The Top 10 Questions Health Plans and MSOs Should Ask About AI and Healthcare Automation

Introduction

Healthcare organizations do not need artificial intelligence merely because it is available. They need reliable ways to evaluate enormous volumes of claims, authorization requests, contracts, policies, provider activity, regulatory materials, and operational data without sacrificing accuracy, accountability, privacy, or human judgment.

The most useful healthcare AI systems do not begin by asking what a model can generate. They begin with established facts: structured data, coding standards, reimbursement rules, contracts, clinical policies, regulatory requirements, documented workflows, and measurable historical outcomes. AI can then help analyze those materials, identify relationships, summarize large datasets, prioritize exceptions, and recommend possible actions. Automation can execute approved administrative steps. Human experts remain responsible for governance, exceptions, consequential decisions, and continuous improvement.

This distinction matters because AI and automation perform different functions.

AI analyzes, interprets, predicts, retrieves, classifies, or generates information. Automation performs predefined actions, such as routing a case, requesting documentation, creating a task, updating a status, generating a report, or sending an approved notification. A healthcare organization may use one without the other, but the greatest operational value often comes from combining them responsibly.



The following questions examine how health plans, managed service organizations, delegated entities, IPAs, TPAs, and risk-bearing provider organizations can introduce AI and automation in a controlled sequence—from data preparation through analysis, workflow execution, human review, and corrective action.

Which department should AI and automation be a major pillar of success?

AI performance depends heavily on the quality, structure, completeness, and legal usability of the information it receives. A sophisticated model cannot reliably correct missing fields, inconsistent identifiers, poorly mapped codes, obsolete policies, or incomplete claims history.

The process should begin with a data inventory. Health plans should identify relevant sources such as claims, encounters, authorizations, eligibility files, provider records, fee schedules, contracts, medical policies, coding references, appeals, call records, and operational timestamps. Each source should have an identified owner, format, update frequency, retention rule, and permitted use.

Next, the organization should determine whether the intended analysis requires identifiable information. Many operational questions can be studied using de-identified or limited datasets. For example, researchers may analyze code combinations, provider patterns, processing times, reason codes, reimbursement differences, and workflow outcomes without exposing names or direct member identifiers.

HHS recognizes two methods for de-identifying protected health information under HIPAA: Expert Determination and Safe Harbor. Removing obvious identifiers informally does not automatically make information legally de-identified. The organization must apply an accepted method and evaluate whether remaining information could reasonably identify an individual.

Once the data is legally and operationally appropriate, it should be normalized. Dates, codes, provider identifiers, quantities, monetary fields, and status values need consistent formats. Delimited datasets should include clear headers, data dictionaries, null-value rules, and record-level identifiers that allow findings to be validated without reintroducing unnecessary personal information.

AI can then be used to classify records, identify patterns, summarize results, or answer questions across the dataset. However, deterministic calculations should still be performed by databases, analytics tools, or controlled code whenever possible. A language model should not be trusted to calculate millions of financial values from raw text when a reproducible query can do so more accurately.

The final step is human validation. Subject-matter experts should review samples, reconcile totals, verify mappings, and confirm that analytical outputs correspond to the source data before any operational action is taken.

Can large language models research massive de-identified healthcare datasets?

Large language models can assist with research across large de-identified datasets, but they should not be treated as replacements for databases, statistical software, coding engines, or actuarial analysis.

The first step is to define the research question precisely. Examples include identifying which denial reasons increased most rapidly, summarizing billing patterns by specialty, comparing authorization outcomes across lines of business, or determining which operational exceptions create the greatest amount of manual work.

The second step is to perform structured computation outside the language model. Database queries or analytical code should calculate totals, percentages, distributions, trends, and financial values. These methods are reproducible and can be independently tested. The output can then be provided to an LLM in manageable, de-identified segments.

The third step is where the LLM adds value. It can explain results in natural language, group similar findings, identify themes, compare narrative policies with structured outcomes, generate research questions, summarize thousands of reason-code descriptions, or help analysts explore relationships that warrant deeper investigation. It can also translate technical findings into executive, operational, provider-facing, or compliance-oriented formats.

The fourth step is evidence linkage. Every LLM-generated conclusion should point back to the underlying records, queries, rules, or source documents. An answer such as “modifier usage appears unusual” is insufficient. The researcher should be able to identify the providers, codes, time periods, peer groups, and calculations supporting that statement.



The fifth step is expert review. Coding, clinical, compliance, actuarial, or payment-integrity professionals must determine whether an observed pattern is meaningful. A statistically unusual result could reflect a legitimate specialty, a benefit change, a contract exception, a data-mapping issue, or an emerging problem.

NIST’s generative AI guidance emphasizes risks including confabulation, information integrity, privacy, human overreliance, and the need for ongoing evaluation. Generative AI should therefore operate as a research assistant within a controlled analytical process—not as the authoritative source of the underlying facts.

How can AI and automation improve medical claims auditing?

Claims auditing can be organized as a chronological chain rather than a single automated decision.

The process begins with authoritative inputs. These may include current and historical claims, coding standards, reimbursement policies, member attributes, provider information, client contracts, and configured exceptions. The organization must first confirm that the fields required for each audit test are present and reliable.

Rules-based technology can then evaluate deterministic issues such as duplicate claims, incompatible procedure combinations, terminated codes, incorrect modifiers, global-period conflicts, excessive units, age or sex conflicts, and invalid places of service. Historical analysis can identify relationships that are not visible within a single claim, such as repeated services, related prior procedures, or patterns across multiple dates.

AI can supplement those rules by finding broader patterns. It may identify providers whose billing behavior differs from appropriate peer groups, detect emerging combinations not previously prioritized, summarize large populations of findings, or rank cases according to financial and operational risk.

Automation should follow the analytical stage. Instead of automatically denying every flagged claim, the system might assign a reason code, calculate the potential financial impact, attach related history, route the claim to a specialized queue, or generate a draft explanation for reviewer consideration.

Human review is then applied proportionately. A clear structural error may require little intervention. A contract-dependent, clinical, or ambiguous issue may require claims, coding, medical, or legal expertise. The reviewer should see the finding, source rule, affected line, historical evidence, financial value, and relevant exceptions.

The final stage is remediation. The organization may correct the payment, update an edit, educate a provider, modify a contract configuration, recover an overpayment, or investigate a broader pattern.

Government healthcare programs also use data analytics to identify potential fraud, waste, and abuse and prioritize further review. HHS-OIG describes data mining as the screening and analysis of data to identify potential fraud, while emphasizing the role of subsequent investigative processes.



The objective is therefore not maximum automation. It is reliable detection followed by proportionate, documented action.

How can AI and automation improve prior authorization?

Prior authorization contains several different functions, and each should be evaluated separately. Coding validation, benefits, eligibility, medical necessity, documentation, contracts, and clinical review should not be collapsed into one AI decision.

The first step occurs before formal review. Automation can verify whether required fields are present, whether submitted values use the correct format, and whether the request contains enough structured information to proceed. Incomplete requests can be routed back for correction before they consume reviewer time.

The second step is rules-based analysis. Procedure codes, diagnoses, modifiers, quantities, demographic compatibility, places of service, and related coding relationships can be evaluated against defined logic. This can eliminate repetitive research while preserving specialized clinical work for qualified reviewers.

The third step is AI-assisted interpretation. An approved model may summarize clinical documentation, compare submitted information with policy criteria, or highlight missing evidence. Because these uses can affect access to care, the organization should verify sources, retain the underlying documents, and prevent the model from inventing unsupported criteria.

The fourth step is workflow automation. A request with missing fields may be returned automatically. A request with a coding issue may be routed to a coding queue. A request that passes coding validation may advance to benefits, eligibility, contractual, or clinical review. Selected routine requests may eventually qualify for automated processing when all required conditions have been independently confirmed.

The fifth step is human governance. Clinical or adverse determinations should receive the level of oversight required by applicable law, contract, policy, and organizational risk standards. A coding engine’s “no issue found” response does not independently establish medical necessity or coverage.

CMS is requiring certain regulated payers to implement and maintain electronic prior-authorization APIs beginning January 1, 2027. These requirements support faster and more standardized exchange, but they do not eliminate the payer’s responsibility for appropriate review and decision-making.



A responsible real-time model therefore evaluates structured information, returns findings, routes the request, and documents each action while preserving the appropriate clinical and administrative controls. PCG’s VA Live implementation guide follows this staged principle: initial real-time determinations, human review, controlled workflow routing, and only later consideration of selected automation.

What remedial tasks can healthcare organizations automate?

Remedial automation is one of the most practical and underused applications of healthcare technology. It focuses on what happens after an issue is identified.

The first step is classification. An AI or rules-based system may determine that a record contains missing information, a coding conflict, an unusual provider pattern, a contract exception, a documentation deficiency, or a workflow delay. Each category should be connected to a predefined remediation pathway.

The second step is task generation. Automation can create a work item, assign it to the correct department, attach the supporting records, establish a due date, and identify the required response. This eliminates manual forwarding and reduces the risk that findings remain unresolved in reports.

The third step is controlled communication. The system may generate a draft request for documentation, provider-education notice, internal compliance summary, claims adjustment explanation, or authorization follow-up. Approved templates and variable fields should be used whenever the communication has financial, clinical, contractual, or regulatory consequences. A human can review sensitive correspondence before release.

The fourth step is system correction. Depending on the finding, automation may update a status, place a claim in a review queue, apply an approved exclusion, open a recovery case, schedule a re-audit, or create a configuration-change request. It should not silently change production rules without testing and authorization.

The fifth step is validation and closure. The workflow should record what action was taken, by whom, when it occurred, whether the issue was resolved, and whether the same problem recurred. This creates a measurable feedback loop.



Remedial automation is especially valuable for repetitive problems. If hundreds of records contain the same missing field, the organization should not merely process hundreds of individual corrections. It should identify the upstream cause, correct the intake process, educate the responsible party, and monitor whether the error declines.

In this model, AI identifies and explains the problem; workflow automation coordinates the response; a human approves consequential actions; and analytics measure whether the remediation actually worked. That sequence converts AI from an interesting reporting tool into an operational improvement system.

PCG's two partners, HCIM and Key Software, would be happy to help with the automation process.

How can AI help detect fraud, waste, abuse, and emerging billing patterns?

Fraud, waste, and abuse analysis should begin with facts and patterns rather than accusations.

The first step is rules-based screening. The organization can identify known issues such as duplicates, improbable units, invalid relationships, excessive frequencies, inconsistent specialties, or billing combinations that violate established requirements.

The second step is longitudinal analysis. Current activity should be compared with historical claims, provider behavior, peer groups, patient populations, geographic patterns, referral relationships, and changes over time. This helps distinguish isolated errors from systematic behavior.

The third step is AI-assisted pattern discovery. Statistical models and machine learning can identify unusual relationships that were not explicitly programmed. Large language models can assist investigators by summarizing extensive claim histories, grouping similar findings, reviewing de-identified narratives, and organizing potential lines of inquiry.

The fourth step is prioritization. Cases can be ranked using financial exposure, frequency, member impact, recurrence, confidence, and similarity to known schemes. Prioritization allows limited investigative resources to concentrate on the highest-risk matters.

The fifth step is human investigation. Software cannot ordinarily determine intent from claims data alone. Investigators may need medical records, provider interviews, contracts, ownership information, referral data, clinical review, or evidence from other organizations. Findings should therefore be described as anomalies, risks, or indicators until the evidence supports a stronger conclusion.

The final step is remediation or enforcement. The organization may educate the provider, recover an overpayment, revise an edit, increase prepayment review, suspend payment, refer the matter to an SIU, or contact an appropriate authority.

HHS-OIG uses data analytics to identify potential fraud targets and combine claim-level information with investigative resources. Its 2026 national enforcement effort specifically reported using advanced data analytics to identify major targets.

AI therefore accelerates screening, pattern recognition, prioritization, and research. It does not eliminate evidentiary standards, due process, investigative judgment, or the distinction between an error and intentional fraud.

How should AI connect with existing claims, authorization, and operational systems?

The value of AI depends on whether its findings enter the correct operational workflow. A stand-alone dashboard that no one regularly acts upon provides limited benefit.

The first step is to map the transaction lifecycle. The organization should identify where claims, authorizations, encounters, provider information, and supporting records originate; when required fields become available; and where a finding could affect the process without creating unnecessary disruption.

The second step is to choose the appropriate integration method. Retrospective research may use secure batch files or a data warehouse. Nightly auditing may use scheduled extracts and returned results. Time-sensitive claims or authorization activity may require an API, middleware, or event-driven interface.

The third step is structured validation. Before information reaches an AI service, required fields should be checked for completeness, format, permitted values, and duplication. An AI model should not be expected to compensate for avoidable interface defects.

The fourth step is response design. The receiving system should know how to store findings, display supporting evidence, assign responsibility, distinguish errors from recommendations, and trigger approved actions. Responses should include consistent identifiers so every output can be reconciled to its source transaction.

The fifth step is exception handling. The integration must account for timeouts, unavailable services, corrected submissions, duplicate requests, incomplete responses, version differences, and downstream system failures. Healthcare operations must continue even when an AI or integration service is temporarily unavailable.

The sixth step is monitoring. Technical teams should track volume, latency, failures, retries, response completeness, user action, and unresolved exceptions.

CMS’s prior-authorization API requirements reinforce the broader movement toward structured, interoperable exchange. However, technical connectivity does not itself establish operational readiness.



An effective integration therefore connects five elements: reliable source data, appropriate analytical logic, clear findings, controlled automation, and accountable human action. Missing any one of those elements can turn a technically successful integration into an operational failure.

How should human governance work after AI and automation are deployed?

Human governance should continue throughout the system lifecycle. Approval at implementation is not sufficient because data, regulations, contracts, models, workflows, and organizational priorities change.

The first governance responsibility is ownership. Every AI use case should have a business owner, technical owner, data owner, compliance contact, and defined decision authority. Responsibility should not be delegated vaguely to “the vendor” or “the algorithm.”

The second responsibility is transparency. Users should understand what the system evaluates, which sources it uses, what it does not evaluate, and how findings are generated. A reviewer should be able to trace a consequential recommendation to its underlying rule, record, policy, or analytical method.

The third responsibility is performance monitoring. Organizations should track accuracy, false positives, false negatives, overrides, appeals, processing time, unresolved exceptions, financial impact, and performance differences across lines of business or populations.

The fourth responsibility is change management. Updates to models, code sets, reimbursement policies, prompts, source documents, mappings, or automated tasks should be documented, tested, approved, and version-controlled.

The fifth responsibility is escalation. Personnel need a clear process for reporting incorrect outputs, unsafe recommendations, privacy concerns, discriminatory effects, security events, or unexpected operational behavior. High-risk systems should include the ability to pause automated actions while investigation occurs.

NIST’s AI RMF presents governance as a cross-cutting function that supports mapping, measurement, and management of AI risks. Its framework also emphasizes documented roles, organizational accountability, and lifecycle evaluation.

Federal health IT policy similarly increasingly emphasizes transparency into how predictive algorithms are designed, validated, and used. ONC’s HTI-1 rule established transparency requirements intended to help users assess fairness, appropriateness, validity, effectiveness, and safety.



Human governance is therefore not simply a requirement that someone “remain in the loop.” It is a management system that determines who controls the technology, how its performance is proved, and what occurs when its results are wrong.

How should a health plan implement and measure AI over time?

AI implementation should occur in phases, with evidence required before the organization advances to greater automation.

The first phase is observation. The organization establishes baseline volumes, turnaround times, labor requirements, error rates, savings, appeals, and existing workflow performance.

The second phase is controlled analysis. The AI system evaluates historical or production-like information without changing live operations. Experts compare findings with known outcomes and identify data-quality or configuration problems.

The third phase introduces decision support. Findings are presented to staff, but humans continue to make and document final decisions. This phase should measure acceptance, disagreement, research time, accuracy, and operational usefulness.

The fourth phase adds workflow automation. The system may route records, create tasks, attach supporting information, generate reports, request missing fields, or prepare draft communications. These actions should reduce administrative effort without transferring substantive decision authority prematurely.

The fifth phase introduces narrowly approved automatic actions. Only high-confidence, well-tested, low-ambiguity scenarios should qualify. The organization should maintain exception rules, appeal processes, audit trails, and shutdown procedures.

The sixth phase focuses on remediation and expansion. Accepted findings should produce upstream corrections, provider education, policy changes, configuration improvements, and updated workflows. Additional automation should be introduced only when prior stages demonstrate sustained value.

Measurement should include more than financial savings. Relevant indicators include processing time, staff capacity, manual touches, research hours, accuracy, appeal outcomes, provider inquiries, member impact, compliance findings, system failures, and recurrence of remediated problems.

NIST cautions that its AI RMF Playbook is not a universal checklist. Organizations should adapt governance and risk controls to the use case, potential harm, and available resources.

The strongest implementation model is iterative: establish facts, apply the appropriate analytical method, automate approved tasks, retain human control, measure the outcome, remediate underlying causes, and then expand cautiously. Healthcare AI creates durable value when it improves the entire operating process—not merely when it produces an impressive answer.

Conclusion

The most effective healthcare AI strategy does not begin with an autonomous decision. It begins with reliable facts, structured data, authoritative rules, and a clearly defined operational problem. AI can then help health plans and MSOs analyze claims, research large de-identified datasets, identify billing patterns, summarize policies, prioritize risks, and support authorization workflows. Automation can route work, request information, generate approved communications, create remedial tasks, and document outcomes. Human experts remain responsible for consequential decisions, exceptions, governance, and continuous improvement.

The appropriate sequence is consistent:

1. Establish reliable data and governing authority.
2. Apply deterministic rules and reproducible analysis.
3. Use AI where interpretation, classification, research, or pattern recognition adds value.
4. Automate only predefined and approved operational actions.
5. Preserve human review based on the consequence and uncertainty of the decision.
6. Measure results and correct the underlying process.

That framework allows healthcare organizations to gain efficiency without confusing speed with accuracy or automation with accountability.

References

National Institute of Standards and Technology: AI Risk Management Framework
https://www.nist.gov/itl/ai-risk-management-framework

National Institute of Standards and Technology: AI RMF Core
https://airc.nist.gov/airmf-resources/airmf/5-sec-core/

National Institute of Standards and Technology: AI RMF Playbook
https://airc.nist.gov/airmf-resources/playbook/

National Institute of Standards and Technology: Generative AI Profile
https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf

Centers for Medicare & Medicaid Services: Interoperability and Prior Authorization Final Rule
https://www.cms.gov/initiatives/burden-reduction/overview/interoperability/policies-regulations/cms-interoperability-prior-authorization-final-rule-cms-0057-f

Centers for Medicare & Medicaid Services: Electronic Prior Authorization
https://www.cms.gov/priorities/electronic-prior-authorization/overview

Centers for Medicare & Medicaid Services: CMS-0057-F Fact Sheet
https://www.cms.gov/newsroom/fact-sheets/cms-interoperability-prior-authorization-final-rule-cms-0057-f

U.S. Department of Health and Human Services: HIPAA De-identification Guidance
https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html

U.S. Department of Health and Human Services: HIPAA Privacy Rule
https://www.hhs.gov/hipaa/for-professionals/privacy/index.html

U.S. Department of Health and Human Services, Office of Inspector General: Data Mining Applications
https://oig.hhs.gov/fraud/medicaid-fraud-control-units-mfcu/data-mining-applications/

U.S. Department of Health and Human Services, Office of Inspector General: Medicare Fraud Strike Force
https://oig.hhs.gov/fraud/strike-force/

U.S. Department of Health and Human Services, Office of Inspector General: 2026 National Health Care Fraud Takedown
https://oig.hhs.gov/fraud/enforcement/2026-national-health-care-fraud-takedown/

Office of the National Coordinator for Health Information Technology: HTI-1 Final Rule
https://healthit.gov/regulations/hti-rules/hti-1-final-rule/