Prior authorization is the tax the US healthcare system levies on itself. A clinician orders a test or a drug, the payer requires pre-approval, someone (usually a nurse) assembles the clinical documentation and submits it, the payer approves or denies, and the process often takes days. The American Medical Association estimates 12+ hours per physician per week spent on prior auth support.
This is exactly the kind of task LLMs are unusually good at — extracting structured data from unstructured clinical notes, matching it against payer criteria, drafting a submission — as long as they're deployed with the right guardrails.
The workflow, broken down
1. **Detection** — the ordering system flags an order that requires prior auth. Sometimes explicit (formulary check), sometimes inferred (CPT + payer combination).
2. **Documentation assembly** — pull relevant notes, imaging reports, prior treatment history from the EMR. Historically a human task; the LLM opportunity.
3. **Criteria matching** — the payer publishes clinical policy criteria (LCDs, NCDs, formulary criteria). Match assembled documentation against them.
4. **Submission** — package as an X12 278 or (increasingly) a FHIR-based prior-auth resource. Send.
5. **Response handling** — approval, denial with reason, or request for additional documentation.
Where LLMs add value
**Documentation assembly.** LLMs are excellent at reading through 30 pages of clinical notes and pulling out the specific data points a payer requires: 'has the patient tried and failed metformin?' 'is there imaging showing X?' 'when was the last elevated HbA1c?'. This is retrieval + extraction at its most useful.
**Criteria matching.** Given a payer's clinical policy (a PDF document), an LLM can compare it point-by-point against assembled documentation and produce a 'this meets/does not meet' response for each criterion. A human reviews the disagreements.
**Draft appeal letters.** When a prior auth is denied, someone writes an appeal citing specific clinical evidence. LLMs draft the first version; a clinician reviews and sends.
The architecture
The architecture we've seen work well: (1) RAG retrieval over the patient chart (grounded, cited); (2) structured extraction into a normalized form; (3) rule-based matching against payer criteria (deterministic); (4) LLM only for the free-text summary + rationale sections; (5) mandatory human review before submission.
The critical bit is step (5). No LLM output goes to a payer without a human clicking approve. The value prop is not automation-away-humans; it's automation-of-drudgery — 3 minutes of clinician review instead of 25 minutes of nurse documentation assembly.
The compliance overlay
PHI is involved in every step, which means: BAA with the LLM provider (OpenAI Enterprise, Anthropic, or self-hosted); audit log every LLM call as a PHI access event; encryption in transit and at rest; SOC 2 + HIPAA compliance for the software; ideally HITRUST if selling to hospitals.
For clients who can't send PHI to a hosted LLM, the pattern is sovereign / on-prem inference on open-weight models (Llama, Qwen, Mistral). Same architecture as our Document Intelligence product.
The regulatory tailwind
**CMS Prior Authorization Rule (2024-2027 phased)** — mandates FHIR-based prior-auth APIs for Medicare Advantage, Medicaid managed care, and QHP payers. Impact response times drop from days to 72 hours. This is the largest structural change to US prior auth in a decade, and it makes AI-assisted PA more valuable (fast + accurate wins), not less.
The economics
Rough numbers on a real deployment: 200 prior auths per week per clinic, 20 minutes each on the old workflow = 66 hours/week. AI-assisted workflow: 3-5 minutes each = 15 hours/week. Net saving: 50 nurse-hours per clinic per week. At $60/hr loaded cost, that's $150k/clinic/year.
The economics work at basically any operator scale. That's why this is one of the fastest-growing healthcare AI verticals.
How Origami builds these
Standard engagement: 8-week build of the core RAG + extraction layer against a client's EMR (Epic, Cerner, athena), 8-week integration to their existing prior-auth submission pipeline, 4-week production hardening + evals + human-in-the-loop workflow. Total 5 months, single senior engineer + product lead + designer. Deployed to production. Book a scoping call if this is on your roadmap.