Scaling Auto-Authorization: From 6 Conditions to Hundreds of Medical Policies

Research Date: 2026-02-12 Context: DaisyAI embedding inside Premera Blue Cross to scale their auto-authorization system

---

Table of Contents

1. How Auto-Auth Works Today
2. Scaling From Few to Many Policies
3. Where GenAI Adds Value
4. What Other Payers Are Doing
5. CMS Prior Authorization Final Rule (CMS-0057-F)
6. Regulatory Constraints
7. Implications for DaisyAI + Premera

---

1. How Auto-Auth Works Today

The Two Dominant Criteria Sets

The prior authorization market runs on two proprietary clinical criteria libraries:

InterQual (Optum/UnitedHealth)

• Organized by condition in a continuum format: all settings of care in one view per condition
• Q&A format with decision points: criteria are structured as clinical questions with rules (e.g., "[>= Two, except Other clinical information (add comment)]")
• Incorporates severity of illness, comorbidities, complications, and intensity of services
• Searchable by CPT/HCPCS codes: if a code requires authorization, the system routes to the relevant InterQual subset for medical necessity review
• Covers 90%+ of condition-specific admission reviews via InterQual AutoReview
• Clinical development: unbiased systematic review by 1,200+ independent multidisciplinary experts
• Source: InterQual Criteria, Optum

MCG (Hearst Health)

• Evidence-based care guidelines used by payers for UM decisions
• MCG Cite AutoAuth: customized rules engine that matches payer-specific criteria to clinical information and guideline content
• MCG Path: FHIR-based API that makes MCG criteria available in any interoperable PA workflow
• Supports Da Vinci CRD/DTR/PAS standards for CMS-0057-F compliance
• Source: MCG AutoAuth, MCG Path

How the Rules Engine Works (MCG AutoAuth Example)

1. Provider submits PA request with clinical documentation through portal or EHR
2. Rules engine evaluates the request against multiple factors:
   • Patient age, requested level of care, line of business
   • Clinical documentation status
   • Whether guideline criteria or medical policy criteria are Met/Not Met
3. Auto-decision logic:
   • If criteria met + rules satisfied → auto-approve (immediate response)
   • If criteria not met → pend to nurse reviewer queue
   • Rules can range from simple (single factor) to complex (combinations)
4. Provider receives real-time response: auto-approval or pending with next steps

Source: MCG Defining Rules for PA Automation

Integration with Payer Admin Systems

The major payer administration platforms are:

TriZetto Facets architecture:

• Core modules: benefits, enrollment, claims pricing/adjudication, comprehensive enrollee database
• Utilization Management (UM) module handles PA workflows
• TriZetto Touchless Authorization Processing (TTAP): automates eligibility checks, identifies whether authorization is needed, returns immediate automated responses
• Productized integration with InterQual and MCG criteria sets for quick deployment
• Custom integration available via standard TTAP APIs for non-Cognizant UM systems
• Sources: TriZetto TTAP, Facets Integration

Integration pattern:

Provider Portal/EHR → PA Request (X12 278 or FHIR)
    ↓
Payer Admin System (Facets/QNXT) → Eligibility + Benefits Check
    ↓
Rules Engine (TTAP / MCG AutoAuth / Custom) → Criteria Evaluation
    ↓
Clinical Criteria (InterQual / MCG / Custom Policy) → Decision Logic
    ↓
Auto-Approve (immediate) OR Pend to Clinical Review Queue

Current Auto-Approval Rates

• Overall MA approval rate: 92.3% — of 52.8 million PA determinations in 2024, 48.7 million (92.3%) were fully favorable (KFF, 2024)
• Cohere Health platform: Up to 90% auto-approval rate, varying 50-90% by specialty (Cohere Health)
• McKinsey estimate: 50-75% of manual PA tasks can be automated with AI (McKinsey)
• Industry reality: 80%+ of authorizations are eventually approved without modification — only a small fraction need detailed medical necessity review

Key insight for DaisyAI: The vast majority of PA requests end up approved. The value proposition is not catching more denials — it is approving faster and with less human touch, while accurately flagging the 8-15% that genuinely need clinical review.

---

2. Scaling From Few to Many Policies

What "Hundreds of Medical Policies" Means

A typical large health plan maintains hundreds to thousands of medical policies across multiple lines of business. Each policy defines:

• What service/procedure it covers (mapped to CPT/HCPCS codes)
• Clinical criteria for medical necessity (diagnosis codes, clinical conditions, prior treatments)
• Documentation requirements (what evidence must accompany the request)
• Exclusions and carve-outs (what is not covered, age limits, quantity limits)
• Line-of-business variations (commercial vs. Medicare Advantage vs. Medicaid may differ)

Example: Premera's InterQual policy structure Premera publishes a medical policy (e.g., policy 10.01.530) that lists services reviewed using InterQual criteria. Different service categories route to different InterQual subsets. Some services use custom Premera medical policies instead of, or in addition to, InterQual. (Premera Policy 10.01.530)

The Structure of a Medical Policy

A medical policy typically contains:

POLICY TITLE: e.g., "Spinal Fusion Surgery"
POLICY NUMBER: e.g., MP-2024-0142
EFFECTIVE DATE: 2024-01-01
LAST REVIEWED: 2025-06-15

APPLICABLE CODES:
  CPT: 22551, 22552, 22554, 22558, 22585, 22612, 22614...
  ICD-10: M43.1x, M47.81x, M48.06, M50.x, M51.x...
  HCPCS: (if applicable)

CRITERIA FOR MEDICAL NECESSITY:
  - Condition A (e.g., degenerative disc disease):
    AND one of:
      - Failed conservative treatment >= 6 months
      - Progressive neurological deficit
      - Cauda equina syndrome
    AND documentation of:
      - MRI/CT findings correlating with symptoms
      - Physical exam findings
      - Treatment history

EXCLUSIONS:
  - Not covered for [specific conditions]
  - Age restrictions
  - Experimental/investigational indications

LINE OF BUSINESS VARIATIONS:
  - Commercial: standard criteria above
  - Medicare Advantage: must also meet NCD/LCD criteria
  - Medicaid: state-specific requirements

The Digitization Challenge

Going from 6 auto-auth conditions to hundreds requires solving several problems:

1. Policy Standardization

• Health plans manage policies in varied formats: Word docs, PDFs, internal wikis, committee minutes
• Each policy has different structure, granularity, and maintenance cadence
• First step: standardize into a consistent, machine-readable format
• Source: Itiliti Health on Policy Digitization

2. Code-to-Policy Mapping

• Map every CPT/HCPCS code that requires PA to the correct medical policy
• Handle one-to-many relationships (one code may be covered by multiple policies depending on diagnosis)
• Handle many-to-one (multiple codes map to same policy)
• Account for line-of-business carve-outs and segmentation

3. Criteria Extraction and Structuring

• Transform prose-format clinical criteria into executable decision logic
• "Failed conservative treatment for at least 6 months" → structured rule with data fields
• Nested AND/OR logic, exceptions, age-dependent criteria
• Distinguish between hard requirements (must have) and supporting evidence (nice to have)

4. Cross-Policy Dependencies

• Some policies reference other policies ("see also...")
• Some criteria depend on results of other procedures
• Step therapy requirements (must fail Drug A before Drug B is covered)

5. Maintenance at Scale

• Policies update quarterly or more frequently
• Clinical evidence evolves, guidelines change
• Must version-control policies and criteria
• Must propagate updates across all lines of business

Real-World Scaling Example

Itiliti Health recently partnered with one of the nation's largest health plans to digitize more than 650 policies across four lines of business, including handling carve-outs, segmentation, and custom business rules. Their approach:

• No AI for digitization — preserves original policy language exactly as intended
• Transforms into structured, machine- and human-readable format
• Policies, procedure codes, and criteria stored in a central system
• Updates are straightforward and consistent across teams and business lines
• Sources: Itiliti Health, Itiliti BUCA Compliance

DTR (Documentation Templates and Rules) Architecture

CMS-0057-F is pushing payers toward FHIR-based policy digitization via the Da Vinci Implementation Guides:

• CRD (Coverage Requirements Discovery): Provider EHR queries payer → "Does this service need PA?" + "What documentation is required?"
• DTR (Documentation Templates and Rules): Payer returns FHIR Questionnaire resources that define exactly what clinical data to collect for each policy
• PAS (Prior Authorization Support): Provider submits structured PA request via FHIR, payer returns decision

This is the architecture that makes scaling possible: instead of unstructured fax/portal submissions, each policy's criteria become a structured FHIR Questionnaire that the provider's EHR can populate automatically from the patient's chart.

Source: Cohere Health on DTR Workflows

---

3. Where GenAI Adds Value

Beyond Rules: What AI Actually Does

Rules engines handle the structured, deterministic cases. GenAI fills the gaps:

Tier 1: Clinical Note Parsing and Extraction (In Production)

• Extract structured information from unstructured clinical notes, PDFs, faxed records
• NLP/ML recognizes data fields and increases confidence scores
• Map extracted data to policy criteria fields
• Who's doing it: Cohere Health (clinical AI copilot), Humata Health (EHR-connected clinical data extraction), Optum InterQual Auth Accelerator (converts provider docs to machine-readable format)
• Source: Humata Health, Cohere Health

Tier 2: Criteria Matching and Evidence Highlighting (In Production/Piloting)

• Compare extracted clinical data against policy criteria
• For each criterion, AI suggests an answer and highlights supporting evidence in the documentation
• Reduces review time by 50%+ (Optum estimates 56% reduction)
• Who's doing it: InterQual Auth Accelerator (AI models trained on 50 years of InterQual criteria), Cohere Unify Decisioning
• Source: InterQual Auth Accelerator

Tier 3: Incomplete Information Handling (Emerging)

• Identify what's missing from a submission before it goes to review
• Suggest additional documentation needed
• Predict likelihood of approval based on available data
• Who's doing it: Humata Health (bundles clinical documentation to improve first-pass approvals, reduces preventable denials by up to 40%), Optum Real (flags claims needing more documentation before submission)
• Source: Humata Health

Tier 4: Edge Case Reasoning (Piloting)

• Handle cases where criteria are ambiguous or conflicting
• Interpret clinical context that doesn't map cleanly to structured criteria
• Support peer-to-peer reviews with clinical summaries
• Status: Mostly in pilot. Payers are cautious about AI reasoning on clinical edge cases. Human clinicians still make final calls on non-obvious cases.

Tier 5: Multi-Modal Input Processing (Early)

• Process imaging reports, pathology reports, genetic testing results
• Cross-reference across multiple clinical documents
• Handle non-standard documentation formats
• Status: Early stage. Some ambient documentation tools (Abridge, deployed at Kaiser across 40 hospitals) capture multi-modal clinical data, but not yet widely used in PA workflows.

What Payers Are Actually Deploying vs. Piloting

Key Distinction: AI for Approvals vs. AI for Denials

Every vendor and payer in this space draws a bright line:

"We do not and will not automate denials. This is only accelerating reviews and automating approvals." — Optum leadership on InterQual Auth Accelerator (Becker's)

"Elevance Health-affiliated plans do not use AI to automate denials of prior authorization requests. Only licensed clinicians determine that a prior authorization does not meet criteria for approval." — Elevance Health

This is both regulatory necessity and market positioning. See Section 6.

---

4. What Other Payers Are Doing

UnitedHealth Group / Optum

The most aggressive AI deployer in payer space.

• InterQual Auth Accelerator: AI trained on 50 years of InterQual clinical criteria. Piloting with 2 large health plans (late 2025), first payer fully live by April 2026. Estimates 56% reduction in review time. (Becker's)
• Digital Auth Complete: Provider-facing tool built with Humata Health. Live since January 2026. Helps providers bundle documentation correctly before submission. (Optum)
• Optum Real: AI-powered real-time claims platform. Distills complex plan rules into real-time coverage info for providers. Piloting with UHC + Allina Health (5,000+ visits processed). Reduces denials by catching documentation gaps pre-submission. (Healthcare Dive)
• InterQual AutoReview: Applies AI to real-time EHR data to auto-populate medical necessity reviews. Covers 90% of condition-specific admission reviews. (Optum)
• PA reduction: UHC cutting PA requirements by 10%, eliminating home health PA for Medicare Advantage managed by Optum Home & Community (formerly naviHealth). (Becker's)
• Pharmacy: PreCheck PA covering 45+ medications, 20 health systems, 75,000 physicians by January 2026. (UnitedHealth Group)

Cigna / The Cigna Group

• Eliminated PA requirements for 25% of medical service codes (600+ codes removed). PA now applies to less than 4% of services for most members. (Healthcare Dive)
• PxDx (procedure-diagnosis) auto-adjudication system: Cigna claims it does not use AI/algorithms for claims review, though ProPublica reported doctors spent avg 1.2 seconds per case reviewing 300,000+ claims in 2 months. (Modern Healthcare)
• AI tools used to "assist clinical reviewers with finding relevant and applicable information" but explicitly do not "make decisions or recommendations."

Elevance Health / Anthem

• "Extremely bullish" on AI investments. (Becker's)
• Majority of PA requests through portals approved in real time; most approved in less than 72 hours.
• Explicit policy: AI does not automate denials. Only licensed clinicians determine non-approval.
• Committed to AHIP pledge: 80% of electronic PA requests completed in real time by 2027.
• Lowest MA denial rate among major carriers at 4.2% (2022). (Becker's)
• Source: Elevance Health PA Page

Kaiser Permanente

• Integrated model (payer + provider) means less adversarial PA dynamic
• Largest GenAI deployment in healthcare: Abridge ambient documentation across 40 hospitals, 600+ medical offices
• AI focus is on clinical documentation, not PA automation per se
• Kaiser Permanente Intelligent Navigator: NLP-based patient navigation for 4.9M Southern California members
• Lowest appeal rate of any MA plan (1.6%) — suggests less friction in authorization process
• Responsible AI framework: "AI never makes medical decisions — our physicians and care teams do"
• Sources: Becker's, Kaiser AI Policy

Premera Blue Cross (Our Partner)

• June 2025: Committed to AHIP PA simplification pledge alongside other national carriers
• Commitments: standardize electronic PA submissions, fast-track responses, answer 80%+ of electronic PA in near real-time by 2027
• Further reducing PA use for certain in-network medical services by 2026
• Made voluntary AI safety/transparency commitments to the White House (December 2023)
• Uses InterQual criteria for many service categories (per policy 10.01.530)
• No public AI deployment announcements — this is where DaisyAI fits
• Sources: Premera PA Improvements, Premera Policy 10.01.530

Cohere Health (PA Platform Vendor)

Not a payer but a critical platform serving payers:

• 12M+ PA requests/year, 660,000+ providers, up to 90% auto-approval
• 47% reduction in admin costs, 73% reduction in care delays
• 15M+ authorizations processed via Cohere APIs to date
• Partnered with MCG to integrate care guidelines into Unify Decisioning
• Selected as WISeR model vendor for CMS
• 94% provider satisfaction
• Source: Cohere Health

Humata Health (AI PA Vendor)

• Selected by CMS as technology partner for WISeR model in Oklahoma (launching January 2026)
• Integration with Microsoft Dragon Copilot (October 2025)
• Connects to provider EHR, uses ML to select/index/classify clinical information
• Bundles into clinical package, submits to health plans, monitors decisions
• Approves immediately but can never deny — complex cases go to human clinicians
• Reduces authorization cycle times by 50%+, preventable denials by up to 40%
• $25M funding to expand platform
• Source: Humata Health, BusinessWire

---

5. CMS Prior Authorization Final Rule (CMS-0057-F)

Overview

Finalized January 2024. Affects: Medicare Advantage organizations, Medicaid managed care plans, CHIP agencies, QHP issuers on federal exchanges.

Compliance Timeline

Sources: CareEvolution, Firely

Decision Turnaround Requirements (Effective January 2026)

Denials must include clear, detailed reasons with specific clinical rationale.

Required FHIR APIs (Live by January 2027)

Technical foundation: FHIR R4 (4.0.1), SMART/OAuth2, US Core/USCDI, Bulk Data Access.

Da Vinci Implementation Guides (Preferred Path)

CMS points to the HL7 Da Vinci guides as the preferred implementation:

• CRD (Coverage Requirements Discovery): Checks if PA is required at time of ordering; returns documentation requirements
• DTR (Documentation Templates and Rules): FHIR Questionnaires that define exactly what evidence to collect per policy
• PAS (Prior Authorization Support): Electronic submission and tracking of PA requests within EHR workflow

CMS allows an all-FHIR PA flow instead of X12 278 under enforcement discretion. This is the direction the market is heading.

First-mover: A large regional Blues plan (working with Itiliti Health) is already live with all three Da Vinci transactions — first in the nation to achieve full CMS-0057 compliance at scale. (Itiliti Health)

Reporting Requirements

Beginning March 31, 2026 (covering CY 2025), payers must publicly report:

• Approval/denial rates
• Appeals outcomes
• Extended review counts
• Average decision times
• Broken down by service category

Implication: Payers with slow turnaround or high denial rates will face public scrutiny. This creates strong incentive to auto-approve more and faster.

---

6. Regulatory Constraints

Can You Auto-Approve? YES.

There is no federal or state prohibition on auto-approving prior authorization requests. Every major vendor and payer does this. The entire thrust of CMS-0057-F and the AHIP industry pledge is to move toward more and faster approvals.

Cohere auto-approves up to 90% of requests. MCG AutoAuth provides immediate approvals when criteria are met. InterQual AutoReview auto-populates and completes reviews. Humata Health explicitly states its technology "approves requests immediately."

Can You Auto-Deny? NO.

Federal — Medicare Advantage (42 CFR 422.101(c)):

The 2024 CMS final rule established clear requirements:

1. Individual circumstances required: Coverage determinations must be based on each patient's individual medical history, physician recommendations, and clinical notes. An algorithm that determines coverage based on a larger data set (rather than individual patient factors) is non-compliant. (Norton Rose Fulbright)

2. Algorithms cannot be sole basis for denial: AI/algorithms can assist in making coverage determinations, but MAOs must ensure compliance with all applicable rules. A prediction alone cannot be used as the basis to deny or terminate services. (CMS FAQ, via AAMC)

3. Physician review required for denials: A qualified healthcare professional must review any denial before it is issued. (CMS 2025 Rule)

4. Public criteria required: Predictive algorithms cannot apply internal coverage criteria that are not made public. AI cannot be used to shift or alter a plan's coverage criteria over time. (Cohere Health on CMS Limits)

Federal — ERISA (29 CFR 2560.503-1):

For employer-sponsored plans, ERISA claims procedures:

• Cannot contain provisions that unduly inhibit or hamper claim processing
• Must provide a full and fair review of denied claims
• A verbal denial alone does not satisfy regulatory requirements
• Denials require specific reasons, reference to plan provisions, and description of appeal rights
• Source: 29 CFR 2560.503-1

State Laws (2024-2025 Wave):

At least 31 states passed PA reform laws in 2025, with near-unanimous bipartisan support. Four states (Arizona, Maryland, Nebraska, Texas) enacted specific AI-in-PA laws with consistent themes:

• Prohibit sole use of AI to deny care or prior authorizations
• Require human review of algorithm-driven decisions
• Mandate disclosure when algorithmic systems are used
• 14 states require denial reviews include specialists with expertise in the patient's condition
• Sources: AMA, Health Law Program

The WISeR Model Precedent

CMS's new WISeR (Wasteful and Inappropriate Service Reduction) model, launching January 2026 in 6 states, establishes a clear template:

• Technology approves requests immediately but can never deny them
• Complex cases that are not an instant "yes" must go to a human clinician
• Coverage decisions expected within 72 hours (48 for expedited)
• "Gold carding" feature planned for mid-2026: exempts clinicians with consistent approval histories from future PA
• Source: HFMA

Summary: Regulatory Framework for Auto-Auth

---

7. Implications for DaisyAI + Premera

Why This Matters

Premera has committed to:

• Near real-time electronic PA by 2027 (AHIP pledge)
• Reducing PA for certain in-network services by 2026
• CMS-0057-F compliance (API requirements by Jan 2027)
• They use InterQual criteria already

They have no public AI deployment. This is the gap DaisyAI fills.

The Scaling Path

Phase 1: Digitize Premera's Medical Policies

• Inventory all medical policies requiring PA (likely 200-700+ across lines of business)
• Map CPT/HCPCS codes to policies
• Structure criteria into machine-executable format (FHIR Questionnaires for DTR compliance)
• Start with highest-volume service categories

Phase 2: Build Auto-Approval Engine

• Rules engine that evaluates structured PA submissions against digitized criteria
• Auto-approve when criteria clearly met (target: 60-80% of submissions)
• Pend to clinical review queue when criteria not met or documentation insufficient
• Never auto-deny — always route to human clinician

Phase 3: Add AI for Unstructured Data

• Clinical note parsing to extract structured data from faxes, PDFs, free-text
• Evidence highlighting for human reviewers (like InterQual Auth Accelerator)
• Missing documentation detection (like Humata/Optum Real)
• Increase auto-approval rate by making more submissions complete

Phase 4: CMS-0057-F Compliance

• Implement CRD/DTR/PAS Da Vinci APIs
• Expose Premera's digitized policies as FHIR Questionnaires
• Enable provider EHRs to query coverage requirements in real time
• Support electronic PA submission and real-time decisioning

Competitive Positioning

DaisyAI's differentiator: Deep embed inside Premera, combining policy digitization + AI clinical intelligence + CMS compliance in a single integrated deployment. Not a platform selling to hundreds of payers — a partner going deep with one.

Key Metrics to Track

• Auto-approval rate by policy category (target: 60% → 80% → 90% over time)
• Time to decision (target: real-time for auto-approve, < 72 hours for all)
• Clinical review queue volume (should decrease as AI improves)
• First-pass approval rate (submissions complete enough to auto-approve)
• Policy digitization coverage (% of PA-required services with structured criteria)
• Provider satisfaction (benchmark: Cohere's 94%)

---

Sources

Criteria Engines & Integration

• InterQual Criteria, Optum
• InterQual Auth Accelerator
• InterQual AutoReview
• MCG Cite AutoAuth
• MCG Path FHIR API
• MCG Defining Rules for PA Automation
• TriZetto TTAP
• Facets/QNXT Integration

Policy Digitization

• Itiliti Health: Digitizing Medical Policies
• Itiliti Health: CMS-0057 Compliance
• Cohere Health: DTR Workflows and Policy Digitization

Payer AI Deployments

• Optum AI-Powered PA Tools (Becker's)
• Optum Real (Healthcare Dive)
• Elevance Health PA Approach
• Elevance AI Investments (Becker's)
• Cigna PA Rollback (Healthcare Dive)
• Cigna PxDx (Modern Healthcare)
• Kaiser AI Policy
• Premera PA Improvements
• Cohere Health Platform
• Humata Health
• Humata + CMS WISeR (BusinessWire)

Statistics

• KFF: Medicare Advantage PA Determinations 2024
• McKinsey: AI in PA
• UHC PA Reduction (Becker's)

Regulatory

• CMS-0057-F (CareEvolution)
• CMS-0057-F Decoded (Firely)
• CMS AI Guidance for MA (Norton Rose Fulbright)
• CMS AI Use by MA Plans (AAMC)
• 42 CFR 422.101(c) via Reed Smith
• ERISA Claims Procedures (29 CFR 2560.503-1)
• State PA Laws (AMA)
• WISeR Model (HFMA)
• WISeR Federal Register
• Premera InterQual Policy 10.01.530

Industry Analysis

• Payer PA Commitments for 2026 (MedCity News)
• AHIP Pledge (Fierce Healthcare)
• MCG + Smile Digital Health FHIR PA (Smile)