Payers Are Using AI Agents: A 2026 Practice Playbook

By Jude Lee · · News

Office manager and billing specialist reviewing a prior authorization denial on a computer in a small medical practice

What actually changed on the other side of the fax

For years, the asymmetry in prior authorization was mostly about staffing: your two-person billing team versus a payer’s utilization management department. The newer asymmetry is automation. Consulting-side commentary points the same direction — Boston Consulting Group’s February 2026 publication “How AI Agents Cut Costs for Health Insurers” is one example of that framing — but treat any of it as an analyst’s view of where plans are headed, not evidence about what your specific payers have running today. Ask your reps directly; some will tell you.

What this means operationally is simple and worth saying plainly: the entity reading your prior authorization packet is increasingly a pipeline, not a person. Pipelines are literal. They reward structured, complete, criteria-matched submissions and punish the “we attached the whole chart, they’ll find it” approach that human reviewers sometimes tolerated.

The regulatory clock that matters more than the vendor announcements

CMS finalized the Interoperability and Prior Authorization Final Rule (CMS-0057-F) in January 2024; the agency’s own summary is on the CMS-0057-F fact sheet at CMS.gov. Per CMS, impacted payers — including Medicare Advantage organizations, Medicaid and CHIP fee-for-service and managed care plans, and QHP issuers on the Federally-Facilitated Exchanges — must meet specific prior authorization decision timeframes and provide a specific reason for denials, with those provisions beginning January 1, 2026. Read the scope carefully: those decision-timeframe provisions apply to prior authorization for items and services and expressly exclude drugs, so your pharmacy and specialty-drug auths are not covered by them. The rule also requires a Prior Authorization API beginning January 1, 2027, along with public reporting of certain prior authorization metrics.

72 hours
Expedited decision window for impacted payers, items and services (drugs excluded)
CMS-0057-F fact sheet, CMS.gov
7 calendar days
Standard (non-urgent) decision window under the same rule
CMS-0057-F fact sheet, CMS.gov
Jan 1, 2027
Prior Authorization API implementation date for impacted payers
CMS-0057-F fact sheet, CMS.gov

The operational takeaway: for a meaningful slice of your payer mix, response times become measurable and denials must come with a specific reason. Both are inputs an AI agent can use well — measuring turnaround by payer and service line, and parsing denial reasons into a triage queue instead of a pile.

Where an agent genuinely helps on your side

An AI agent, in the sense that matters here, isn’t a chatbot that answers questions. It’s a system that takes multi-step actions against your tools — read the chart note, pull the imaging report date, check the plan’s published medical policy, assemble the packet, log the submission, and stop for a human signature. The reusable instruction set that makes it do this the same way every time is what Anthropic and others call a skill: a packaged “here is how our practice preps an MRI auth for Plan X,” loaded every time instead of depending on whoever wrote today’s prompt.

  1. Packet prep and criteria matching — the agent drafts the request against the payer’s stated criteria and flags what’s missing. See our walkthrough of prior authorization automation with AI agents.
  2. Denial triage — the agent reads the specific denial reason, classifies it fixable/appealable/write-off, and drafts the next action. We compared this to rules-based scrubbers and outsourcing in AI denial triage vs scrubber rules vs outsourced RCM.
  3. Payer performance tracking — turnaround, denial reason frequency, overturn rate by plan. Boring, and probably the highest-leverage item here, because it turns an argument with a payer rep into a documented pattern.
Our house position: if the first reader of your prior auth packet is a machine, the packet has to be written for a machine — criteria language, dates, and failed conservative therapy stated explicitly, not implied.

Where the agent itself breaks

Three failure modes we’d design against from day one, each with the spot-check that catches it:

Citing a superseded policy version. The agent pulls a cached or outdated medical policy or LCD and builds the packet against criteria the plan no longer uses. Mitigation: require the draft to print the policy title, version or effective date, and source URL at the top. The reviewer confirms that effective date against the payer’s live policy page before submission.

Fabricating criteria language. Language models produce plausible-sounding policy text that isn’t in the document. Mitigation: require verbatim quotes with a section pointer, and treat any unquoted paraphrase as unverified. The reviewer checks that each quoted criterion appears word-for-word in the linked policy.

Silently dropping an attachment. The narrative reads complete while the PT notes or imaging report never made it into the upload. Mitigation: have the agent output an attachment manifest with file names and counts. The reviewer reconciles the manifest against what actually transmitted and logs the payer’s confirmation number.

Off-the-shelf features versus a custom agent over your own data

Built-in AI in your PM, clearinghouse, or EHR
Already inside the system of record and covered by an existing BAA. No integration project, one support number, one audit trail. The advantage a custom build cannot match: the vendor owns the update burden. When payer portals, forms, or APIs change — and under CMS-0057-F they will — the fix ships inside your subscription instead of landing on your consultant. Good when your bottleneck is generic: eligibility, standard edits, template letters. Limits: you get the vendor’s definition of “complete packet,” you rarely see the logic, and cross-system work (chart + PM + payer portal + fax log) often falls outside its reach. Ask the vendor how it handles your top three denial reasons specifically.
Custom agent connected to your systems via MCP
You define the skill, the data scope, and the stop points. MCP — the Model Context Protocol, an open standard for giving an assistant governed access to tools and data — lets you expose exactly the queries you want (“fetch the last two office notes and the PT completion date for this patient”) and nothing else. Good when your workflow is specialty-specific or spans systems. Costs: real build and maintenance effort, a signed BAA with any vendor touching PHI, someone accountable for access logs, and you absorb every payer-side change yourself. Our Claude + EHR via MCP build guide covers the plumbing.

The third option stays legitimate: hand the work to an outsourced RCM partner or a prior-auth service and let them own the automation. If your volume is low or your denial pattern is stable, buying the outcome beats building the capability. There’s no prize for having an agent.

Modeling whether any of it pays

Use your own numbers. Recovered labor is (auths per month × minutes saved each ÷ 60) × loaded hourly rate. A worked example with stated assumptions: assume 40 auths a month, 12 minutes saved each, and a $28 loaded hourly rate — that’s 480 minutes, 8 hours, roughly $224 a month. Now subtract honestly: if human review adds back 5 minutes per packet, your net is 7 minutes each, about 4.7 hours, roughly $130. Those figures are placeholders to show the shape of the math, not benchmarks.

Then add the harder line: denials previously written off × average allowed amount × the share you now actually appeal and win. Then subtract build or subscription cost. If the recovered-hours line comes out small, the honest answer may be a rules-based checklist in your PM system. Our comparison of agents, RPA, and plain rules is the sanity check to run before scoping anything.

Pick a metric you can measure, not a borrowed percentage

People search for governing ratios — the “30% rule in AI” is a common one — expecting a standard. There isn’t one; no regulator or standards body publishes it, and the phrase gets used loosely for everything from data splits to rough automation targets. Our opinion, offered as opinion: pick a target you can measure. “The agent drafts 100% of packets, a human approves 100% of them, and we track the edit rate” beats any borrowed percentage.

Which roles actually get more valuable

IBM’s Think newsroom, in a February 2026 piece titled “Why humans are always in the loop: Researchers name the boundary of AI automation,” frames accountability and judgment as that boundary. That matches what we’d expect in practice operations: the roles that grow own judgment and exception handling — the biller who knows which medical director to call, the manager who decides when a case escalates, the clinician who signs the appeal. Data entry between two systems is what agents genuinely absorb.

And no, this doesn’t replace physicians. Assistants like ChatGPT and Claude are large language models — general-purpose text systems, not FDA-cleared clinical devices — and consumer chat tools shouldn’t be used for diagnosis or for anything involving PHI without a BAA and appropriate enterprise configuration. Per HHS Office for Civil Rights guidance, a vendor handling PHI on your behalf is a business associate; confirm the agreement before a chart note leaves your building. When a workflow touches clinical criteria or medical necessity, a qualified clinician signs off.

  1. Pull your last 90 days of denials and auth turnaround

    Sort by payer and reason code. You cannot negotiate — or automate — a pattern you haven’t measured.

  2. Check which of your payers are 'impacted' under CMS-0057-F

    Start with the CMS-0057-F final rule fact sheet page on CMS.gov to confirm the payer categories, then look for the plan’s own published compliance or API attestation on its provider portal. For those plans, log decision times against the published windows.

  3. Write the skill by hand first

    Have your best biller document exactly how they prep your highest-volume auth. That document is the spec; if it can’t be written down, it can’t be automated.

  4. Decide build vs buy honestly

    Ask your PM/EHR vendor what their AI does with your top denial reasons. If the answer is vague, price a scoped custom build — and compare both to an outsourced service.

  5. Keep the human signature

    Draft-and-review, not send-and-hope. Log every agent action for auditability.

As of early 2026, payer-side agentic AI is a stated direction more than a uniform reality, and vendor capabilities shift quarterly — re-verify before committing budget. The durable move is unglamorous: clean, structured, criteria-matched submissions, and a measured record of how each plan responds.

Not sure where to start?

Get a free automation audit: we map your scheduling, intake, insurance, billing, and patient communication and show you what's worth automating — before you spend a dollar.

Get a free automation audit

Related guides