Prior authorization asks a payer to approve a service before it is delivered. Each payer has criteria, and the request succeeds when the packet shows that the patient meets them. Staff spend time reading the chart for the relevant history, finding the test results and notes that satisfy each criterion, and writing the letter. Denials and resubmissions often come from a missing piece of evidence, not a disagreement about medicine.
The task is repetitive, document-heavy, and checkable against written criteria. It is also a task where the clinical decision, and the accountability for it, belong to clinicians. The design should respect both facts.
The design
- Orderservice and payer
- Criteriapayer policy, loaded
- Read chartextract facts, inline PDFs
- Matcheach criterion: met, not met, unclear
- Gapswhat evidence is missing
- Draftpacket and letter, cited
- Clinician or staffreviews and signs off
- Submissionpacket, edits, who approved
- Criteria first. The payer's written policy for the service is the checklist. It is placed in context and the system works through it item by item.
- Read the chart. Notes and results are sent inline to the Messages API. The model extracts the facts that bear on each criterion, with a citation to the page or passage.
- Match, with a third answer. Each criterion is marked met, not met, or unclear. Allowing "unclear" matters. Forcing a binary answer teaches the system to guess.
- List the gaps. The most useful output is often what is missing: a lab that was not found, a note that does not state duration of therapy. Staff can obtain it before submitting, which is where first-pass success is won.
- Draft the packet and letter. Every clinical statement carries a citation back to the chart. Staff review the draft against the cited text.
Staying inside the HIPAA boundary
Anthropic offers HIPAA-ready API access with a signed business associate agreement and a HIPAA-enabled organization. Its eligibility table matters here, and the data handling article covers it in full. The relevant points for this design:
- The Messages API, citations, PDF support sent inline, and prompt caching are eligible.
- Batch processing, the Files API, Agent Skills, hosted code execution, and Managed Agents are not. The API returns an error if you try them. So the design uses real-time requests, inline PDFs, and a loop you run yourself.
- Structured outputs are eligible, but the JSON schema is cached outside the PHI protections. Keep patient data out of schema property names, enum values, and patterns. Patient data belongs in message content only.
- HIPAA readiness is not available on Claude Platform on AWS, and on Bedrock and Google-managed Claude the cloud provider's terms govern. Choose the platform deliberately.
Where clinicians stay in charge
The system does not decide that a service is medically necessary. It reports what the chart shows against the payer's criteria. A person confirms that the chart supports the request, signs the submission, and handles anything that needs clinical judgment, including the choice to request an exception. Record who approved each packet. The reviewer should see the criterion, the evidence found, and the source passage in one place.
How to evaluate it
- Criterion-level accuracy. On a set of past requests with staff-labeled outcomes, how often does met, not met, or unclear agree with the label? Grade with code against the labels.
- Gap recall. Did the system name the missing evidence that caused real denials? Check against denial reasons.
- Citation support. Does each cited passage say what the packet says it does? This is the safety property. A fabricated citation is worse than none.
- Business measures, tracked and not assumed. Staff time per packet, turnaround, first-pass approval, and rework. Report what you measure, by payer and service line.
Payer rules change, so keep the criteria library versioned and tie each packet to the criteria version it used.
This is a reference design. It describes how we would build the system and cites Anthropic's documentation for platform facts. It is not a client case study, and the figures it uses are list prices or worked examples, not results.
Have a process like this?
Bring it to a 45-minute working session.