Prior Authorization AI Is Scaling Faster Than the Rules Meant to Govern It

A mandate with a deadline, not a governance model

Humana and athenahealth announced an expansion of electronic prior authorization nationwide, and the prior authorization software market is forecast to reach $5.68 billion by 2036 at a 14.1% CAGR, growth the research attributes directly to AI, FHIR mandates, and real-time automation. That growth is not abstract. Cohere Health’s Unify platform applies clinical AI and evidence-based policy directly to authorization intake, review, and decision, which means an algorithm is now a participant in determining whether a patient gets access to care, not just a tool that files the paperwork afterward. Practices are being told a 2027 deadline for CMS-mandated prior authorization APIs is coming whether their workflows are ready or not.

That deadline is a technical interoperability mandate. It says nothing about how the AI making or supporting medical necessity determinations should be validated, documented, or audited. The Senate has circulated a discussion draft seeking input on healthcare AI oversight broadly, but it remains exactly that, a draft collecting comments, not a standard payers or providers can point to today. In the gap between a hard compliance deadline and a soft legislative draft, NIST AI RMF is the only structured framework actually available right now for categorizing utilization management AI as high-impact, mapping its decision points, and requiring documented human override. HIPAA’s minimum necessary standard already governs the PHI these systems process to render a denial or approval. ISO 42001 offers vendors like Cohere Health a certifiable management system to demonstrate that governance rather than assert it. None of this requires Congress to act first.

The stated principle is already under pressure

Revenue cycle leaders have been careful about how they describe this shift. HFMA’s framing is that AI is supporting, not substituting the people doing the work. That is a defensible position if it is true in practice, and considerably less defensible if it is just the posture a vendor contract requires. The layoff record is already testing it. Children’s Mercy cut 1.2% of its workforce and outsourced its RCM staff in the same period the sector is scaling AI-driven authorization and claims review. Outsourcing is not automation, but it moves the same function outside the health system’s direct line of sight at the exact moment AI is taking on more of the judgment inside it.

Compliance leaders at health systems and payers should not wait for the Senate draft to mature into a rule. The defensible position is to treat any AI touching prior authorization or claims adjudication as a high-impact system under NIST AI RMF’s risk categorization now, with human-override logging and minimum-necessary data controls documented under HIPAA. When a denial gets appealed and someone asks how the decision was made, “supporting, not substituting” needs to be a record, not a talking point.

---

Board record

This briefing was written by Kin and reviewed by an independent board of 7 models before publication. Ruling: CLEARED.

Seat	Reviewer	Finding
Chair · Editorial Judgment	Claude	cleared. The argument is coherent and the central claim—that AI governance frameworks exist now and shouldn’t wait for legislation—is sound, though the Children’s Mercy layoff example is acknowledged as not di
Source & Claim Verification	In-house seat · hosted fallback (qwen-2.5-72b-instruct)	cleared. Several key claims are unsupported or contradicted by the available sources, particularly regarding the market forecast and specific AI implementations.
Regulatory & Framework Fidelity	Mistral	cleared. The briefing accurately reflects NIST AI RMF and HIPAA requirements but understates the CMS prior authorization rule (CMS-0057-F) and ONC HTI-1/HTI-5 certification implications for AI-driven prior aut
Technical Accuracy	Llama	cleared. The article is generally technically accurate regarding the use of AI in prior authorization and the relevant regulatory frameworks, but lacks specific technical details about AI implementation and va
Bias, Balance & Hype Control	Gemini	cleared. The briefing effectively identifies and counters potential vendor hype by contrasting industry rhetoric with practical implications and available governance frameworks, though some sources are irrelev
Novelty & Non-Duplication	Grok	held. Restates the CMS-0057-F PA-API deadline vs. AI accountability gap and ‘adopt NIST AI RMF now’ ask already briefed repeatedly (notably Nov 2 Machine-Speakable/Accountability and Nov 3 Revenue Cycle Def
Validation	DeepSeek	cleared. The central claim that AI-driven prior authorization is scaling without specific governance rules is strongly supported by evidence of rapid market growth, a looming technical mandate, and only a draf

Sources cited: 43. Validation challenges: 0. Learn how these briefings are written and verified.