A prior authorization AI agent is a piece of software assigned one job inside a prior authorization review, such as checking eligibility, reading the clinical record against the medical policy or drafting the request to a provider for a missing document, and given rules about what it may not do. The question a health plan should ask of any such agent is not whether it is accurate in general but what it is allowed to decide. In Botminds' Prior Authorization Automation the answer is nothing: six agents do the reading, matching, chasing and drafting, and the decision on every request stays with a person, a nurse to approve and a physician to deny. This guide sets out each agent's job, the limit written into it, and the federal rule that makes the limit more than a design preference.
Plans are buying this kind of software under pressure from two directions. CMS-0057-F cut the Medicare Advantage standard clock to 7 calendar days and requires a specific reason on every denial from 2026, and insurers covering most Americans pledged in June 2025 to move toward real-time approvals. At the same time, federal regulators have not written rules specific to AI in coverage decisions, which leaves the general rules, applied strictly, as the boundary.
Six agents, each with a job, a hard limit and the rule behind the limit
| Agent | Does | Never | Why the limit |
|---|---|---|---|
| Intake agent | DoesReads requests from the portal, fax and X12 278; checks eligibility and benefits; picks the medical policy in force; starts the 72-hour or 7-day clock. | NeverChanges the urgency the provider asked for. Expedited only when the provider asked or a nurse says so. Keeps the request as received. | Why the limitA physician’s expedite request must be granted when the physician says the standard clock could seriously jeopardise the member (422.570). |
| Chart reader | DoesNumbers every page as received, names and dates each document, marks duplicate pages. | NeverDrops a page or reorders the record. | Why the limitEvery later citation, appeal and audit points at a page; the page has to be where the provider sent it. |
| Criteria matcher | DoesChecks each criterion against the chart: met, contradicted or not found, always with the quoted passage, document and page, or with what it searched. | NeverTicks a criterion without a quoted passage, infers facts that are not written, or recommends a denial. | Why the limitMedicare Advantage decisions must rest on the member’s own history, physician recommendations and clinical notes (422.101(c)). |
| Missing-records agent | DoesNames the exact missing document, finds where the chart mentions it, drafts the fax and portal request with a reply-by time, matches the reply. | NeverSends anything without the nurse, or asks for more than the open criteria need. | Why the limitHIPAA’s minimum necessary standard applies to requests for health information, not only to disclosures (45 CFR 164.502(b)). |
| History agent | DoesPulls the member’s past requests, decisions and appeals, and the paid claims that corroborate treatment named in the chart. | NeverWrites anything. It is read only. | Why the limitA claim shows a service was billed; it does not show what the clinical note says. The nurse weighs both. |
| Notice writer | DoesDrafts the approval or denial notice: for a denial, the criterion not met, the quoted record and page, and reconsideration rights. | NeverSends a denial without a physician’s e-signature. | Why the limitAn adverse medical necessity decision must be reviewed by a qualified professional before it issues (422.566(d)). |
What is a prior authorization AI agent?
It is a narrow worker, not a reviewer. A general-purpose model asked "should this request be approved?" produces an answer with no visible basis; an agent asked "does page 41 say Kellgren-Lawrence grade 3 or 4?" produces a checkable fact. The difference matters because a coverage decision has to be explained to the provider, the member, an appeal reviewer and, in Medicare Advantage, a CMS auditor. An answer that cannot be traced to a page cannot be explained.
Breaking the review into jobs also makes limits enforceable. "Do not recommend a denial" is a rule one can test on a single agent; it is meaningless for a system whose only output is a verdict. And it puts each failure in a known place: if a criterion was ticked wrongly, the cited passage shows whether the chart reader mis-dated a document or the criteria matcher misread a sentence.
Six jobs inside one prior authorization request, in the order they happen
Every prior authorization request, whatever the service, passes through the same six jobs. Some plans do all of them by hand; others automate intake and leave the rest to nurses. The flow below is how the solution divides them, with the two points where a person must act.
One request through Prior Authorization Automation: four agent steps, two human decisions
Agent
Intake agentReads the request from portal, fax or 278; confirms eligibility and that the service needs prior authorization; picks the policy in force; starts the clock.
Never: Downgrades an expedited request.
Agent
Chart reader and history agentNumber and date every page; pull past requests, decisions and paid claims for the member.
Never: Drop, reorder or edit a page.
Agent
Criteria matcherMarks each criterion met, contradicted or not found, with the quoted passage and page or the searches it ran.
Never: Ticks without a quotation, or recommends a denial.
Agent
Missing-records agentFor an open criterion, drafts a request for the named document with a reply-by time; matches the reply when it comes.
Never: Sends without the nurse.
A person decides
UM nurseChecks the cited evidence; sends records requests; approves when every criterion is met; routes a contradicted criterion to a physician.
Never: Issues a denial.
A person decides
Physician reviewerWeighs the passages for and against; offers a peer-to-peer; approves or signs the denial the notice writer drafted.
Never: Is bypassed on an adverse decision.
Every agent step is shown with what it found and how long it took
Can AI deny prior authorization? What the federal rules say in 2026
No federal rule lets software issue a Medicare Advantage medical necessity denial on its own, and no federal rule written specifically about AI governs the question either. The binding rule is older and general: before a plan issues a partly or fully adverse medical necessity decision, a physician or other appropriate health care professional with relevant expertise must review it (42 CFR 422.566(d)). Software can draft that decision; it cannot be the reviewer.
CMS has said directly that its 2024 rule did not change this. In the preamble to CMS-0057-F it wrote that the rule does "not directly address how prior authorization decisions are made, such as using AI, statistical methods, requirements for clinical decisions, or other algorithms", and then:
“However, prior authorization decisions involving AI or other algorithmic systems must still comply with applicable requirements, including requirements around clinical decision-making and the finalized policy requiring communication of the specific reason for denial.”
CMS, CMS-0057-F final rule preamble (89 FR 8758, 8 Feb 2024)
Two other facts complete the 2026 picture. In April 2025 CMS chose not to finalize proposed Medicare Advantage guardrails for AI, saying it would keep considering future rulemaking (CY 2026 final rule). And in June 2025 insurers, in a voluntary pledge announced by CMS, committed to "Ensure medical professionals review all clinical denials." (CMS). The pledge is voluntary, and no independent source yet measures whether it has been kept. Medicare's own traditional-program pilot draws the same line from the other side, letting technology companies recommend while licensed clinicians decide non-payment; the WISeR model guide reads that design closely. State insurance law can add its own rules on automated review, and a plan should read its state's statute itself rather than rely on a summary.
Can AI approve prior authorization requests?
Federal Medicare Advantage rules require professional review before an adverse medical necessity decision, not before an approval, so a plan may approve without a physician. CMS's market research for its WISeR model found that "Some MA plans reported decision time to prior authorization approval being almost instantaneous for services with very clear clinical coverage criteria" (90 FR 28749). The pledge's commitment to "real-time approvals for most requests by 2027" assumes exactly that.
Prior Authorization Automation does not do it by default, and a buyer should know that. In the solution a nurse clicks and e-signs every approval, and the nurse may approve only when every criterion carries a quoted passage, unless the plan changes the setting. The reasoning is that an approval is also a commitment: once a Medicare Advantage plan approves, it may not later deny coverage on the basis of lack of medical necessity, and it may reopen the approval only for good cause or reliable evidence of fraud or similar fault. A plan whose goal is approval with no human touch for clear-cut services is buying a different design. A plan whose goal is that every approval and every denial can be explained from the file is buying this one.
Who may decide what is a setting, versioned and recorded
Why the agents never pick the urgency or stop the clock
The intake agent may start the clock but may not change the urgency, because in Medicare Advantage the urgency is often not the plan's to choose. Under 42 CFR 422.570(c)(2)(ii), "For a request made or supported by a physician, the MA organization must provide an expedited determination if the physician indicates that applying the standard timeframe for making a determination could seriously jeopardize the life or health of the enrollee or the enrollee's ability to regain maximum function." An agent that read the chart and concluded the case was routine would be overruling the physician on a point the regulation gives to the physician.
The clock rule is the same in spirit. Extensions in Medicare Advantage are allowed only in listed circumstances and need a written notice to the member giving the reasons (42 CFR 422.568(b)(2)). An agent that paused a clock while it waited for records would be taking an extension nobody decided. In the solution, the clock runs from receipt, the agents work inside it, and alerts reach the nurse and supervisor before a request falls due.
What the evidence says about AI in prior authorization so far
The published evidence is thin and mostly technical. A systematic review in the Journal of Managed Care & Specialty Pharmacy in September 2026 screened 3,417 records and found 16 studies that met its criteria; 62.5% of them concerned AI in payer review and decision-making, 18.8% post-denial appeals, 12.5% initial submission and 6.3% early initiation of a request (JMCP). Most reported model metrics such as precision and recall rather than faster decisions or fewer wrong denials, and in the authors' words most studies "had high analysis bias, limited generalizability, inadequate validation, and limited subgroup reporting".
That has two consequences for a buyer. A vendor's accuracy figure, measured on its own data set, says little about a plan's own policies and records. And the operational claims that matter, minutes per review and decisions on time, have to be measured on the plan's own requests. That is the purpose of a pilot on closed requests, and of insisting on citations: a cited tick can be checked by a nurse in seconds, so its accuracy can be measured request by request.
A black-box score and a cited agent, seen from the nurse's chair
A model that scores the request: A likelihood of approval, sometimes with a short rationale.
Agents that cite the chart: Each criterion as met, open or contradicted, with the quoted passage and page.
A model that scores the request: Re-read the chart to see whether the score was right.
Agents that cite the chart: Click the page and read the highlighted sentence.
A model that scores the request: The error is invisible until an appeal or an audit finds it.
Agents that cite the chart: The wrong tick points to the wrong page; the nurse rejects it on the spot.
A model that scores the request: Lowers the score.
Agents that cite the chart: Becomes a named document requested from a named provider, with a reply-by time.
A model that scores the request: Written afterwards from the nurse’s notes.
Agents that cite the chart: Drafted from the cited criterion, for a physician to sign or reject.
Who is accountable when an AI agent reviews a request?
The plan is, and the named person who signed. Nothing in the Medicare Advantage rules moves responsibility for an organization determination to a software vendor or a delegated reviewer; the plan issues the decision and answers for it on appeal and audit, which is why utilization management outsourcing comes with an oversight duty that never transfers. Inside the plan, the person accountable for an approval is the nurse who signed it and for a denial the physician who signed it. The agents' role is to make sure each of them signed with the evidence in front of them.
That has a practical form. In the solution every agent step, decision and setting change is recorded with who, what and when; settings changes are versioned; the request screen shows how each tick was produced and how long each step took; and pages received after a request are marked with the time they arrived. When a CMS auditor or an independent review entity asks why a request was approved or denied, the answer is a list of criteria, each with a passage, a page and a signature. HIPAA also applies to the agents' work: a vendor handling the plan's members' records does so as a business associate, which HIPAA allows only with satisfactory assurance that the vendor will safeguard the information (45 CFR 164.502(e)), and requests for records are limited to what the open criteria need.
How to tell a prior authorization agent team from a black box
Ask to see the limits, not the accuracy slide. An honest agent design can show, for each agent, what it may not do and how that is enforced, and can show a request where an agent stopped because of a limit. The checklist below turns that into questions a clinical operations leader can put in a demonstration. The twelve questions for prior authorization software cover the wider purchase: clocks, notices, the 2027 API and price.
Questions to put to any prior authorization AI agent in a demonstration
- Show me a criterion the agent marked as not found, and what it searched
A system that only ever says met or not met is hiding its uncertainty in the second answer.
- Show me the page behind any tick, in one click
If the evidence is a summary rather than the record, the nurse is checking the summary.
- Can any agent approve, deny or recommend a denial?
If yes, ask which licensed person reviews it, and where that review is recorded.
- Can any agent change urgency, extend a clock or send to a provider?
Each of those is a decision with a rule attached; an agent should draft, a person should act.
- What happens to pages that arrive after the request?
They should be added, numbered and marked as new, and the criteria re-checked.
- Where is the record of who did what?
Every agent step, decision and setting change, with time and actor, kept for audit.
The answers separate tools built to replace the reviewer from tools built to equip one. The second kind is easier to defend, and it is what the federal rules, the June 2025 pledge and Medicare's own pilot all assume. For the reviewer's side of the same story, the prior authorization nurse's day shows where the hours go before and after the agents read the chart.
Questions people ask
Is AI prior authorization legal?
Using software in a prior authorization review is legal; letting it issue a Medicare Advantage medical necessity denial without professional review is not, under 42 CFR 422.566(d). CMS said in the CMS-0057-F preamble that decisions involving AI must still meet the rules on clinical decision-making and the specific reason for denial. State insurance law may add rules of its own, which a plan should read in the statute itself.
What tasks in prior authorization can AI do?
Everything up to the decision: reading and classifying the request, checking eligibility, finding the policy, reading the record against each criterion, drafting records requests and notices, and matching replies. In Prior Authorization Automation six agents divide those jobs. The decision itself, and sending anything to a provider, stays with a nurse or physician.
How do health plans use AI for prior authorization?
Most published research concerns the payer's review step: 62.5% of the 16 studies in a 2026 systematic review looked at payer review and decision-making. In practice plans use it to triage requests, read records, flag missing documentation and draft notices. The evidence that it shortens decisions or reduces wrong denials is still thin, so plans should measure it on their own requests.
Does CMS regulate AI in Medicare Advantage prior authorization?
Not with AI-specific regulation as of October 2026: CMS proposed AI guardrails for Medicare Advantage and decided in April 2025 not to finalize them. The general rules apply instead, including professional review of adverse decisions and decisions based on the member's own medical history, physician recommendations and clinical notes under 42 CFR 422.101(c).
Can an AI agent send a records request to a provider?
In Prior Authorization Automation it drafts the request and a nurse sends it. The draft names the document, facility and dates the open criterion needs and sets a reply-by time before the request falls due. Keeping the send with a person means a nurse checks that the request asks only for what the criterion needs.