read them as signals. We found no independent study of how much delay hub intake itself causes. Measure yours.
The published figures on delay need their labels. A 2024 sponsored post by a hub vendor says manual enrollment, including faxing forms to the hub, can "delay patient access by an average of 14 days", and reports one case where speed to therapy went from 12.2 days to 3.7 with digital intake, with no method given.21 A 2019 sponsored post reports a two-month pilot of about 1,250 patients in which providers completed enrollment forms 92% of the time, 48% of those electronically.22
The one peer-reviewed number close to this subject is on prior authorization, a later step. Among 190 children with inflammatory bowel disease (IBD) at one hospital, the median time from a doctor's recommendation to the first dose of a biologic, a medicine made from natural sources such as human or animal cells or microorganisms, was 21 days, and a prior authorization was associated with about 10.2 more days.23
The same study linked prior authorization to more hospitalizations, surgeries or emergency visits for the disease within 180 days. It shows that days matter in this disease. It does not isolate intake.
Published day counts around enrollment measure different things, so none of them is your benchmark
Each bar is from a different setting. The first two are peer-reviewed; the others are vendor statements.
Recommendation to first dose, children with IBD, median21 days
Associated with a prior authorization, same study10.2 days
Manual enrollment delay, vendor's average14 days
Speed to therapy before digital intake, one vendor case12.2 days
Speed to therapy after digital intake, same case3.7 days
Authorization-first hub policy, vendor's upper figure, business days5 days
Recommendation to first dose, children with IBD, median
21 days
Associated with a prior authorization, same study
10.2 days
Manual enrollment delay, vendor's average
14 days
Speed to therapy before digital intake, one vendor case
12.2 days
Speed to therapy after digital intake, same case
3.7 days
Authorization-first hub policy, vendor's upper figure, business days
5 days
What a day's delay means to a hub and to a patient
A patient whose disease has flared and who has been told a new drug is coming experiences the hub's silence as the drug being late. The office experiences it as a form it believes it sent on Tuesday. And for the hub, each return trip is the same packet handled twice.
The time is easier to see at the two ends than in the middle, so most hubs can quote their case-opened time and few can say how many hours their forms spend waiting in the fax queue or waiting on the office. Those are two different problems with two different fixes.
09 · Why fax survives
Why specialty hub enrollment still runs on fax in 2026
In shortFax has fallen slowly and stays common, and hubs must take whatever an office can send. Electronic enrollment helps on the offices that adopt it. Any plan that assumes fax will soon vanish will go on keying.
Federal survey data give the clearest picture available. Hospitals using fax at all to exchange records fell only from 71% in 2018 to 67% in 2023, and those using it "often" from 40% to 30%.24 We read those figures in a trade report on the federal data. Among office-based physicians, the population that fills in hub forms, 35% used only fax, mail or e-fax to share information with outside providers in 2019, the latest physician figure we could find; we read excerpts of that federal brief.25
Hospital fax use fell only four points in five years
Share of US hospitals using fax to exchange records with outside organizations
of office-based physicians used only fax, mail or e-fax with outside providers, 2019.25
ONC Data Brief 59
55%
of US net manufacturer revenue came from specialty medicines in IQVIA's 2022 report, up from 28% in 2011, the latest share we could read.26
Trade summary of IQVIA; we did not read the report
67%
of hospitals still used fax in 2023 to exchange records.24
ASTP/ONC, via trade report
What electronic enrollment changes, and where it stops
An electronic form built to refuse blanks cannot be sent with a required field empty, and it can start from what the prescribing system already holds. Vendors in this market report good results on their own data, which is why Part C asks you to measure.
The limit is reach: only the offices that use a given network or portal get the benefit, patients who have not signed still have not signed, and a hub serving thousands of offices will keep a fax line open. The practical question is what a fax is worth to you once a machine can read it.
We could verify no public figure for the size of the hub services market or the number of forms US hubs process each year. To size your own, count fax pages per day for a week and add your electronic channels.
10 · Plain language and the reader
Reading grade 18 on a patient's form: what a 2026 study found in manufacturer authorizations
In shortThe rule requires plain language. A May 2026 study of three insulin assistance programs found none met an eighth-grade reading level, and all three ended assistance if the patient withdrew permission. A hub reading forms cannot fix this, but the people who own the form can.
The study looked at public materials for three makers' insulin assistance programs, covering 23 products.9 All three required permission to use and share health information, all three let practitioners, pharmacies and insurers disclose to the maker, and all three included diagnoses and prescriptions. Two of the three let the data support internal analytics. Research and marketing use appeared only as optional choices, each in one program. The median reading grade was 18.1, which the authors describe as graduate level.
Three manufacturer forms read at grade 18, far above the grade 8 the authors used as a yardstick
Flesch-Kincaid grade level, median of three insulin assistance programs. A small sample, and assistance programs rather than hubs in general.
Revocation is the sharper point. All three programs allowed patients to revoke, and all three ended assistance when they did. The rule's wording on conditioning binds covered entities, so a maker outside that definition is on different ground, and the authors argue withdrawal is "limited or impossible" in practice.9,1 Keep two things separate when you read this: the study covers assistance programs, where free drug is at stake; and hub enrollment forms may differ. Ask what your form says will happen if a patient says no.
For intake, the practical lesson is narrow. If a patient asks the office what the form means, or crosses out a sentence, that form needs a person. And when the people who own the form next revise it, they should test its reading level against the rule's plain-language requirement.
11 · What goes wrong
False statements, kickback exposure and misdirected faxes: the risks that sit behind an enrollment form
In shortA hub must carry what the doctor wrote, unaltered. Filling in a clinical value is how support staff get into trouble. Other risks come from what the hub gives away for free, and from a fax that reaches the wrong office.
The clearest warning comes from a neighboring activity. In November 2021 Kaléo agreed to pay $12.7 million to resolve allegations that it caused false claims for an overdose drug. The government alleged that preferred pharmacies submitted prior authorization requests that misrepresented who submitted them or carried false statements about patients' histories. The release says these are allegations only, with no determination of liability, and the conduct involved pharmacies and prior authorization.27
Its lesson for hub intake is simple: staff do not supply, tidy or infer a clinical fact on an office's behalf. If a code and a box disagree, the office decides.
The second risk is what the service is worth. The HHS Office of Inspector General (OIG) issues guidance for drug makers. It says that support services with no substantial independent value to the purchaser may not implicate the Anti-Kickback Statute, the federal law against paying for referrals of care that federal health programs cover, standing alone. Tied to something that benefits a referring provider, such as a reimbursement guarantee, the same limited reimbursement support would raise kickback concerns.28
That guidance dates from May 2003. OIG's compliance page, read November 3, 2026, keeps it in an archive and lists no newer guidance written for drug makers. Intake rarely decides these arrangements, but it does see them on the form: a free-drug "quick start" box and any promise to a practice belong to people who can judge them.
A reply matched to the wrong patient and a filled-in clinical value carry the highest stakes at intake
Our grading of intake failures. Use it to choose what a person always reviews.
LowMediumHigh
PatientPrivacyLegalCostStaff fill in a clinical valueHighLowHighMediumFax-back goes to the wrong officeMediumHighHighLowReply matched to the wrong patientHighHighHighMediumOutreach with an invalid authorizationLowHighHighLowText sent with no signed consentLowMediumHighLowMember ID keyed wrongMediumLowLowMediumForm version out of dateLowMediumMediumLow
Misdirected faxes and matching a return page to the right patient
A fax-back carries a patient's name and a birth date to a number someone typed. The usual controls are few: confirm the number against the office record, send only what the office needs to act, and keep a record of who approved the send. On the way back in, match the reply as section 6 describes. Most of these are ordinary care with a fax machine; the difference at volume is that a hub does it thousands of times a week.
Security rules for a system that stores faxes
Whichever way HIPAA reaches you, a hub's document store will hold names, diagnoses and insurance numbers. The January 2025 proposal to rewrite the HIPAA Security Rule remains a proposal, with the federal agenda listing final action for July 2027.17 The rule in force stays the baseline for covered entities and business associates, and a hub should ask its vendors the same questions either way (section 21).
12 · What AI changes
Reading handwriting by machine: how far form software has come, and what regulators say about AI at an intake desk
In shortNo regulator has written rules for AI at a hub's intake desk that we could find. General privacy rules apply as they do to any vendor. FDA's AI draft addresses regulatory decisions on drugs, and the draft EU manufacturing annex addresses critical manufacturing, so neither is aimed here.
Older form-reading software matched templates: it found a box at fixed coordinates and read the characters inside. It works on clean typed electronic forms and fails on a skewed fax with handwriting. Newer models read a page more as a person does, finding the field by its label and reading cursive with a confidence score, a measure of how sure the software is of each read.
We could find no published benchmark of handwriting on hub forms, so test on your own forms and score field by field. Treat any vendor's claim of a single accuracy number as a place to start asking.
Instrument
Status on November 3, 2026
Reach at a hub's intake desk
HIPAA Privacy Rule
In force
Applies by role, whatever software is used. A vendor acting for a covered entity can be a business associate.2
HIPAA Security Rule rewrite
Proposed, 90 FR 898; final action listed for July 2027
Covers AI that produces information for regulatory decisions on drugs and biologics. By our reading, reading a hub's forms falls outside that purpose.29
Draft EU GMP Annex 22
Draft, consulted July 7 to October 7, 2025; not in EudraLex Volume 4
Addresses critical manufacturing uses. Does not reach US patient services.30
EU AI Act
Regulation (EU) 2026/1744 moved Annex III high-risk rules to December 2, 2027
This guide covers US hubs. A program in Europe has its own privacy and AI analysis, and its own form.31
The sensible limits follow from the work itself. Software reads, compares and drafts. It should never write a value that is not on the page, because that is the conduct in section 11. It should mark what it is unsure of, because a confident wrong digit is worse than a flagged one. And it should stop at anything that calls for judgment: a representative's authority, a crossed-out sentence, a consent question. A person answers for what leaves the building.
One practical check is the vendor's handling of the data itself. Where the page images go, whether they train a model, and who can see them are ordinary questions, and their answers belong in a contract before a single real form is loaded.
13 · How teams do it today
Who works an enrollment fax today, and where a form's 12.5 hours go
In shortA form moves through a fax queue, a keyer, a checker, an office and a case manager, and most of its time goes on waiting. Hubs run this in house, through a contractor or with software, and many combine them.
Intake specialist, team lead, privacy lead, case manager, office coordinator: who touches a form
IS
Intake specialist
Splits the packet, keys fields, checks the form, calls the office.
Cares about: not keying 31 fields to learn that a signature is missing.
TL
Intake team lead
Owns each form until it becomes a case, and approves what goes back to offices.
Cares about: the queue at 9 a.m., and knowing which offices cause it.
PL
Privacy lead
Owns consent and masking rules, and decides the unusual signature.
Cares about: nobody calling a patient on a form that was never valid.
CM
Case manager
Receives the opened case and starts benefits verification.
Cares about: finding out on the first call, rather than the fifth, that the member ID was wrong.
OC
Office coordinator
Faxes forms between patients, and gets the calls when something is missing.
Cares about: one clear request, instead of three separate calls about one patient.
Fax line to open case: the steps and the hand-offs at a typical hub
A form passes through three people, and an incomplete one goes around again
An illustrative process, with an illustrative elapsed time at a busy hub. Replace it with your own.
1Split and index
Fax server output is sorted by patient and document type.
Intake specialist4 hours in queue
2Key the fields
31 fields typed into the hub's system.
Intake specialist3 hours elapsed
3Check against form rules
Signatures, consent, codes, version.
Intake specialist2 hours elapsed
4Compare the card
Card against form, field by field.
Intake specialist1 hour elapsed
5Ask the office
A fax or a call for each gap. Then the wait.
Team lead, office coordinator1.5 hours, then the office's reply
6Open the case
Status, timers and hand-off to a case manager.
Team lead1 hour elapsed
Illustrative · replace with your own numbers
Show the numbers
Step
What happens
Who
Time
Split and index
Fax server output is sorted by patient and document type.
Intake specialist
4 hours in queue
Key the fields
31 fields typed into the hub's system.
Intake specialist
3 hours elapsed
Check against form rules
Signatures, consent, codes, version.
Intake specialist
2 hours elapsed
Compare the card
Card against form, field by field.
Intake specialist
1 hour elapsed
Ask the office
A fax or a call for each gap. Then the wait.
Team lead, office coordinator
1.5 hours, then the office's reply
Open the case
Status, timers and hand-off to a case manager.
Team lead
1 hour elapsed
Fax, eForm, e-signature, portal: how a sample week of forms arrives
The fictional hub in this guide takes most of its forms by fax, on weekdays. The numbers are invented for scale. Your fax server can give you the real ones in minutes.
Fax carries nearly two of every three forms in the sample hub
64%by fax
Fax64%
eForm21%
e-signature9%
Portal6%
Fictional example from this guide
Show the numbers
Part
Value
Fax
64%
eForm
21%
e-signature
9%
Portal
6%
Forms bunch on weekdays, at about 400 or more a day against under 100 on a weekend
Forms received per day, Thursday through Tuesday, in the sample hub
431Thu
448Fri
96Sat
71Sun
402Mon
414Tue
Fictional example from this guide
Show the numbers
Period
Value
Thu
431
Fri
448
Sat
96
Sun
71
Mon
402
Tue
414
In house, a contracted hub, or software on either: the three ways hubs run intake
Some makers staff intake themselves, usually when they have one or two brands and want close contact with offices. Others contract a hub services company, which brings staff, a case system and a fax line, and which may also run pharmacy or field teams. Either kind can add software, from a fax server's indexing tool to electronic enrollment networks to document reading. Each choice moves work around. A maker that outsources still owns the form and the privacy design, so it should see the same numbers its contractor does.
Part B · See it working
Marisol's enrollment on Botminds Hub Enrollment Form Processing, screen by screen
The same fictional case as the opening, from the fax line to an open case, followed by the screens an intake lead uses every day. Every person, office, plan and number on these screens is invented.
14 · The fax arrives
A six-page Veltrimab fax from Wrenfield Gastroenterology becomes a cited patient record
In shortSix software agents, each with one job, split the packet, read 31 fields with their page and box, and run the brand's 15 form rules. Dana Okafor, the intake team lead, sees the blank authorization boxed in red and a request already drafted, and nothing has gone out.
How to read these screens. The sample plays through in one sitting, so its clock barely moves: the office's reply shows the same minute as the request. In real use an office's reply takes as long as it takes. The form's wording is the product's sample text, written for this demonstration, and is no model for your own form; section 4 gives the rule's real elements.
1
Page on the left, record on the right
At 7:42 am the fax arrives on line 2. Each read field is boxed on the page and listed in the record with a confidence score and a page chip. Click a row and its box lights up, click a box and its row lights up. Three of the 31 fields were read below 90%. Marisol's Social Security number, on the office's demographic sheet, was masked on arrival.
Incoming forms. The authorization and date are empty, so both rows show red. The sample's text-consent row reads as ticked; outreach stays locked until the signature line is filled, which is also when a written consent has a signature at all (section 5).
2
The office's usual gap, checked first
Before reading anything else the agents look at the line this office tends to miss. Wrenfield sent 64 forms in 30 days, 48% complete on arrival against 58% for the network, and left the patient authorization unsigned on 21. Today's form repeats that gap, and two others.
This office usually leaves out. Counts from the office's own 30 days of forms, with the fax-back draft waiting below for Dana.
3
A draft request, held until Dana decides
The Office Request Writer has already written to Rosa Dellamar, the coordinator at Wrenfield: patient signature and date, page 1, section 2, with the page attached and the line marked, and a reminder to black out Social Security numbers before faxing. It cannot go yet, since two items need Dana's decision.
The fax-back, previewed. It names only the patient's first name and last initial, the date of birth and the case number, and two items hold it back.
4
Twelve of 15 rules pass, and one blocks the case
In form review, the Completeness Checker has run the Veltrimab rules. The blank authorization blocks the case and goes in the request. Two more need Dana. A banner keeps patient outreach locked, by this hub's rule: until the signature arrives, nobody contacts Marisol.
Form review. The left rail lists the six pages by document type. That "no health information goes to the program" line is the sample hub's rule; the form itself has already arrived, as section 3 explains. Your privacy lead sets the rule for your hub.
15 · Two decisions and a fax
A Crohn's code on an ulcerative colitis form, two swapped digits, and one fax to the office
In shortDana asks the office to confirm its own code, takes the printed card's member ID and approves one request with two items. The case opens as Pending info, follow-up timers start, and outreach stays locked.
5
Evidence side by side, with the decision left to Dana
The ulcerative colitis box is ticked, but K50.90, a Crohn's disease code, is written. The prescription line and chart note both describe ulcerative colitis. The agents do not correct it; the screen says this is a form check and the office confirms its own code. The member ID reads NWH 4417 2093 on the form, at 78% confidence, and NWH 4471 2093 on the printed card, at 99%.
Decisions with their evidence. Handwriting beside print. Dana chooses, and the form's value stays on the record alongside her choice.
6
The request, down to two items
Dana's first decision adds the code question to the letter. Her second settles the member ID, so it stays out. The letter now asks for two things and names each page and section. She can edit the wording, and she approves it. Her name and the time go on the record.
The office request. Thirteen of 15 checks now pass. The note under the letter says what is attached, and that no insurance number or code goes beyond what is asked.
7
Sent, with the follow-up already set
The request is faxed to (312) 555-0148 and the case opens in the hub system as Pending info. The sample hub's timers run from there: a call to the office at 24 hours, a second request with an e-signature link at 48 hours, and close as incomplete at day 10.
Waiting on the office. Outreach is still locked, and the timeline shows each step to come.
16 · The reply and the open case
The signed page comes back, matches itself to ENR-24817, and the case goes to benefits verification
In shortThe reply is matched on two identifiers, and all 15 checks pass. Dana confirms two low-confidence handwritten fields and opens the case, and Sam Patel, the case manager, takes it from there.
8
Two identifiers, never a name alone
Wrenfield's one-page reply is matched on the office's fax number and Marisol's date of birth. She has signed and dated. Dr. Novak confirms ulcerative colitis, K51.90: "K50.90 was written in error." Every check passes, and by this hub's rule it may now contact Marisol by phone and text.
The reply, matched. The reply appears in the packet as page 7, and the fixed items are marked as fixed by the office.
9
A person opens the case
Two handwritten fields were read below 90%: the date of diagnosis and the TB test. Dana checks each against its box on the page and confirms it. Then she opens the case, and the cited fields are written to the hub system.
The case opened. It goes to Sam Patel for benefits verification with Harborline Health Plan, a fictional plan.
10
Every step on the record
The Activity tab lists each step with its time: what each agent read, what Dana decided, what was sent and what came back. A privacy lead who is asked about one form on one day opens this tab.
Activity. AI marks an agent step and DO marks Dana Okafor, so a reader can see who did what.
17 · The rest of the intake line
Inbox, office coaching, dashboard, form rules: running intake across three brands
In shortBeyond a single case, the screens show every packet's status, how each office is doing and why, and the rules each form runs. Six agents do the reading and drafting. A person approves every request and every case.
Inbox. Every packet with its brand and form version, office, channel, status, stage and what is still open. Complete ones can be opened as cases together.
An NPI that fails. On a different case, a handwritten number with its last two digits swapped, beside the registry's match. Both numbers are made up. Dana can take the registry's number or ask the office.
Masked on arrival. The demographic sheet, with the number blacked out before anyone sees the page.
Offices. Ranked by how often a form arrives complete, lowest first, each with its most frequent gap.
A coaching note. Drafted from the office's own 30 days: sign section 2 at check-in, attach both sides of the card, check the code against the box. Nothing goes until a person approves it.
Dashboard. Sample figures from a fictional hub. Median receipt to case reads as a design goal here, and "keying time saved" is an estimate at about 10 minutes a form.
Form rules. Each brand form version has its own list, each rule says where it applies and what a failure does. New or changed rules go live after the privacy lead approves them, and can be tried on past forms first.
Settings. The confidence threshold, the people who approve, and the follow-up timers.
Wrenfield sits near the bottom of the sample hub's offices, and its usual gap is one signature
Forms complete on arrival, last 30 days, fictional offices. Network 58%.
Cobbett Dermatology86%
Northgate Skin Clinic82%
Tallgrove Dermatology76%
Coastal IBD Center70%
Larkmoor Digestive Health64%
Alderpeak Rheumatology51%
Wrenfield Gastroenterology48%
Riverbend Arthritis Center42%
Fictional example from this guide
Show the numbers
Item
Value
Cobbett Dermatology
86%
Northgate Skin Clinic
82%
Tallgrove Dermatology
76%
Coastal IBD Center
70%
Larkmoor Digestive Health
64%
Alderpeak Rheumatology
51%
Wrenfield Gastroenterology
48%
Riverbend Arthritis Center
42%
Packet Sorter to Case Opener: the six agents, and what each never does
Packet Sorter
Splits each fax or upload into its documents and matches an office's reply to the open case.
Never matches a patient on a name alone; a reply needs two identifiers.
Form Reader
Reads typed and handwritten fields, with the page, section, box and a confidence for each value.
Never infers a value that is not written. Below the threshold, a person confirms.
Insurance Card Reader
Reads payer, member ID, group, BIN, PCN and Rx group from both sides of the card and compares them with the form.
Never overwrites the form's value silently. A person sees both.
Completeness Checker
Runs each brand form's rules: required fields, signatures, consent, code against box, NPI check digit, form version. It looks at the office's usual gap first.
Never makes a clinical judgment. It checks the form against its own rules.
Office Request Writer
Drafts the fax to the office in plain words, with page and section, and drafts coaching notes.
Never sends on its own. A person approves every request, and letters give no clinical advice.
Case Opener
Writes confirmed fields and citations to the hub system, sets the status and timers, and assigns the case manager.
Never opens a case before a person approves. Outreach stays locked until the authorization is signed.
Dana signs the requests and cases, Omar owns consent and rule changes
Approves and opensIntake team leadDecides flagged fields, approves each request and opens each case. Dana Okafor in this example.
Reviews packetsIntake specialistsWork the inbox, call offices and confirm fields read below the threshold. Lena Ortiz in this example.
Decides consentPrivacy leadOwns representative signatures, masking and every rule change. Omar Haddad in this example.
Takes the caseCase managerStarts benefits verification from a complete, cited case. Sam Patel in this example.
In the sample settings two people's duties stay separate: the person who approves a fax does not change the rules that drove it. Whether a complete form may ever open with no person is a setting your privacy lead and team lead decide; on the sample hub a person opens every case.
Botminds is SOC 2 Type II audited and manages information security to ISO 27001. Its roles, approvals and audit trail are controls that support your compliance. Whether your hub meets HIPAA, the phone rules and state law is decided by your role, contracts, policies and conduct.
Faxes, eForms and cards go in; a cited case and one request come out
Every channel
Faxed and scanned forms, as PDF or TIFF
eForms and portal submissions
E-signature returns
What comes with a form
Prescriptions
Insurance card images, front and back
Demographic sheets and chart notes
Agents read, check and draftEvery form, against each brand's own rules
A person approves every request and case
Every value cites its page and box
Outputs
A cited patient case in the hub system
A completeness verdict with reasons
One request to the office, drafted
Follow-up timers and an intake dashboard
Design targets
38 minutes, median, from a complete form to an open case
92% of cases opened the day the form arrives
330 hours of keying saved a week at 1,980 forms, an estimate at about 10 minutes a form
Design targets are the solution's goals, to be measured in your own deployment. They are not results from a customer.
The design goal takes a form from about 12.5 hours to under one, mostly by removing the queue
Estimated elapsed hours for one form at a busy hub, by hand and as designed. Queue time and one request to the office included; the office's reply left out. An estimate, to be replaced by your own measurement.
By hand, estimatedAs designed, estimated
Waiting in the fax queue4 h0.1 h
Keying 31 fields3 h0.1 h
Checking signatures, consent, codes, version2 h0.1 h
Writing and faxing the request1.5 h0.1 h
Comparing the card with the form1 h0.05 h
Opening the case and setting follow-up1 h0.2 h
Illustrative · replace with your own numbers
Show the numbers
By hand, estimated
As designed, estimated
Waiting in the fax queue
4 h
0.1 h
Keying 31 fields
3 h
0.1 h
Checking signatures, consent, codes, version
2 h
0.1 h
Writing and faxing the request
1.5 h
0.1 h
Comparing the card with the form
1 h
0.05 h
Opening the case and setting follow-up
1 h
0.2 h
Fax server, hub system, e-signature: the systems it connects to
It connects by category: the inbound fax server, your eForm and portal channels, an e-signature service for signing links, and the hub or case management system where cases and timers live. The NPI registry and ICD-10-CM lookups support the checks. Anyone with access can ask about a form, an office or a rule in plain words, and each answer points to the page it came from.
Part C · Are you ready to automate?
Should your hub automate enrollment intake? The costs, the return and the questions
Written to you, the person who owns the intake line. It asks you to count your own forms before believing anyone's numbers, ours included.
18 · What a chased form costs you
Hours keyed and forms chased: what enrollment intake costs your hub, and how to count it in a week
In shortThere is no public cost per enrollment form. The hours are easy to count, while the larger costs sit in patients who start late and in cases that fail further down the line. A week with your fax server and a sample of fax-backs will give you real numbers.
62%
of hub enrollments arrive without HIPAA authorization, one vendor says. It gives no method, so test it on your own forms.4
Vendor statement, 2021
4–5
business days a hub policy of authorization first can add before benefits work starts, the same vendor says.4
Vendor statement, 2021
10.2 days
more to a biologic's first dose were associated with prior authorization among 190 children with IBD at one hospital. That step comes later than intake, and the figure shows why days matter.23
Peer-reviewed, 2022
On an illustrative form, the queue, keying and checking take about three-quarters of 12.5 hours
Elapsed hours from fax to open case by hand, with queue time and one request to the office, and the office's reply left out. An estimate for one busy hub. Use your own.
Waiting in the fax queueKeying and checkingCard, request and opening
By hand4 h5 h3.5 h
Illustrative · replace with your own numbers
Show the numbers
Waiting in the fax queue
Keying and checking
Card, request and opening
By hand
4 h
5 h
3.5 h
Keying hours, office replies, rework: how to find each figure for your hub
Cost
Where it hides
How to find your number in a week
Keying time
Inside the intake team's day, seldom timed
Time 30 forms with a stopwatch. Multiply by your monthly forms.
Forms that return
Fax-backs in the outbound log
Fax-backs sent ÷ forms received. Pull 100 and tally the gap on each.
The office's reply time
Between the outbound and inbound fax logs
Median hours from request to matched reply, for those 100.
Queue time before anyone reads
Fax server timestamps against first touch
Compare received and first-opened times across a week, by hour.
Wrong values reaching the case
Corrections made by benefits specialists
Have a second reader re-key 50 opened cases. Count differences field by field.
Forms abandoned
Cases closed as incomplete
Closed-incomplete ÷ received, by office and brand.
What late starts and wrong member IDs cost beyond the keying
The patient who gave upA form that sits unsigned for ten days may close with no one having spoken to the patient. Nothing in your keying numbers shows that person.
The wrong first callA case manager who calls a plan with a transposed ID loses the call and often the morning. That cost lands in benefits verification, where nobody blames intake.
The office's patienceThree calls about one patient teach an office that your brand is hard work. That cost appears in no report.
A privacy findingOne fax to the wrong number takes hours of your privacy team's time, whatever the eventual outcome.
19 · Your return
Your hours back on 120,000 enrollment forms a year: the levers and a calculator
In shortThe return comes from reading time, fewer minutes per chase and earlier case opening. The calculator counts the first two, in hours and dollars, and leaves the rest to your judgment. Every default is illustrative.
Reading, chasing and the office's own habits: where hub intake pays back
Reading time
Fields you stop keying
A person confirms what was read below a confidence threshold, in place of typing every field.
forms × (keying minutes − review minutes) ÷ 60
Chasing time
A drafted request for every gap
The gap is found before keying, and the request is drafted with its page and line.
A note built from an office's own counts changes what that office sends. Measure it office by office.
points of complete-on-arrival gained ÷ 100 × forms × minutes per chase ÷ 60
Speed
Cases opened the day the form arrives
Queue time falls first. Its value is to the patient and the brand, so report it in hours.
median hours from fax to open case, before and after
Hours, dollars and months to pay back: the sums for your intake line
Your volumeYour minutesYour costs
Illustrative yearly value
Keying hours saved0
Chasing hours saved0
Time saved, valued$0
After the yearly cost$0
Months of savings to cover a year's cost0
Keying hours = forms × (minutes today − minutes after) ÷ 60. Chasing hours = forms × share incomplete × (minutes today − minutes after) ÷ 60. Value = hours × loaded cost. After the yearly cost = value − yearly cost. Months = yearly cost ÷ (value ÷ 12), with a dash when there is no saving. The 120,000 forms, the 39% and the 10 minutes come from the fictional hub in this guide; none is a benchmark. Hours saved are only money if you redeploy the people or avoid a hire.
20 · Is your hub ready?
Is your intake line ready? Eight scored questions on forms, consent and offices
In shortAnswer each from 0 to 2. The ninth is for reflection and takes no score. Nothing you choose leaves this page.
1
The packets you can reach
Can you pull a year of faxes and electronic forms, with their replies, for one brand?
Why it mattersA test needs real handwriting and real gaps. Clean samples prove nothing.
A strong answer"Yes, from the fax server, linked to case numbers."
2
Each brand's form rules in writing
Is every rule for each form version written down, with what happens when it fails?
Why it mattersA machine runs what you can state. Unwritten rules live in your best specialist's head.
A strong answer"Each version has a rule list, with an owner, and a date."
3
Your policy on a blank authorization
Has counsel set what your hub does when the authorization is blank, by brand and arrangement?
Why it mattersSoftware will enforce whatever you decide. Decide it first (section 3).
A strong answer"Written, signed by privacy, and it says who may be contacted when."
4
Text consent from form to phone
Does a signed consent, and any "stop" reply, reach the system that sends your texts?
Why it mattersA revocation must be honored within ten business days.3
A strong answer"Consent is recorded with its source page, and stop replies update it the same day."
5
Your baseline numbers
Do you know your minutes per form, share incomplete, reply time and top gaps by office?
Why it mattersWithout a baseline, any pilot result is an opinion.
A strong answer"All four, by brand, from the last quarter."
6
A hub system you can write to
Can new software create and update cases through an interface your hub system supports?
Why it mattersA reader that leaves people re-keying into the hub system saves less than it should.
A strong answer"Yes, with an API and a test environment."
7
Your role under HIPAA, written down
For each flow of data, do you know who is a covered entity, a business associate or neither, and is a contract in place?
Why it mattersA new vendor reading page images joins that chain, and your contracts must say so.
A strong answer"A data map, reviewed this year, with each agreement named."
8
Someone who owns the office relationship
Is one person responsible for each office's gaps, with time to call and coach?
Why it mattersFaster reading moves the bottleneck to the office. The next gain comes from coaching.
A strong answer"Team leads own a list of offices, reviewed monthly."
9
The office you would call first
For reflection only, with no score. Which office sends you the most incomplete forms, what does it keep leaving blank, and when did anyone last tell it?
What a score of 0–6, 7–11 or 12–16 asks of your intake team
0–6
Explore
Time 30 forms, tally 100 fax-backs and get your blank-authorization policy written. Software would only speed up an undecided process.
7–11
Ready to pilot
Run a measured pilot on past packets from one brand, read blind against a person, with known gaps planted, before any live form.
12–16
Ready to implement
Plan all brands and channels, connect the hub system and put office coaching into a named role.
21 · Questions for any vendor
What to ask any vendor about reading hub enrollment forms, including us
In shortAsk about your handwriting, your consent policy, your data and your audit. A good vendor can answer each on your own packets. Ask us the same.
A
Can it read our faxes and tell us when it cannot?
A1
What is your accuracy on my handwritten fields, field by field, on my own past faxes?
Why it mattersNo public benchmark exists for this work that we could find. Only your forms can answer.
Strong answer · warning signA blind test with field-level scores · one overall percentage.
A2
What happens to a value below your confidence threshold, and can I set the threshold?
Why it mattersThe errors you worry about most are confident wrong digits.
Strong answer · warning signIt goes to a named person, and thresholds are yours · "it learns".
A3
Will it ever write a value that is not on the page?
Why it mattersFilling in a clinical fact is the conduct in section 11.
Strong answer · warning signNever, and every field cites its page and box · "it infers from the chart note".
A4
How do you keep two patients in one fax apart, and match a reply to the right case?
Why it mattersA wrong match is a privacy event.
Strong answer · warning signTwo identifiers, and a person for anything uncertain · matching on name.
B
Does it follow our consent rules, and show its work?
B1
Show me how a blank authorization changes what the system will and will not do.
Why it mattersYour policy has to be enforced by the software, in writing.
Strong answer · warning signA lock your privacy lead controls · a flag someone may ignore.
B2
How is text consent recorded, and how does a "stop" reach it?
Why it mattersThe ten-business-day clock runs from receipt.3
Strong answer · warning signSource page, date, and a tested route for opt-outs · "that's your texting vendor".
B3
What does the audit trail show me for one form, and can I export it?
Why it mattersYour privacy team will ask for exactly one form, one day.
Strong answer · warning signEvery read, correction, approval and send, by name and time · a daily log file.
B4
Who approves a change to a form rule, and can I test it on past forms before it goes live?
Why it mattersA new form version arrives without warning, and a bad rule can stop every form.
Strong answer · warning signA named approver and a replay on past forms · a vendor ticket.
C
Where do the page images go?
C1
Will you sign a business associate agreement where one is required, and what is your role in my data map?
Why it mattersYour counsel has to place a new vendor in the chain (section 3).
Strong answer · warning signA clear answer for each flow · "we're HIPAA certified".
C2
Do page images or corrections train a model that any other customer uses?
Why it mattersThese pages hold diagnoses and insurance numbers.
Strong answer · warning signA contract clause · a statement on a web page.
C3
What happens to a Social Security number on a page you read?
Why it mattersOffices send them, despite the form's request.
Strong answer · warning signMasked on arrival, and no copy kept · "users are trained to ignore it".
C4
Which independent audit reports can I read?
Why it mattersA named report and a scope tell you more than a badge.
Strong answer · warning signA current report you may read under agreement · a logo.
22 · A pilot on past packets
A ten-week pilot on one brand's past enrollment packets, and what to measure
In shortStart with one brand and past packets, compare field by field against a person, plant known gaps, then run live with a person approving every send. Decide on your own numbers.
Ten weeks takes one brand from past packets to a decision
An illustrative plan. Your counsel's review and your hub system's access usually set the pace.
Your teamVendor
Data map and agreements
Baseline: time 30 forms, tally 100 fax-backs
Load form rules for one brand
Blind read of 500 past packets
Score field by field, planted gaps
Live, every send approved by a person
Measure and decide
Week 0246810
Illustrative · replace with your own numbers
Show the numbers
Activity
From
To
Data map and agreements
0
2
Baseline: time 30 forms, tally 100 fax-backs
0
2
Load form rules for one brand
1
3
Blind read of 500 past packets
3
5
Score field by field, planted gaps
4
6
Live, every send approved by a person
6
9
Measure and decide
9
10
Field accuracy, gaps caught, hours from fax to case: what to score
Measure
How
Decide on
Field accuracy
Compare each field to a second reader, separately for typed and handwritten
Where wrong values would hurt: member ID, date of birth, NPI
Gaps caught
Plant 25 known gaps: unsigned, undated, wrong code, old form
Every planted signature gap found. Anything else, you set the bar.
False alarms
Count requests a person rejected as unneeded
An office should not hear about things that are fine.
Fax to open case
Median and 90th percentile, complete forms only, before and after
Against your baseline
Office reply time
Request to matched reply, by office
Whether single, specific requests come back sooner
Rework downstream
Corrections made by benefits staff per 100 cases
Whether it fell, stayed or rose
The working session: nine harder questions for intake, privacy, legal and patient services
Bring your intake lead, privacy officer, counsel and the patient services head into one room.
A
Privacy and consent decisions
A1
For each brand, what may the hub do between a form arriving and an authorization being signed?
Why it mattersThis is your policy, and the software will carry it out.
A2
Does one signature on our form have to cover an authorization, a text consent and anything else, and in which states is that a problem?
Why it mattersCalifornia and the compound authorization rule make this a live question.11,1
A3
What will we do when a patient revokes, and what have we told them will happen?
If reading takes seconds, what do twelve intake specialists do next year?
Why it mattersDecisions, office calls and coaching remain. Plan the roles out loud.
B2
Should a complete form open a case without a person, and who decides?
Why it mattersIt is a real choice, made on evidence, with your privacy lead.
B3
What does a contracted hub owe us in numbers, if it runs this?
Why it mattersYou own the form and the risk, whoever keys it.
C
Offices
C1
What do we tell offices will change?
Why it mattersFaster, more specific requests still land on a busy front desk.
C2
Which offices should move to electronic forms first?
Why it mattersYour office-level gaps tell you where it pays.
C3
Who may send an office a coaching note, and what may it say?
Why it mattersA note from a brand to a prescriber's office needs a look from your compliance team.
23 · Common questions
The HIPAA, text consent, NPI and fax questions people search about hub enrollment forms
In shortShort answers to what intake teams, offices and buyers ask, each of which stands alone.
What is a hub enrollment form?
A hub enrollment form is the form a drug maker prints for a specialty medicine so a doctor's office can sign a patient up for its patient support service. It usually runs two or three pages, with sections for the patient, insurance, diagnosis, prescriber and prescription, plus the patient's authorization and a prescriber signature. Offices send it by fax, electronic form, e-signature or portal.
What is hub enrollment form processing?
It is the desk work of turning an enrollment form into a complete patient case: splitting the packet, reading the fields, checking signatures and consent against the brand's rules, asking the office for anything missing and opening the case for benefits verification. It decides how soon a patient hears from the hub, and whether the next person starts with correct information.
Does a hub enrollment form need a HIPAA authorization?
Most forms include one, because a covered entity such as a doctor's office, plan or pharmacy generally needs a valid authorization to disclose health information for purposes HIPAA does not otherwise permit. Treatment and payment disclosures have their own permission under 45 CFR 164.506(c). Whether a given hub needs a signature before starting work depends on its role and its contracts, and we found no HHS statement that settles it, so ask counsel.
Is a drug manufacturer covered by HIPAA?
A drug maker is not a covered entity simply by being a drug maker: the rule's definition lists health plans, clearinghouses and providers who transmit health information electronically in covered transactions. A maker that also runs something on that list, or a vendor acting for a covered entity, can have duties. That is why an authorization warns that information may no longer be protected once disclosed.
What makes a HIPAA authorization invalid?
Under 45 CFR 164.508(b)(2), an authorization is not valid if its expiration has passed, if it has not been filled out completely with respect to a required element, if it is known to have been revoked, if it breaks the rules on compound authorizations or conditioning, or if material information in it is known to be false. A missing signature or a missing date is an incomplete required element.
Can a patient sign an enrollment form electronically?
Federal law says a signature may not be denied legal effect solely because it is electronic (15 U.S.C. 7001), and the FCC's definition of written consent accepts an electronic signature recognized under federal law or state contract law. Your counsel should check state rules for your form. California, for one, sets its own requirements for medical authorizations.
Does text message consent need a signature?
Prior express written consent, the standard for telemarketing by autodialer or prerecorded voice under 47 CFR 64.1200, is defined as an agreement bearing the signature of the person called. Other messages can fall under a lesser standard or a health care exception. A careful hub treats a ticked box as meaningful only once the form is signed. The Supreme Court's June 2025 McLaughlin decision, a fax case, held that district courts in enforcement cases are not bound by the FCC's reading of the Act, and it did not address texts or consent.
How do you check an NPI on a form?
Run the Luhn check digit formula that CMS publishes, which treats the number as if the prefix 80840 came first, by adding 24 to the sum. A failure usually means a typing slip. Then look the number up in the public NPI Registry to confirm the name and practice. A pass on the check digit alone shows only that the number is well formed.
What should a hub do if the ICD-10 code does not match the diagnosis box?
Ask the office to confirm, and record the answer. K50 is Crohn's disease and K51 is ulcerative colitis, for example, so a K50 code under a ticked ulcerative colitis box is a contradiction anyone can see. The hub should show the conflict, and the prescriber's office should resolve it, because hub staff do not make clinical calls.
Why do doctors' offices still fax enrollment forms?
Fax works with every office and needs no new login. In a federal survey for 2019, 35% of office-based physicians shared information with outside providers only by fax, mail or e-fax, and 67% of hospitals still used fax in 2023. Electronic enrollment helps where offices adopt it, so most hubs run fax and electronic channels side by side.
How long does hub enrollment take?
There is no independent public benchmark for hub intake. Vendors have published figures such as a 14-day delay from manual enrollment, without a method. Measure your own: hours from fax to open case for complete forms, and hours from request to reply for the others. Those are different problems with different fixes.
Can AI read handwritten enrollment forms?
Current document models read many handwritten fields with a confidence score, though no published benchmark on hub forms exists that we could find. Test any tool on your own past faxes, field by field, with a person confirming anything below a threshold. A reader should never write a value that is not on the page.
Does software make a hub HIPAA compliant?
No software can do that on its own. Whether a hub meets its duties depends on its role, contracts, policies, training and conduct. Good software gives you controls that support your compliance: authorization locks, masking, approval records and a full audit trail. Treat any claim of being certified for HIPAA with care, and ask what a named audit report covers.
What is a fax-back in patient services?
A fax-back is the hub's message to a doctor's office listing what is missing or needs confirming on an enrollment form, often with the page to sign and the line marked. A good one asks for everything at once, names the page and section, and carries only what the office needs. A person at the hub should approve it before it goes.
24 · One-page summary
Hub enrollment form processing on one page: the method, the rules and the terms
Print this page
In shortThe guide on one screen, as of November 2026.
The method
Split the packet and match it to a patient on two identifiers.
Check the signature, date and consent lines before keying anything.
Read each field with its page, box and confidence. Never write what is not there.
Run the form's rules: check digit, registry, code against box, card against form, version.
Send one request, with the page and line, approved by a person.
Hold outreach as your policy says until the authorization is valid.
Open the case with timers and a named owner.
Tell each office what it keeps leaving out.
Rules, as of November 3, 2026
45 CFR 164.508: six core elements and three statements. Unchanged since January 2013.
47 CFR 64.1200: stop-word opt-outs within a reasonable time, ten business days at most. "Revoke all" due January 31, 2027.
McLaughlin, June 20, 2025: in enforcement cases, district courts are not bound by the FCC's reading of the Act.
HIPAA Security Rule rewrite: proposed, final action listed for July 2027.
FDA AI guidance: draft, aimed at regulatory decisions on drugs.
State law can add more. California sets its own form.
Terms
Authorization
Signed permission under 45 CFR 164.508 to disclose stated information.
BIN and PCN
Routing numbers on a pharmacy benefit card.
Business associate
One who handles protected information on behalf of a covered entity.
Check digit
The last NPI digit, computed from the rest by the Luhn formula.
Compound authorization
An authorization combined with another document, which the rule limits.
Covered entity
Health plan, clearinghouse or provider transmitting electronically.
Fax-back
A hub's request to an office for what is missing.
Hub
A support service helping patients and offices start a specialty medicine.
ICD-10-CM
The US diagnosis code set.
NPI
National Provider Identifier, ten digits.
Personal representative
Someone with authority under state law to act for the patient.
TCPA
Telephone Consumer Protection Act, the federal law on calls and texts.
25 · Sources
Sources
Read November 3, 2026. Regulatory status statements are as of that date. Several figures on hub intake come from vendors, and each is marked where it appears.
45 CFR 164.508, Uses and disclosures for which an authorization is required. Code of Federal Regulations, 2025 edition (revised as of October 1, 2025); last amended 78 FR 5699, January 25, 2013. govinfo.gov
45 CFR 160.103, Definitions. Code of Federal Regulations, 2025 edition. govinfo.gov
47 CFR 64.1200, Delivery restrictions. Code of Federal Regulations, 2025 edition (revised as of October 1, 2025). govinfo.gov
Muscarella (CoverMyMeds), sponsored guest post, Drug Channels, September 10, 2021. A vendor's statement; it names no study or dataset. drugchannels.net
CMS, Requirements for National Provider Identifier (NPI) and NPI Check Digit, January 23, 2004. cms.gov
15 U.S.C. 7001(a), Electronic Signatures in Global and National Commerce Act. govinfo.gov
45 CFR 164.506, Uses and disclosures to carry out treatment, payment, or health care operations. Code of Federal Regulations, 2025 edition. govinfo.gov
Karakousis CP, Polito F, Page KR, Socal MP. Insulin Patient Assistance Programs and Protected Health Information. JAMA Network Open 2026;9(5):e2611849, May 11, 2026. Three manufacturers' programs. jamanetwork.com
45 CFR 164.502, General rules, minimum necessary and personal representatives. Code of Federal Regulations, 2025 edition. govinfo.gov
California Civil Code section 56.11. Paraphrased; we read excerpts of a California Department of Health Care Services compilation and of AB 1697 (2023-24), which is listed as amending the section, and did not read the current text on the Legislature's own site, so check it. leginfo.legislature.ca.gov
Revised Code of Washington 19.373.100, My Health My Data Act exemptions. app.leg.wa.gov
45 CFR 164.530(j), Documentation and retention. Code of Federal Regulations, 2025 edition. govinfo.gov
45 CFR 164.501, Definitions (marketing). Code of Federal Regulations, 2025 edition. govinfo.gov
FCC Consumer and Governmental Affairs Bureau, Order, DA 26-12, CG Docket No. 02-278, adopted and released January 6, 2026. docs.fcc.gov
McLaughlin Chiropractic Associates, Inc. v. McKesson Corp., 606 U.S. ___, No. 23-1226, Supreme Court of the United States, decided June 20, 2025, slip opinion. supremecourt.gov
HHS, HIPAA Security Rule notice of proposed rulemaking, 90 FR 898, January 6, 2025. Unified Agenda entry RIN 0945-AA22 lists Long-Term Actions, final action 07/2027, read November 3, 2026. govinfo.gov
Fenwick, Supreme Court's McLaughlin Decision Creates New Uncertainty for Healthcare Text Message Compliance, July 15, 2025. One firm's commentary. fenwick.com
CMS, FY 2027 ICD-10-CM code files: Tabular List, code descriptions and addenda, for discharges and encounters from October 1, 2026; K50, K51, K50.90, K51.90. cms.gov
Garza MY, et al. Error rates of data processing methods in clinical research: a systematic review and meta-analysis. Int J Med Inform 2025;195:105749. PMID 39647291. 93 papers, 1978 to 2008. Clinical research data, not hub intake. pubmed.ncbi.nlm.nih.gov
Stotts (AssistRx), sponsored guest post, Drug Channels, March 22, 2024. A vendor's figures from one case study, with no method given. drugchannels.net
Conroy (CoverMyMeds) and Morel (RxCrossroads by McKesson), sponsored guest post, Drug Channels, October 18, 2019. Vendors' data on file. drugchannels.net
Constant BD, et al. Delays Related to Prior Authorization in Inflammatory Bowel Disease. Pediatrics 2022;149(3):e2021052501. PMID 35190811. 190 children at one hospital. pubmed.ncbi.nlm.nih.gov
TechTarget, ONC: Health information exchange happening more via Direct, July 15, 2025, on ASTP/ONC data. We read this report, not the federal data page. techtarget.com
ONC Data Brief No. 59, Interoperability Among Office-Based Physicians in 2019, July 2022. We read excerpts, not the whole brief. healthit.gov
DCAT Value Chain Insights, How is the US Bio/Pharma Market Performing?, on IQVIA Institute, The Use of Medicines in the U.S. 2022: 55% of net manufacturer revenue against 28% in 2011. We read this summary, not the IQVIA report. dcatvci.org
US Department of Justice, Kaléo Inc. Agrees to Pay $12.7 Million to Resolve Allegations of False Claims for Anti-Overdose Drug, November 2021. Read as reposted by the US Postal Service Office of Inspector General. Allegations only, with no determination of liability. uspsoig.gov
HHS OIG, Compliance Program Guidance for Pharmaceutical Manufacturers, 68 FR 23731, May 5, 2003, Product Support Services, at 23735. Listed in OIG's CPG Archive on November 3, 2026. govinfo.gov
FDA, Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products, draft guidance, January 2025, docket FDA-2024-D-4689. fda.gov
Draft EU GMP Annex 22, Artificial Intelligence, joint EC and PIC/S consultation July 7 to October 7, 2025. EudraLex Volume 4 listed no Annex 22 on November 3, 2026. picscheme.org
Regulation (EU) 2026/1744 (AI Omnibus), in force July 27, 2026; Annex III rules December 2, 2027. European Commission, regulatory framework for AI. digital-strategy.ec.europa.eu
Next step
See it on your own enrollment forms.
Explore the solution, or bring a sample of past packets, including the ones you already know came back, and we will read them with you, every field tied to its box.
We use essential cookies to make this site work, and cookieless, anonymised analytics to understand how it's used. "Accept all" also turns on Google Analytics, which sets cookies. Privacy policy