For years, healthcare organizations have approached Medicare fraud and billing compliance as primarily a retrospective exercise. Claims are submitted, payments are made, audits follow, and organizations investigate problems after they surface.

That model is becoming increasingly unsustainable.

The federal government is moving toward a more aggressive approach to Medicare program integrity, using data analytics, artificial intelligence (AI), and machine learning to spot suspicious billing patterns earlier and, in some cases, prevent improper payments before they are made.

CMS has made the direction clear. In August 2026, the agency said its enforcement actions had stopped more than $1.6 billion in potentially improper Medicare laboratory payments since the beginning of the Trump administration. The effort included using AI and machine-learning models to analyze Medicare fee-for-service claims, identify unusual billing patterns, and flag high-risk claims for further review.

In September 2026, CMS announced another major enforcement action involving 11 medical equipment suppliers associated with more than $3.4 billion in suspected fraudulent Medicare Advantage and Part D billing. The agency said data analytics helped identify suppliers billing for equipment involving deceased beneficiaries and other suspicious activity.

This is more than an escalation of traditional fraud enforcement. It’s a fundamental change in the timing of the fight. The question for healthcare organizations is no longer simply whether they can respond effectively when an auditor finds a problem. It is whether they can identify the same risks before increasingly sophisticated government enforcement does.

From “Pay and Chase” to Continuous Detection

The traditional model of program integrity has often been characterized as “pay and chase,” which involves identifying a claim, paying it, discovering a problem later, and attempting to recover the money. Technology is changing that equation. CMS has explicitly described its current approach as using data-driven prevention and real-time enforcement. Its fraud initiatives increasingly combine claims data, provider information, utilization patterns, and other signals to identify anomalies before improper payments occur.

The agency’s Wasteful and Inappropriate Service Reduction, or WISeR, model provides another example. CMS is using AI and machine learning with human clinical review to evaluate certain services vulnerable to fraud, waste, and inappropriate utilization. For providers, this creates a different compliance environment.

A billing pattern that once might have survived for months before appearing in an audit can increasingly be identified through continuous analysis. A provider may not receive a warning that a pattern has become risky. The first indication could be a claim being held, denied, or referred for investigation.

That changes the role of revenue integrity.

The Risk Is Already Showing Up in Provider Data

External enforcement is growing more sophisticated as providers face increasingly aggressive scrutiny of their own claims. Our analysis shows how quickly audit exposure is changing. For example, we’re seeing a 30% increase in external payer audit risk, while the average amount at risk per claim increased 18%. HCC audits increased 102%, and the report also documented a 26% increase in coding denials.

The significance isn’t simply that more claims are being audited. The financial consequences of waiting to discover problems after submission are growing.

Organizations can no longer treat revenue integrity as a periodic exercise performed when an audit arrives. The risk increasingly exists at the point where documentation, coding, and claims are generated. That makes continuous visibility increasingly important.

Compliance Has to Move Upstream

The logical response isn’t to build a larger team to chase denials and respond to audits. It is to move the detection process closer to the point where risk is created. That means analyzing claims before submission, identifying unusual coding patterns, comparing provider behavior against relevant benchmarks, and looking for documentation or medical-necessity issues. At the same time, there is still time to correct them.

AI can help with that work because the volume of healthcare data makes purely manual approaches increasingly impractical.

But AI should not be viewed as a replacement for coding, compliance, or clinical expertise. Its value is in helping organizations identify where human attention is most needed. An effective system can continuously examine large volumes of claims and surface patterns that would be difficult for an individual reviewer to recognize. A compliance professional can then investigate the finding, determine whether there is a legitimate explanation, and decide on appropriate action. 

The result is a shift from reviewing everything to intelligently prioritizing what deserves attention.

The Emerging AI Arms Race

This is where the issue becomes bigger than fraud prevention. If regulators use increasingly sophisticated technology to identify patterns in healthcare claims, providers and health systems need to understand their own data at the same level. Otherwise, there is an asymmetry.

One side can continuously analyze millions of claims for anomalies while the other relies primarily on periodic audits, spreadsheets, and retrospective reviews. That is not a sustainable compliance strategy.

The organizations best positioned for this environment will use technology to continuously monitor their revenue cycle and billing behavior, identify emerging risks, and intervene before those risks become denials, repayment demands, or investigations. In other words, the goal isn’t simply to beat an audit.

It is to make sure the organization can see what the auditor is likely to see before the auditor does.

Humans Still Have to Make the Call

An important distinction exists between using AI to identify risk and allowing AI to determine that fraud has occurred. Healthcare billing is complicated. A statistical anomaly isn’t necessarily an error, and an unusual claim isn’t necessarily fraudulent.

A sophisticated revenue-integrity program therefore needs a human review layer. AI can pinpoint patterns. It can prioritize claims. It can connect information across enormous datasets. But experienced compliance, coding, and clinical professionals still need to determine what those patterns mean.

That matters more as healthcare organizations adopt AI for higher-stakes compliance functions. The objective should not be to automate judgment.

It should be to give the people responsible for that judgment better information, sooner.

The New Definition of Preparedness

CMS’s recent actions suggest that the federal government’s approach to Medicare fraud is moving toward continuous detection, data-driven enforcement, and earlier intervention in the payment process.

Providers should expect that trend to continue. That means preparedness can no longer be defined simply by having a compliance program, conducting periodic audits, or responding quickly when an external payer raises a concern.

Preparedness increasingly means knowing what is happening inside the organization’s claims data every day. The Medicare fraud fight is becoming an AI arms race. Regulators are using technology to find suspicious patterns faster, connect signals across enormous datasets, and stop questionable payments before they leave the system. Healthcare organizations don’t necessarily need to outspend or out-tech the government.

But they do need enough visibility into their own data to recognize risk before someone else does. Organizations that make that transition will be in a much stronger position not only to defend revenue, but to show their billing methods are accurate, defensible, and compliant before an outside party comes asking questions.

About Ritesh Ramesh

As CEO of the company, Ritesh focuses on driving growth and profitability for MDaudit with a customer-centric vision, strong team culture, and platform innovation. Ritesh has spent his entire career at the intersection of data , analytics and emerging technologies, transforming business models across various retail and consumer focused industries, including healthcare. Ritesh has 22+ years of experience working for leading professional services firms including PricewaterhouseCoopers(PwC) , Hewlett-Packard(HP) and Knightsbridge Solutions before joining MDaudit.

What You Should Know

• The Private Equity Stakeholder Project (PESP) released an updated edition of its Private Equity Hospital Tracker in late October 2026, revealing that private equity firms now own nearly one in eight private hospitals in the United States.
• The update was triggered by the $3.9 billion acquisition of Select Medical by an investment consortium that includes private equity sponsor Welsh, Carson, Anderson & Stowe (WCAS).
• The total count of private equity-owned hospitals across the United States climbed to 561 facilities, representing an increase from the 447 facilities identified in PESP’s July 2026 dataset.

The Numbers: Quantifying the Inpatient Buyout Footprint

The updated dataset underscores the scale of private equity’s hospital asset base:

• 561 PE-Owned Hospitals Nationwide: Up from 447 facilities documented in July 2026, representing a net single-period addition of 114 hospitals.
• 11.9% of All Private Hospitals: PE-backed operators now control nearly 12% of all private (proprietary for-profit and non-profit) hospitals in the country, up from 9.5% in July.
• 33.6% of Proprietary For-Profit Hospitals: More than one-third of all investor-owned, for-profit hospitals in the United States are now controlled by private equity sponsors, compared to 26.8% earlier in the year.
• WCAS Vaults to #2 Nationally: Through its acquisition of Select Medical alongside its ongoing controlling platform in Emerus Hospital Partners (the nation’s largest operator of micro-hospitals), Welsh, Carson, Anderson & Stowe now directly oversees 124 hospitals, establishing itself as the second-largest private equity hospital portfolio owner in the nation.

Jim Baker, Executive Director of PESP, framed the systemic policy concerns: “Anyone who thinks private equity is done buying hospitals should think again. The industry is still placing multi-billion-dollar bets on hospitals, even after the devastating failures at systems like Steward Health Care, and Prospect Medical Holdings/Crozer Health. Patients and healthcare workers are the ones who suffer when those bets go wrong, and policymakers need to take that risk seriously.”

Regulatory Evasion and Oversight Friction: The Massachusetts HPC Review

Beyond aggregate footprint expansion, the Select Medical transaction exposes friction between fast-moving national buyout syndicates and state-level healthcare market oversight bodies.

In Massachusetts, lawmakers enacted comprehensive transaction review legislation in early 2025 specifically designed to prevent unmonitored changes of hospital ownership following the collapse and liquidation of Steward Health Care. Under state statutes, healthcare entities are required to submit formal Notices of Material Change (MCN) to the Massachusetts Health Policy Commission (HPC) at least 60 days prior to executing any transaction that alters ownership or governance.

However, the Select Medical acquisition closed on July 1, 2026, without prior notification:

• PESP Alert Triggers Regulatory Inquiry: Following direct outreach from PESP in August, the Massachusetts HPC contacted Select Medical corporate leadership, determining that the $3.9 billion buyout constituted a mandatory material change requiring regulatory evaluation.
• Late-Filing Submission: Select Medical formally filed its transaction notice on October 15, 2026—more than three full months after the acquisition had legally taken effect.
• Active Review Posture: As of late October 2026, the Massachusetts HPC confirmed the transaction notice remains under active regulatory review, though specific enforcement remedies or structural mitigation conditions have not been publicly disclosed.

The delayed filing underscores the jurisdictional challenges state healthcare commissions face when policing multi-state corporate buyouts where national holding entities acquire parent companies whose local operating licenses sit several layers down the corporate organizational chart.

Capital Engineering: Real Estate Unbundling and Non-Profit Joint Ventures

The tracker highlights two financial engineering strategies that define modern PE hospital management:

• REIT Leaseback Structures: At least 144 private equity-owned hospitals operate under real estate arrangements where the physical hospital real estate has been severed and sold to third-party Real Estate Investment Trusts (such as Medical Properties Trust). These sale-leasebacks extract upfront liquidity to fund dividend recaps or debt service, saddling the underlying operating company with long-term, inflation-escalating master lease obligations that strain operational margins.
• The Non-Profit Joint Venture Shield: Approximately 23% of PE-owned hospitals operate through joint-venture arrangements with tax-exempt, non-profit health systems. For private equity sponsors, co-branding inpatient rehabilitation facilities (IRFs) or long-term acute care hospitals (LTACHs) with prestigious regional academic health systems provides instant clinical credibility, local payer contracting leverage, and streamlined physician referral pipelines while keeping capital structures largely insulated from public disclosure.

Navigating the Inpatient Private Equity Landscape

The transaction data and regulatory responses point to three structural realities shaping health PE firms have largely pivoted away from buying distressed rural and safety-net general acute care facilities. Instead, capital is consolidating high-margin, specialized post-acute assets—such as Select Medical’s critical illness recovery hospitals, inpatient rehabilitation facilities (IRFs), and occupational health clinics—where commercial and Medicare reimbursement models remain predictable and length-of-stay metrics can be tightly controlled.

With California (OHCA), Massachusetts (HPC), New York, and Minnesota establishing aggressive pre-transaction healthcare review panels, private equity firms can no longer rely on standard 30-day Hart-Scott-Rodino (HSR) antitrust waiting periods alone. Sponsor legal counsel must account for state-level cost-and-market-impact reviews that can delay transaction closes by four to six months.

As PE ownership captures a third of proprietary hospitals, federal and state lawmakers entering the post-midterm legislative cycle are prioritizing statutory definitions of health system beneficial ownership. Bipartisan momentum is building behind legislation to mandate complete disclosure of private equity capital capitalization tables, limit dividend recapitalizations, and restrict master-lease encumbrances on essential community healthcare assets.

Here’s a plausible scenario from the not-so-distant future. It’s 2 a.m. on a holiday weekend, and a hospital’s claims or records system throws an error. This is mission-critical infrastructure we’re talking about, and these systems process mountains of personally identifiable information every hour of every day. Night staff at the security operations center need to know: Is this just a routine glitch or is there an active breach? However, there’s only one person who knows the answer — and she retired last spring.

This kind of nightmare situation should keep everyone involved in healthcare IT up at night. However, the industry tends to obsess over new threats while ignoring this looming risk.  While leaders are rightly worrying about future-proofing their systems against risks like quantum computer decryption, they continue to let the RPG skills gap grow more dire.

That approach is no longer tenable. Demographic trends are backing healthcare IT organizations in a corner, and leaders up against the clock must take action now to ensure knowledge about these systems persists even after the current generation of RPG developers hangs up its hat.

The overlooked layer

Underneath the patient’s portals, mobile apps and analytics dashboards that get all the attention, most hospitals and health systems are still running their core operations on something far less glamorous. Claims processing, patient records, scheduling, billing — the systems that actually keep a healthcare organization solvent and functioning day to day — were mostly built decades ago in RPG and COBOL. These workhorse systems are largely still in place, doing their jobs efficiently and reliably.

These systems predate most of the IT staff now responsible for them. They were built by a generation of developers who understood not just the code but the business logic embedded in it — why a particular field validation exists, why a batch job runs at a specific hour, why an integration point was built the way it was, etc. And because these systems have run reliably for so long, they’ve earned a reputation as “stable.” Stable, in practice, becomes shorthand for “nobody touches it,” which quietly slides into the “nobody really watches it” category.

That’s not a failure of planning so much as a natural consequence of how well these systems work. Organizations facing tighter budgets and more urgent modernization priorities elsewhere had every reason to leave them alone. The result is a layer of healthcare infrastructure that carries enormous risk and enormous responsibility being run by a shrinking pool of people who understand it.

The real risk isn’t the language, it’s the knowledge

It’s tempting to treat RPG and COBOL themselves as the vulnerability — as if the code were somehow less secure simply for being old. But there’s nothing about these languages that’s inherently insecure. The real danger is that fewer people understand how these specific systems behave under normal conditions.

Incident response depends on understanding the baseline. Before anyone can determine whether an anomaly is a routine glitch or an active compromise, someone needs to know what “normal” looks like for that system. This includes things like what a typical batch job produces, which errors are cosmetic, and which are early warning signs, and how the system usually talks to the systems around it. Currently, that knowledge lives in the heads of the people who have spent years watching the system behave.

When that knowledge thins out, it affects everything downstream. A security team that would otherwise triage an incident in minutes instead spends hours just figuring out what they’re looking at. In a breach scenario, those hours matter. And in a healthcare environment especially — where the data at stake is protected, health information and the systems involved often can’t fully recover from extended downtime — those hours can have a direct patient impact.

Not every consequence of the RPG skills gap manifests as a dramatic breach, either. Some of the most pernicious risks are quieter than that — slow leaks rather than sudden ruptures. Think of a permission setting configured years ago for a use case that no longer exists, or an integration point that was patched around rather than properly updated, because updating it correctly would have required understanding design decisions nobody currently on staff was part of. These are the kinds of errors that go unnoticed when no one on staff understands the system’s original design. They don’t show up as an “incident.” At most, they’re a footnote in an audit — until something else goes wrong, and the house of cards comes tumbling down.

Why this gets worse, not better

The trajectory here isn’t going to reverse on its own. The specialists who hold deep RPG and COBOL knowledge are retiring, and the pipeline of people entering the workforce with any level of fluency is barely a trickle by comparison. Organizations that hoped AI would be able to fill the gap are hitting a barrier. While an AI model can help rewrite a COBOL routine into something more contemporary, it can’t tell you why a given routine was built the way it was in the first place or what edge case a seemingly odd piece of logic was written to handle. 

In short, AI lacks the institutional knowledge that made the original team effective. And that context is exactly what matters most in the middle of an incident, when the difference between a fast, confident response and a slow, uncertain one comes down to someone recognizing what they’re looking at.

Knowledge transfer as a security best practice

The instinct in healthcare IT is to treat this as a staffing problem or, at best, an item on a modernization roadmap — something to address eventually, if budget permits. That instinct undersells the stakes. Documentation, cross-training and succession planning for legacy systems belong in the same category as patching schedules and access control reviews: core security hygiene, not “nice-to-haves” that get deprioritized when resources are tight.

Treating institutional knowledge as an asset that needs deliberate protection means building structured processes around it. Organizations should pair veteran RPG and COBOL specialists with newer staff well before retirement is on the horizon so they can document not just what the code does, but why it was built that way. Veteran-rookie teams can work together on incident response runbooks that capture the judgment calls a specialist would make instinctively. This is hardly glamorous work, to be sure, but it could ultimately determine whether a 2 a.m. anomaly gets resolved in twenty minutes or twenty hours.

Where this leaves healthcare IT

Given these challenges, the instinct might be to conclude that the real fix is ripping out this old system entirely and replacing them with something modern. Sometimes that’s the right call (although it’s rarely the fastest). But the more urgent fix is making sure that the knowledge from one retired developer doesn’t represent the loss of an entire cohort of accumulated IT knowledge.

Healthcare cybersecurity professionals have spent years learning to protect networks and data with increasing sophistication. It’s time the industry gives due attention to the knowledge residing in the heads of the people who keep its essential systems running. Preserving that knowledge isn’t a matter of historical curiosity — it’s a security requirement that healthcare can no longer afford to overlook.

About Jennifer Nelson 

Jennifer Nelson has spent the bulk of her career in mainframe space, including 15 years at Rocket Software and five years at BMC. In 2019, she left Rocket to work in senior engineering roles at global technology companies outside of the Z world. In early 2024 Jen began working on what would become Izzi Software, which is currently acquiring software companies on the Z Systems and IBM Power platforms.

What You Should Know

• Washington, D.C.-based digital infrastructure startup Wrapped Health announced the closing of a $2.1M pre-seed financing round co-led by Lightbank and Arteria Capital, the specialized healthcare AI venture fund established by former Headspace CEO Russell Glass.
• The company will deploy the new capital to expand its core product and engineering teams, scale integrations across major electronic health record (EHR) platforms, and deepen commercial distribution with hospital systems, medical groups, and digital health providers.
• The platform addresses an operational gap in outpatient care, where 90% of consumers report receiving over-the-counter (OTC) recommendations from physicians, yet these instructions remain confined to verbal suggestions, handwritten sticky notes, or buried after-visit summaries.

Tapping the $124B Non-Durable Health Economy

While prescription drug spending commands the bulk of health policy debate, consumer-directed wellness represents an immense, largely unmonetized adjacency for health systems. According to figures from the Centers for Medicare & Medicaid Services (CMS), Americans spend nearly $124 billion annually on over-the-counter medicines and non-durable medical goods.

Although provider recommendations drive a significant share of those retail transactions, health systems have historically captured zero economic value, zero downstream attribution, and zero clinical adherence tracking from those purchases.

Wrapped Health positions itself as the enterprise connective tissue linking the clinical consultation to digital retail fulfillment:

• EHR Context Ingestion: Running directly inside clinician charting environments, the software continuously reads clinical encounter notes, diagnostic problem lists, and visit types (such as prenatal visits, orthopedic post-op discharges, or diabetic wound checks) to interpret provider recommendations.
• Agentic Healthcare Commerce: Translates unstructured provider recommendations into structured, one-tap digital carts, matching the clinician’s specific advice with compliant consumer SKUs from major nationwide retailers for same-day delivery or home shipping.
• Native FSA/HSA Unlocking: Automatically checks product eligibility against Flexible Spending Account (FSA) and Health Savings Account (HSA) databases, allowing patients to allocate pre-tax benefit dollars directly at checkout without submitting manual paperwork.

Max Russell-Harris, Co-founder and CEO of Wrapped Health, emphasized the usability disconnect: “Patients can buy almost anything with one click, except the products their doctor tells them they need. Healthcare has built digital systems for prescriptions, labs, and imaging, but there’s still a huge gap when it comes to everyday health products. We’re building that missing connection. It shouldn’t matter whether you’re seeing your local doctor, visiting a major health system, or getting care online. If your provider recommends something, getting it should be the easy part.”

Initial Enterprise Distribution: The athenahealth Foothold

To bypass prolonged hospital IT integration backlogs, Wrapped Health has executed an API-led channel strategy, launching natively inside the athenahealth Marketplace. The initial integration makes Wrapped’s agentic purchasing capabilities immediately accessible to more than 180,000 ambulatory clinicians utilizing the athenaOne cloud platform nationwide. By embedding the product directly into existing ambulatory note-signing and discharge navigators, clinicians can authorize retail recommendations without logging into a third-party portal or altering standard documentation habits.

For years, healthcare provider organizations have pursued automation to improve revenue cycle efficiency. Rules-based workflows, robotic process automation, predictive analytics, and machine learning have each helped reduce manual intervention and accelerate the completion of repetitive tasks.

But reimbursement for specialty healthcare services, such as laboratory, radiology, pathology, and specialty pharmacy, is becoming too complex for efficiency alone to solve.

The challenge facing provider organizations today is not simply the volume of claims they must process. It is the speed at which reimbursement conditions can change, the complexity of determining why payment did not occur as expected, and the operational burden of deciding what to do next—often across thousands of claims simultaneously.

That distinction matters.

The next evolution of revenue cycle management may therefore be less about automating more tasks and more about creating systems capable of recognizing reimbursement friction, determining an appropriate response, taking action within established guardrails, and learning from the outcome.

That is the promise of agentic AI.

The Revenue Cycle Has Become an Information Problem

Traditional revenue cycle workflows were largely designed around transactions: submit a claim, receive a response, correct an error, appeal a denial, post a payment.

Today, reimbursement increasingly depends on a much broader information ecosystem.

Coverage policies change. Prior authorization requirements evolve. Coding and billing rules are updated. Documentation requests increase. Payor edits can affect entire populations of claims. A change that initially appears to be an isolated denial may actually represent a broader adjudication pattern.

The operational challenge is identifying that distinction quickly.

Consider a diagnostic organization accustomed to receiving, on average, 200 requests per month for additional information. If that volume suddenly increases to 15,000, processing each request individually is no longer scalable. Even if adding staff members were practical, it does not address the underlying problem.

The underlying questions that must be considered are strategic:

• What changed?
• Is the activity isolated or systemic?
• Which claims, services, locations, or payors are affected?
• What evidence is required to respond?
• And should the organization continue managing individual transactions—or address the underlying issue?

These are not simply automation questions. They require context, pattern recognition, reasoning, and coordinated action.

From Task Automation to Intelligent Orchestration

Traditional deterministic automation generally begins with a predefined instruction based on rules or business logic: When X happens, perform Y.

That model remains extremely valuable. Many revenue cycle activities are predictable and should be automated in this way whenever possible.

AI, and specifically Agentic AI, introduce a complementary set of capabilities.

Rather than simply executing an assigned task, an agentic system can work toward an objective by gathering information, evaluating conditions, selecting among possible actions, executing approved steps, and assessing the results.

Within healthcare revenue cycle management, that could eventually mean multiple specialized AI agents working together across the reimbursement lifecycle.

For example, an intake agent can be deployed to recognize an incoming payor request. An extraction agent could identify the relevant patient, claim, diagnostic service, and documentation requirements. A strategy agent could evaluate the appropriate response using historical outcomes, payor requirements, and organizational policies. Other agents might navigate external systems, complete forms, assemble supporting documentation, or route exceptions to the appropriate subject-matter expert.

The significant change is not any one of these capabilities.

It is their orchestration.

Instead of asking employees to move between disconnected systems, identify the problem, gather information, determine the next step, and execute it manually, organizations can begin designing systems in which technology coordinates much of that activity while people provide oversight where judgment and expertise matter most.

The Goal Should Not Be an AI Arms Race

There is another important consideration as healthcare organizations adopt increasingly sophisticated technology.

The conversation about AI in reimbursement can easily become adversarial: payors automate, therefore providers must automate faster.

That framing misses a larger opportunity.

Payors have legitimate responsibilities related to appropriate utilization, coverage criteria, payment integrity, and affordability. Provider organizations have equally important responsibilities to deliver medically appropriate services, document those services accurately, and support appropriate and timely reimbursement.

Both sides also bear the cost of unnecessary administrative complexity.

A claim that generates repeated documentation requests, manual reviews, appeals, and resubmissions creates expense throughout the healthcare system. Reducing avoidable friction should therefore be a shared objective.

AI may provide an opportunity to identify where that friction originates.

For example, if thousands of claims begin receiving the same request or denial, AI can help provider organizations identify the pattern earlier. That information can support a more productive conversation with the payor: What is driving the change? Is additional information required? Has an adjudication rule changed? Is there an unintended consequence that should be addressed?

Used effectively, AI can help move the relationship from transaction-by-transaction dispute resolution toward data-informed problem solving.

That is a far more valuable application than simply automating one stand-alone task in a workflow.

Human Expertise Becomes More Valuable, Not Less

Agentic AI also raises an understandable question: If technology can determine and execute the next action, where does that leave the revenue cycle professional?

The answer may be that expertise becomes even more important.

AI systems still require objectives, guardrails, escalation thresholds, validated data, and accountability. They also need people capable of recognizing when an automated conclusion does not reflect clinical, regulatory, contractual, or reimbursement reality.

Experienced reimbursement professionals possess something extraordinarily difficult to replicate: context.

They understand that two denials carrying the same adjustment code may have very different underlying causes. They recognize when a payor request is unusual. They understand the difference between a coding issue and a coverage issue, or between an isolated processing error and an emerging reimbursement trend.

The objective should therefore not be to remove humans from revenue cycle management.

It should be to change where human expertise is applied.

Instead of asking highly experienced professionals to spend much of their day finding information, moving between portals, assembling documents, and repeating predictable actions, AI can potentially absorb more of that administrative work.

People can then concentrate on exceptions, strategy, policy interpretation, payor engagement, and complex reimbursement decisions.

Speed of Learning May Become the Real Competitive Advantage

Perhaps the most consequential benefit of agentic AI is not faster claim processing.

It is faster organizational learning.

Historically, diagnostic organizations may not recognize a reimbursement issue until denial volumes increase, accounts receivable ages, or payment trends deteriorate. By that point, weeks or months of claims may already be affected.

A more intelligent revenue cycle creates the possibility of compressing that timeline:

Signal → Pattern → Insight → Action → Outcome → Learning

Imagine detecting an unusual increase in a denial category within days rather than months. The system identifies the affected claim population, evaluates common attributes, compares the pattern against historical behavior, and alerts a reimbursement expert that the activity may represent an emerging payor issue.

The expert validates the finding and determines the appropriate intervention.

The outcome then becomes part of the organization’s institutional knowledge.

Over time, the advantage is no longer simply that one organization processes claims faster than another. It is that the organization recognizes changes in reimbursement patterns earlier and adapts more quickly.

Preparing for an Agentic Revenue Cycle

The transition will not happen simply by purchasing an AI tool.

Organizations considering agentic capabilities should first examine the foundations of their revenue cycle: data quality, workflow standardization, interoperability, governance, escalation protocols, and measurable outcomes.

They should also be deliberate about where autonomy is appropriate.

A low-risk administrative task may require little human intervention. A complex coverage determination, significant payor escalation, or decision involving regulatory interpretation may require considerably more oversight.

The appropriate model is not unrestricted autonomy.

It is graduated autonomy supported by strong governance and guardrails—allowing technology greater independence where the rules, evidence, and risk tolerance support it while preserving human judgment where the consequences are greater.

That distinction will become increasingly important as AI capabilities mature.

The Next Question for Revenue Cycle Leaders

The first era of revenue cycle automation asked:

• What tasks can we automate?

The next era will ask:

• What outcomes can intelligent systems help us achieve?

That is a fundamentally different question.

For healthcare leaders, the opportunity is not simply to process more claims with fewer manual touches. It is to build a reimbursement operation capable of detecting change earlier, understanding its implications faster, responding more intelligently, and continuously learning from the results.

Agentic AI will not eliminate reimbursement complexity. Nor will technology replace the need for productive collaboration among provider organizations, payors, clinicians, policymakers, and patients.

But it can change how effectively organizations navigate that complexity.

And ultimately, that may be the more meaningful transformation: moving revenue cycle management from a predominantly reactive function toward an increasingly adaptive one.

About Clarisa Blattner, CCS, CPC

Clarisa Blattner is the Senior Director of Reimbursement Strategy & Industry Affairs at XiFin, Inc. She serves as a subject matter expert in revenue cycle management (RCM) and payor and market strategies, focusing on achieving operational efficiencies and maximizing revenue. With over 25 years of experience in the healthcare sector, Clarisa has an extensive background in revenue cycle management, particularly within the healthcare industry. Previously, she oversaw the billing and reimbursement operations for the outsourced billing department

What You Should Know

• Healthcare language access and technology leader Equiti officially announced the acquisition of Lexi AI, an award-winning healthcare artificial intelligence language interpretation company.
• The transaction unifies Lexi’s on-demand artificial intelligence interpretation with Equiti’s established Martti platform, creating an integrated hybrid language access architecture across clinical and administrative workflows.
• Equiti introduces its proprietary Modality Matters framework, an operational delivery model designed to match each clinical interaction to the appropriate channel—deploying immediate, purpose-built AI for lower-risk, approved scenarios while preserving human medical interpreters for complex clinical decisions, policy mandates, or patient requests.

Engineering the “Modality Matters” Framework

Rather than treating generative AI and certified human medical interpretation as opposing technologies, Equiti is deploying a dynamic triage methodology it terms Modality Matters. The operational framework allows hospitals and ambulatory clinics to match every patient communication touchpoint with the clinically and legally appropriate interpretation channel:

• Purpose-Built Healthcare AI via Lexi: Lexi provides instant, low-latency AI interpretation across more than 35 languages and dialects, engineered specifically for medical terminology and integrated natively into electronic health record (EHR) communications and telephony workflows.
• Accredited Human Expertise via Martti: Martti delivers 24/7 on-demand video and audio access to human medical interpreters across more than 250 languages and dialects (including American Sign Language). Interpreters are backed by a rigorous 120-hour clinical curriculum, annual continuing education, quality assurance audits, and specialized clinical coaching via Martti University.
• Dynamic Real-Time Escalation: If an interaction begins in an automated AI mode—such as a routine nursing vitals check—and suddenly uncovers an acute clinical risk or diagnostic complexity, the clinician can dynamically shift the session to a live, qualified Martti medical interpreter in real time without dropping the encounter.

Maureen Huber, CEO of Equiti, framed the transaction’s strategic intent: “AI is opening a new chapter in language access, and Equiti is committed to leading it responsibly. This is an investment in the next generation of language access, bringing Lexi’s capabilities together with Martti’s human expertise so healthcare organizations can put patients first while strengthening the performance of their language access programs.”

From Academic Innovation to Enterprise Scale

Lexi was founded by Linh Pham and Siddharth UR as an advanced design engineering and health-tech initiative at Harvard University, earning industry recognition as the 2025 Grand Prize winner of the Peter M. Sacerdote Award in the Harvard Business School New Venture Competition (Social Enterprise Track).

Unlike horizontal voice-translation applications that struggle with nuanced clinical jargon, Lexi was co-designed directly with healthcare providers to accommodate noisy hospital acoustics, dialectal idioms, and complex anatomical descriptions:

Executive Integration

Following the transaction, Linh Pham joins Equiti’s executive leadership team as President, with co-founder Siddharth UR stepping into the role of Head of Innovation. The deal leverages Equiti’s market position, backed by private equity firms GTCR and Heritage Group (which acquired and unified Cloudbreak Health and Voyce under the Equiti banner). Equiti currently handles over 1.5 million clinical care sessions each month, supporting more than 4,000 healthcare facilities nationwide, and ranks among the top five healthcare interpreting providers in the global Nimdzi 100 and Slator Language Service Provider Index.

Linh Pham, co-founder and CEO of Lexi, highlighted the cultural alignment: “Joining Equiti brings together two teams with complementary experience and a shared commitment to patient-centered language access. By combining Lexi’s healthcare AI expertise with Equiti’s decades of language access leadership and qualified interpreter network, we can support more people across more moments of care.”

When was the last time your team won an appeal on a clinical validation downgrade? If you have to stop and think about it, you are not alone.

Payer behavior has made this harder than it used to be. Clinical validation audits are driving a marked rise in Diagnosis-Related Group (DRG) downgrades, forcing hospitals to defend diagnoses that, for years, were accepted on the strength of a physician’s documentation alone. As audits grow more frequent and the criteria keep shifting, traditional coding and documentation practices no longer secure full reimbursement.

The exposure is real. In 2025, hospitals spent nearly $18 billion overturning claims denials, according to the American Hospital Association. Against margins this thin, even a modest rate of downgrades adds up quickly.

But the teams that protect the most revenue don’t just win more appeals. They reduce their exposure earlier, before claims are submitted and contracts are signed.

Understanding the difference between DRG and clinical validation audits

Traditional DRG validation audits confirm that diagnoses and procedures are coded and sequenced correctly, in line with the official ICD-10-CM guidelines. In that review, a provider’s statement that a condition exists is generally enough for code assignment, because the focus is on applying coding rules rather than second-guessing the clinical reasoning behind the diagnosis.

Clinical validation audits work differently. Since their introduction in the 2011 Recovery Audit Contractor (RAC) Statement of Work, payers have applied a separate standard, testing whether objective evidence in the medical record, such as laboratory results, imaging, clinical signs, and treatment response, supports the diagnosis itself. Here the clinician’s opinion, however expert, is not the deciding factor. A correctly coded diagnosis can still be disputed if the payer decides the record does not support it.

The practical effect is significant. A case coded correctly as sepsis can be downgraded to a less severe infection, or removed entirely, if the payer judges the objective evidence insufficient.

What’s driving the increase

The rise in downgrades is not random. Payers are deploying machine learning and audit tools that flag far more claims for review, and the diagnoses that carry the highest reimbursement, such as sepsis, acute respiratory failure, acute kidney injury, and severe malnutrition, are the most frequent targets.

Adding to the friction, payers often apply different clinical criteria than the treating physicians. For example, clinicians have largely moved to Sepsis-3 definitions, yet many payers still review claims against Sepsis-2. Neither the ICD-10-CM Official Guidelines nor AHA Coding Clinic requires Sepsis-3 for diagnosis coding, so a payer imposing that threshold is applying a standard that exceeds CMS coding guidance. That is a contestable overreach, not a legitimate basis for denial, but only if your team recognizes it as one.

There’s a deeper, structural problem. Payers, clinicians, and federal programs often apply different criteria to the same DRG, and most contracts say nothing about how downgrades will be handled, so hospitals start at a disadvantage before any appeal is filed. Payers can also change terms with little notice, since many contracts let an amendment take effect without the provider’s signature. Payers can introduce new criteria or downgrade procedures without warning, in part because many contracts contain language stating that “the signature of Provider will not be required in order for the amendment to take effect.”

Get the terms right before a dispute

The best defense against a downgrade is written into the contract long before a claim is audited. When negotiating or renewing payer agreements, several provisions are worth asking for.

• Defined, published criteria. Require payers to use recognized, published clinical definitions rather than internal or undisclosed criteria when questioning a diagnosis.
• Physician-level review. Mandate that only a qualified physician, not a coder or an algorithm, can overturn a treating physician’s documented diagnosis.
• Peer-to-peer rights. Guarantee your physician a direct conversation with the payer’s reviewing physician before a downgrade is finalized.
• Advance notice of changes. Require written notice before any change to clinical criteria or downgrade procedures takes effect.
• Audit limits. Set explicit caps: a percentage limit (e.g., no more than 5% of DRG claims reviewed per quarter), a fixed volume limit, a defined lookback window such as 12 months from date of service, and restrictions on extrapolating findings from a small sample across a broader population of claims.

Regulation can reinforce these positions. Under CMS-4208-F, effective January 1, 2026, once a Medicare Advantage plan approves an inpatient admission, it generally cannot reverse that approval based on information gathered after the fact, absent fraud or obvious error. Hospitals unaware of that protection may be conceding reversals they no longer have to accept.

Close the gaps you cannot negotiate away

Contract terms reduce exposure, but they do not eliminate it. The rest of the defense is operational.

• Validate high-risk DRGs before billing. A pre-bill clinical validation review on those high-risk DRGs catches weak documentation while it can still be fixed.
• Make CDI concurrent, not retrospective. Documentation gaps are far easier to close during the encounter than after discharge, and a concurrent query is far more effective than a post-discharge appeal.
• Monitor trends by payer and DRG. Track how often downgrades occur and which payers and diagnoses drive them. A repeated pattern from one payer on one DRG is a signal of systemic audit activity, and for public payers it can precede extrapolated recoupment across a wider set of claims.
• Measure what overturns denials. Analyze which appeal strategies succeed and apply those lessons across the organization. In Medicare Advantage, roughly 57% of denied claims are ultimately overturned, a sign that a large share of denials are reversible when challenged. The revenue is recoverable, if your process is built to capture it.

Moving forward

The teams that protect the most revenue treat audits as moving targets and defend accordingly, starting with the contract, reinforced at the point of care, and backed by the discipline to spot patterns early. Handled that way, DRG downgrades stop being an unpredictable drain and become a manageable, measurable part of revenue integrity. There’s a clinical payoff, too. When you run the revenue side this way, physicians and coding teams spend less time defending documentation after the fact and more time on the patients in front of them. Few teams can sustain this alone, and no contract enforces itself, so the strongest defenses pair disciplined internal work with the right outside expertise.

And the next time someone asks when your team last won a clinical validation appeal, you’ll have an answer ready.

About Adele Frias

Adele Frias is Vice President of Specialty Revenue Cycle Solutions, EnableComp.

Artificial intelligence (AI) has now reached a crucial tipping point in the way U.S. healthcare plans carry out their operations. A study by Everest Group, supported by Sagility, found that 70% of health plans have introduced AI tools to streamline both administrative and clinical activities. Nevertheless, 84% of payer executives say that they have seen limited benefits from these implementations and just 10% have noticed measurable improvements in operations.

The fact that these systems are not aligned points to a fundamental error in the digital transformation of healthcare, namely the belief that simply adding automated tools to the scattered existing infrastructure will automate the current state of chaos instead of enabling operational efficiency.

Healthcare administrative spending in the U.S. is approximately $1 trillion annually, costs that result in part from manual processes, complex clinical reviews, and the lack of systems integration. Although technology frequently functions as a quick fix, achieving true operational efficiency involves some fundamental rework. Before introducing automated tools, health plans should re-engineer their workflows end-to-end to ensure the optimal use of AI. Only by restructuring workflows will health plans harness AI as an intelligence amplifier for human healthcare experts to implement specialized clinical judgment rather than replace it.

The Flaw of Overlaying Tech on Legacy Chaos

For many years the administrative and clinical operations of health plans have worked in isolation. The handling of claims, utilization management (UM), payment integrity, and member services have usually depended on separate platforms, manual transfers between them, and outdated rules engines.

When health plans try to modernize by adding AI models or robotic process automation (RPA) directly onto these disjointed systems, the fundamental problems still exist. Imagine an AI system that flags claims for investigation. If the underlying contract terms or prior authorization rules are wrong, the AI may identify thousands of claims that never needed review in the first place. Instead of saving time, claims staff are left sorting through unnecessary alerts and correcting avoidable errors.

To achieve a meaningful return on investment, healthcare operations must build a stronger operational foundation by standardizing workflows, improving data quality, and establishing consistent governance before deploying AI and automation at scale.

Indeed, AI code depends on health plans mapping the full lifecycle of a transaction, whether it’s a prior authorization request or a complicated inpatient claim. Identifying policy gaps, eliminating redundant hand-offs, and standardizing data inputs creates the necessary operational baseline. Technology can deliver true scalability and efficiency only on a clean, connected foundation.

Why AI Is an Intelligence Amplifier Paired with Domain Expertise

A related misconception in the field of healthcare technology involves the idea that AI is a solo solution that can solve complex problems entirely on its own. By extension, AI can replace human expertise entirely, including in complicated administrative and clinical processes. Yet, research reveals that 94% of payer executives stress the importance of having human oversight when introducing automated tools.

Healthcare operations depend on deep clinical, payment integrity, and operational knowledge that generic algorithms can’t replicate. Healthcare is by its nature complex, dynamic and full of high stakes. Although AI is good at processing large amounts of data, recognizing patterns and automating routine administrative work, it lacks the kind of nuanced reasoning needed for complex decisions. In clinical areas like UM, complex case management and claims appeals, full automation opens the door to substantial financial and regulatory risk.

Augmented intelligence is the best method of handling this complexity. Technology from this point of view amplifies intelligence for registered nurses, certified coders, and claims specialists. For example, generative AI tools help RNs by examining hundreds of pages of unstructured medical records, and clinical history and comparing the data with evidence-based protocols within minutes. RNs can then review the combined evidence to make the final clinical decision.

Instead of focusing on pure automation, organizations should redesign their operating models so AI and healthcare professionals work together as an orchestrated team. This human-in-the-loop approach greatly reduces manual review times without losing the important clinical judgement of experienced healthcare professionals. It changes frontline experts from administrative paper-chasers into valuable decision-makers.

Knocking Down Silos Across the Claims and Clinical Lifecycle

AI and automated decision engines can only deliver on their promise when fed clean, integrated data across the entire organization. For health plans to achieve sustainable financial and operational value from these technologies, they need to break down the barriers separating clinical oversight from financial settlement. Usually, functions like UM and payment integrity have worked as separate, reactive departments. Payment integrity in particular has been concerned with post-pay recovery, pursuing improper payments months after claims have been resolved.

Connecting operations across the entire claims lifecycle creates a continuous feedback loop that directly links workflow redesign to measurable clinical and financial outcomes:

• Prevent: By carrying out clinical interventions at the upstream level, agreeing on prior authorization, and validating benefit configurations, errors are prevented before adjudication occurs, improving first-pass accuracy.
• Detect: Before any payment is made, high-impact editing rules, pre-payment clinical reviews, and risk-scoring algorithms flag potential overpayments or coding anomalies, mitigating financial leakage.
• Resolve/Recover: Outlier claims are sent to specialized auditors and clinicians for a specific review, while normal claims go through without issue, reducing administrative burden and provider abrasion.
• Learn: The root causes are identified by systemically analyzing the findings from downstream audits, appeal outcomes, and payment trends, driving better decision-making.
• Prevent (continuous feedback): Insights gained from post-pay findings fed back into upstream configuration, clinical guidelines and adjudication rules to prevent repeated errors.

When clinical context, contract logic, and processing of claims work together as an integrated ecosystem powered by re-engineered workflows and domain-specific AI, health plans reduce the number of errors on the first submission, remove provider friction and cut down on administrative overhead.

The Path Forward Through Intelligent Operations

With narrow profit margins a common concern for health plans, along with changing CMS requirements and persistent clinical workforce shortages, technology ROI will become increasingly important. 

To future-proof payer operations, the path forward is domain-led intelligent operations, a strategy that combines the use of purpose-built AI, re-engineered workflows, and licensed healthcare professionals who are familiar with the intricacies of clinical care and payment policy. By giving priority to workflow design, human-AI orchestration, and deep healthcare expertise, health plans will finally be able to bridge the AI ROI gap and secure both financial and operational resilience.

About Anand Biradar 

Anand Biradar is the Chief Go-to-Market Strategy & Enterprise Transformation Officer at Sagility.

Over the past two years, healthcare leaders have been forced to rethink what operational resilience really means.

The cyberattack on Change Healthcare demonstrated how dependent providers had become on a single third-party platform for everything from claims processing to cash flow. The attack on Ascension showed how quickly disruptions to technology can spill over into clinical operations, delaying care, forcing clinicians back to paper documentation, and disrupting the day-to-day functioning of hospitals across the country. While the headlines focused on cybersecurity, both events underscored a much broader lesson: healthcare organizations are only as resilient as the network of third parties they depend on every day.

Most hospitals responded by strengthening cybersecurity, evaluating supplier risk, and reassessing business continuity plans. Those were the right priorities. But another question deserves equal attention. Do hospitals truly understand every third party that has meaningful access to their facilities, systems, and operations?

For decades, vendor credentialing has been built around a straightforward assumption: the highest risk comes from the people working closest to patients. That philosophy shaped accreditation standards, influenced hospital policies, and created rigorous oversight for medical device representatives and other clinical vendors entering operating rooms and procedural areas.

It was an effective model because it reflected the way hospitals operated at the time. Today’s hospitals operate very differently.

Modern health systems rely on an extensive network of third-party personnel who rarely fit the traditional definition of a clinical vendor. Biomedical technicians maintain connected medical equipment. Facilities contractors oversee mechanical systems that support patient care environments. Environmental services teams work throughout patient units. Food service vendors, elevator mechanics, security contractors, IT specialists, construction crews, and maintenance personnel move throughout hospitals every day to keep operations running.

Most of these individuals never step inside an operating room. Many have access to patient care areas, restricted spaces, connected technologies, or critical infrastructure that directly supports clinical operations. Yet they often fall outside the oversight models hospitals originally built for vendor credentialing.

That disconnect is becoming increasingly difficult to ignore because the nature of hospital risk has changed.

Healthcare has become one of the most operationally complex industries in the world. Clinical care depends on digital infrastructure. Building systems are increasingly connected. Medical devices communicate across networks. Critical utilities are monitored electronically. Hospitals rely on outside organizations not simply to deliver products but to maintain the systems that allow patient care to continue uninterrupted.

In other words, operational resilience and patient safety are no longer separate conversations.

A contractor repairing an air handling unit serving an intensive care unit may never interact directly with a patient, but the reliability of that system is fundamental to patient care. A biomedical technician servicing network-connected infusion pumps may never be classified as a traditional clinical vendor, yet their work intersects with cybersecurity, clinical engineering, and operational continuity. Even environmental services personnel routinely move throughout patient care areas where infection prevention, physical security, and operational efficiency all converge.

None of these examples represents an unusual circumstance. They represent an ordinary day inside a modern hospital. The challenge is that many credentialing programs continue to reflect yesterday’s assumptions about where vendor risk exists rather than today’s operational reality.

Healthcare has invested years building thoughtful credentialing programs that have strengthened accountability and improved patient safety. The issue is that those programs were designed around a narrower understanding of third-party access than hospitals manage today.

Expanding oversight does not mean treating every contractor exactly the same. A one-size-fits-all approach would simply create more administrative work without producing better outcomes. Instead, hospitals should begin thinking about third-party oversight the same way they approach enterprise risk management. The question should no longer be whether someone fits into an existing credentialing category. The better question is what level of operational risk that individual presents based on where they work, what systems they access, and how their activities could affect patient care or hospital operations.

That requires moving away from static credentialing toward a more dynamic understanding of third-party risk.

Annual verification may satisfy a compliance requirement, but it does little to address the reality that contractor assignments change, certifications expire, organizational relationships evolve, and access requirements shift over time. Hospitals have embraced continuous monitoring in cybersecurity because they understand risk changes every day. Third-party oversight should evolve with that same mindset.

The organizations making the greatest progress are also recognizing that vendor oversight is no longer the responsibility of a single department. It sits at the intersection of supply chain, facilities, clinical engineering, information security, compliance, infection prevention, and executive leadership. As hospitals become more interconnected, so do the risks they manage.

What Hospital Leaders Should Do Next

Rather than expanding existing credentialing programs indiscriminately, healthcare organizations should focus on aligning oversight with how hospitals actually operate today.

The first step is understanding the full third-party ecosystem. Many organizations have mature oversight for clinical vendors while maintaining far less visibility into facilities contractors, service providers, maintenance personnel, and other operational partners. Hospitals cannot effectively manage risks they have never fully defined.

Next, leaders should evaluate whether credentialing reflects current risk or historical assumptions. Oversight should be based on the environments individuals enter, the systems they access, and the potential operational impact of their work instead of broad job categories that may no longer reflect reality.

Hospitals should also rethink credentialing as an ongoing operational capability rather than a point-in-time administrative exercise. Continuous visibility into who is entering facilities, whether requirements remain current, and how access changes over time provides a more accurate picture of organizational risk than periodic verification alone.

Finally, third-party oversight should become part of broader enterprise resilience planning. The strongest organizations increasingly recognize that operational resilience depends on understanding not only the technologies that support patient care, but also the people who install, maintain, repair, and access them every day.

Healthcare has spent decades refining how it manages clinical risk. The next chapter is recognizing that operational resilience depends just as much on the people working behind the scenes as those delivering care at the bedside.

Hospitals know how to secure the operating room. The greater challenge, and the greater opportunity, is ensuring they have the same level of confidence in everyone else who walks through their doors.

About Mickey Meehan

Mickey Meehan is CEO of Green Security, where he works with healthcare organizations to strengthen vendor governance, credentialing, and operational resilience. With more than two decades of experience across healthcare operations, supply chain, and technology, he has held executive leadership roles at Premier, Mobitor, Zimmer, and MedPricer, helping health systems navigate complex purchasing, vendor, and workflow challenges.

The difference matters more than it first appears. A duplicate email is an annoyance. Treating a caregiver as the patient, or carrying a permission from one program into another, damages trust that rare-disease companies spend years building. Yet patient CRM modernization is usually planned as a platform or campaign migration. The harder work is deciding who each record represents, what communication it permits, how quickly changes reach every system, and who answers for the data when it is wrong.

In 2025 I led the data integration and migration workstream of a patient CRM modernization at a rare-disease company. We connected nine integrations spanning six websites, a patient-services environment and a legacy CRM. In the first 75 days after cutover, internal reporting showed 30% less time to plan and execute patient communications and 45% less rework from changing requirements; we later presented these results at an industry conference. These are operational results; they say nothing about clinical outcomes. The four decisions behind them apply to any technology stack.

1. Identity is a decision about relationships

The visible part of a CRM migration is rebuilding messages and campaigns. We began with a data audit and a ranked inventory of campaigns instead. Before moving any journey, we had to establish whether two records described the same patient, and whether the person acting on that patient’s behalf was someone else entirely.

Record matching is a known weak spot in healthcare. In 2018, The Pew Charitable Trusts reported that as many as one in five patients may not be matched correctly to their records even within a facility they have visited before. Marketing databases differ from clinical records, but the lesson carries over: a missed match and a false match fail in different ways, and a false match can pose a more serious privacy risk.

Our team wrote the identity and reconciliation rules together with the business owners: which identifiers could support a match, which uncertain cases went to a person for review, and how a caregiver stays linked to a patient while remaining a separate record with separate permissions. Fewer records was a side effect. The goal was an accurate account of who takes part in each relationship and whose consent applies.

2. Consent has to work wherever the data goes

A disease-awareness registration, a copay enrollment and a request for product updates grant different permissions. When those choices are scattered across platforms, compliance rests on campaign builders remembering every exception.

We made consent part of the data model: purpose, channel, source, date and withdrawal status. Eligibility is checked when an audience is activated, and a marketing opt-out stays separate from the service messages a patient still needs. Access to sensitive information is governed on its own track, with procedures reviewed through our data governance process.

Standards help with half of this. The HL7 FHIR Consent resource gives healthcare a common way to record a consent decision, and its specification states plainly that enforcement is out of scope and left to access-control mechanisms. A well-recorded permission protects no one until every downstream workflow honors it. That is why we tested withdrawals, exceptions and channel-specific rules with the same care as new opt-ins.

3. Agree on meaning and timing before you integrate

One-off integrations can turn every new campaign into a new engineering project. We standardized the single path by which website registrations, program data, patient-services records and legacy history enter the engagement environment, pass through reconciliation and become available for segmentation. Standardizing the integration path reduced the need to rebuild data pipelines when campaign requirements changed. Across the migration, internal reporting showed a 45% reduction in rework associated with requirement changes.

Timing deserves the same attention. Our sources refresh four times a day, which suits scheduled outreach and falls short of real-time interoperability. An event-triggered journey can only react as fast as the data that feeds it. For every new use case, decide how fresh the data must be, how late-arriving changes are handled and which events need a different integration pattern.

My 2026 reference architecture for FHIR-enabled healthcare CRM describes six integration patterns, among them identity matching, consent enforcement, terminology normalization, bulk synchronization and event-driven subscription. The migration predates that paper and did not implement it. Looking back, the experience reinforces a distinction my research also addresses: integration patterns define how systems exchange and manage data, but organizations must still establish who owns the data, resolves conflicts and governs its use.

4. Every important signal needs an accountable owner

Web registrations, patient-services data and legacy CRM history are usually maintained by different teams. Connecting the systems does not settle what a field means, when it should change or which source wins a conflict.

We assigned owners to the critical sources and fields and brought those owners into design decisions from the start. Definitions got resolved upstream, once, so campaign teams downstream stopped reinterpreting conflicting signals. Governance became part of the architecture from the first design meeting.

Four questions before the next integration

Before approving another patient CRM integration, I would ask:

1. Can we tell the patient from the caregiver?
2. Can every activation show the permission it relies on?
3. Do we know when each signal becomes available, and is that soon enough for the message it drives?
4. Who fixes the data when the answer is wrong?

Go back to the daughter and her father. Connecting their records may make communication more efficient, but earning their trust requires something more: recognizing each person’s role, honoring their individual preferences, and ensuring those choices are reflected before communications are sent. That is the difference between connecting patient data and building a reliable patient relationship.

About Jaymin Sutarwala

Jaymin Sutarwala is Associate CRM Strategy & Operations Director at United Therapeutics, where he leads the CRM platforms that support commercial and medical teams. His research on healthcare CRM architecture and patient privacy appears in peer-reviewed and open-access journals.

Sources cited in the text:

• The Pew Charitable Trusts, “New Report Lists Steps to Improve Patient Matching Across Electronic Health Records”, 2 October 2018.
• HL7 FHIR R4, Consent resource, section 6.2.3 “Background and Context”.
• J. H. Sutarwala, “A Reference Architecture and Integration Pattern Catalog for FHIR-Enabled Healthcare CRM Systems”, 2026, doi:10.5281/zenodo.19163604.

Healthcare executives often evaluate artificial intelligence with a familiar checklist: model accuracy, integration effort, implementation time, and license cost. That list omits the expense that determines whether an administrative AI project creates capacity or creates another system to supervise. The missing line item is exception handling.

The demand is real. In its 2026 Physician Survey on Augmented Intelligence, the American Medical Association reported that 81 percent of respondents were aware of or used AI in practice. Seventy-three percent expected administrative automation to improve physician well-being and burnout. The same survey found that physicians placed high importance on validated safety and efficacy, privacy assurances, and involvement in adoption decisions. Buyers are therefore trying to solve two problems at once: reduce operational burden and preserve accountable human control.

Feature comparisons hide operational work

A product demonstration usually shows a clean case. The input is complete, the identity matches, the portal is available, and the action follows a known rule. Real queues contain missing demographics, duplicate records, expired credentials, unclear orders, payer discrepancies, unreachable contacts, and policy questions. Those cases do not disappear when the routine path becomes faster. They become a separate queue that somebody must detect, investigate, route, and close.

This changes the economics. A tool can automate a large share of individual steps while increasing management work if staff must watch dashboards, interpret failures, and repair incomplete cases. License utilization may rise while backlog age, rework, and staff interruptions remain unchanged. A business case based only on tasks automated or minutes saved will miss that transfer of work.

Define the unit of value

Procurement teams should define value as a completed, in-scope outcome with evidence. For an eligibility queue, completion might require a verified response stored in the approved system before the visit. For a referral queue, it might require the document to be matched, indexed, advanced to the next task, and escalated when identity is uncertain. The unit should be observable and auditable.

That definition lets leaders compare software, outsourced services, staffing, and managed automation on the same basis. It also prevents a common measurement error: treating an attempted action as completed work. Calls placed, messages generated, and documents classified are activity measures. They matter, but they do not establish that the queue reached its agreed final state.

Price the exception path

Every proposal should state what happens when the normal path fails. Which administrative exceptions will the vendor resolve? How long will it continue working a case? What evidence will it retain? When must clinic staff intervene? Which decisions always remain with an authorized person? If these questions are unanswered, the buyer cannot estimate the actual operating cost.

A practical scorecard should separate routine completion, administrative exception resolution, and practice intervention. It should track eligible cases received, cases completed, turnaround time, backlog age, reopened work, unresolved exceptions, and staff touches. The goal is not a perfect automation rate. The goal is reliable capacity with a visible boundary around human authority.

Treat governance as part of the workflow

Governance cannot live only in a policy document. The NIST AI Risk Management Framework emphasizes managing risk across the AI lifecycle. In operations, that principle should appear in access controls, approval rules, escalation paths, logs, testing, and post-deployment monitoring. A Business Associate Agreement may be required, but it does not define who may change a code, make a clinical determination, accept a financial term, or act for a patient.

The same operating discipline supports the HHS guidance on HIPAA risk analysis. Buyers should map each workflow’s systems, data, permitted actions, retained evidence, and fallback procedures before expanding scope. This makes governance measurable instead of aspirational.

Start with one live queue

The most credible ROI study begins with one bounded queue and includes failure modes from the start. Capture the baseline backlog, completion time, staff effort, rework, and exception mix. Run normal cases alongside missing information, access failures, identity mismatches, and policy exceptions. Measure whether the queue closes with less staff attention while decisions outside the approved boundary still reach the right person.

Healthcare organizations do not need another favorable demonstration. They need a financial model that includes the work left behind when the happy path ends. Once exception handling appears as a priced, measured part of the operating model, leaders can tell whether an AI investment creates capacity or merely moves the burden to a different screen.

About Feynman Xu

Feynman Xu, Ph.D., is the founder and CEO of MedArise, which provides managed AI employees for defined administrative workflows in medical practices. His work focuses on workflow ownership, exception handling, and clear human authority in healthcare operations.

What You Should Know

• Clinical artificial intelligence search platform Vera Health announced the closing of a $28.5 million Series A funding round led by Threshold Ventures.
• The financing included participation from Mantis VC and SV Angel, with existing institutional backers Y Combinator and Gradient tripling down on their initial investments, bringing total capitalization to $32M.
• Operates at high capital and workforce efficiency: with an engineering and clinical team of only 12 employees, the platform has scaled to more than 800,000 clinicians across 190 countries, largely through peer recommendations.
• Penetrates key international provider markets: platform adoption includes approximately 1 in 4 practicing physicians in Spain and Italy, and 1 in 7 physicians in France.

The Architecture of Truth: Inverting the Generative Paradigm

Unlike generic AI assistants that generate text probabilistically and search for citations as a post-hoc justification, Vera Health operates on an inverse architecture: it retrieves and grades the evidence first, and only writes the answer second.

• Exhaustive Corpus Ingestion: The search engine continuously indexes more than 60 million peer-reviewed biomedical publications, clinical practice guidelines, consensus statements, and FDA/EMA drug labels.
• Algorithmic Level-of-Evidence Grading: Rather than weighting search results purely on keyword density or text semantic similarity, Vera’s retrieval pipeline programmatically evaluates underlying study designs, sample sizes, cohort power, publication recency, journal impact factor, and citation velocity.
• Making Uncertainty Visually Explicit: Every claim generated in a clinical summary is dynamically color-coded based on the strength of supporting evidence. When data on an orphan disease or novel off-label therapy is limited to a small retrospective case series, Vera flags the assertion in red—explicitly warning the treating physician that the underlying evidentiary ground is thin.
• Medical Society Policy Integration: Through a formal institutional partnership with the American College of Emergency Physicians (ACEP), Vera embeds official clinical policies and clinical decision trees directly into bedside search results, with source attribution verified against medical society standards.

12 Employees, 190 Countries, and Viral Clinician Referrals

Vera Health’s growth trajectory stands as an anomaly in enterprise healthcare software, where scaling typically requires massive direct sales forces and lengthy hospital procurement cycles:

• Massive Adoption Velocity: One year ago, Vera counted a few thousand active clinicians. Today, more than 800,000 healthcare professionals across 190 countries utilize the platform daily, querying the engine hundreds of thousands of times every single day.
• App Store Dominance: Every month since June 2026, Vera has ranked as the most downloaded clinical mobile application globally across both the Apple App Store and Google Play. In September alone, the platform logged more downloads than incumbent clinician networks OpenEvidence and Doximity combined.
• International Market Saturation: The platform has achieved notable penetration across European healthcare systems through peer-to-peer physician word-of-mouth, capturing approximately one in four practicing physicians in Spain and Italy, alongside one in seven physicians in France.
• Extreme Organizational Efficiency: Operating with a lean founding team of only twelve employees, Vera has maintained a zero-dollar enterprise marketing budget, driving user acquisition almost exclusively through peer-to-peer clinician recommendations.

Taieb Bennani, Co-founder of Vera Health, framed the platform’s core operating ethos: “Clinicians are the best data scientists I’ve ever met. They make the call in seconds, with more evidence than any human could ever read. The secret to building for them is to live and breathe the problem like no one else. Everyone on our team is a clinician, or the child or sibling of one, like Maxime and me. That passion translates into every detail of the product, and when you build with that kind of obsession, the product speaks for itself, and clinicians share it with their colleagues. We don’t have the biggest team or the most money. We have the people who care the most about getting it right.”

Localized Practice via “Vera Spaces”

A major barrier to global medical AI adoption is geographic divergence in clinical practice: a cardiology pathway in Paris routinely differs from guideline-directed medical therapy in Madrid or New York.

To bridge global science with institutional variance, Vera is rolling out Vera Spaces. The enterprise capability allows hospitals and regional health systems to upload and index their own internal clinical order sets, formulary restrictions, and departmental protocols alongside global biomedical literature. When an emergency physician queries an antimicrobial dosing regimen, the platform synthesizes international trial data while prioritizing the hospital’s specific local antibiogram and pharmacy restrictions.

The company affirmed that the platform will remain permanently free for licensed clinicians and medical trainees worldwide. The system operates under full HIPAA and GDPR compliance, holds SOC 2 Type II certification, and enforces a strict privacy firewall that never trains underlying AI models on clinicians’ entered patient queries.

Every executive discussion about AI eventually arrives at risk. Will AI make the wrong decision? Will it create new security vulnerabilities? Will it introduce compliance challenges that organizations aren’t prepared to manage?

Those are important questions. But when it comes to payments, they’re often not the first questions organizations should be asking. The bigger issue is that many organizations are layering AI on top of payment infrastructures that were never designed for the speed, complexity, and volume of today’s financial environments.

AI isn’t creating most of these weaknesses. It’s exposing them.

The Real Risk Is Data You Can’t Trust

AI is only as reliable as the information it receives. Data quality, governance, and consistency often present greater barriers to success than the technology itself. 

Transaction data now frequently moves across multiple systems before reaching its final destination. I’ve yet to meet an organization whose payment environment looks clean on paper and actually works that way in practice. Most are managing a mix of processors, banks, legacy systems, portals, spreadsheets, and workarounds that have accumulated over years. As transaction volumes grew, organizations adapted by adding more systems rather than creating a unified foundation. 

That approach was manageable when decisions moved at human speed. AI changes the equation. Processes that once took hours or days can now happen in seconds. Insights can be generated instantly, exceptions identified automatically, and routing decisions can become dynamic.

But accelerating a process doesn’t automatically improve it — when there are inconsistencies, it does quite the opposite. Missing metadata, timing mismatches, duplicate records, or conflicting transaction details may not seem significant in isolation, but when AI is used to automate decisions, those inconsistencies quickly become amplified.

The question isn’t whether your AI is sophisticated. It’s whether the data feeding it can be trusted.

Reconciliation Is Becoming a Strategic Control Function

One of the most overlooked consequences of AI-driven payments is what it means for reconciliation.

Ask most executives where reconciliation sits and they’ll point you toward finance. But as payment ecosystems become more complex and transaction speeds increase, reconciliation is evolving into a critical control function. When organizations rely on delayed or manual reconciliation processes, they create windows where errors, fraud, leakage, or operational issues can remain undetected. 

AI has the potential to accelerate payment activity significantly, but it also compresses the amount of time available to identify and correct problems. Security in payments has always been about control and validation, but the faster transactions move, the more important visibility becomes.

If an organization cannot clearly explain how a transaction moved from initiation to settlement, it has a control gap. That gap isn’t simply a finance issue. It’s a risk issue.

AI Needs Infrastructure, Not Just Automation

For healthcare organizations, those risks are becoming harder to ignore.

Patient payment ecosystems are far more complex than they were even a few years ago. Payments may move through financing programs, payment plans, online portals, card processors, banks, and revenue cycle platforms before they are fully reconciled. At the same time, finance teams are under pressure to improve collections, reduce administrative burden, and deliver a better patient financial experience.

AI can help achieve those goals. It can identify patterns, automate workflows, and surface exceptions faster than manual processes ever could.  But AI cannot create visibility where none exists.

If organizations cannot confidently trace how payments move across their ecosystem, they will struggle to trust the outputs AI generates. And when trust breaks down, so does the value of automation. That’s why the conversation around AI in payments needs to shift.

The Real Competitive Advantage Is Visibility

The question isn’t whether AI can streamline financial operations — we know it can. The question is whether the underlying infrastructure provides the transparency and traceability required to support it. 

That means prioritizing data integrity before automation, treating reconciliation as a strategic control rather than a monthly accounting exercise, and creating the visibility needed to understand exactly what happened to every transaction moving through the ecosystem. 

Organizations that get this right will be able to move faster, resolve issues sooner, and make better decisions. Those that don’t may find themselves scaling inefficiencies rather than eliminating them. For healthcare finance leaders, that distinction matters. As payment ecosystems become more complex and patient financial responsibility continues to grow, confidence in the data behind every payment becomes ever-more important.

In my view, the organizations that get the most value from AI won’t necessarily have the best models or rush to implement the technology the quickest. They’ll have the fewest blind spots. They’ll have redesigned workflows that make every transaction, every exception, and every dollar moving through the system visible and explainable. 

AI won’t break payments. Poor infrastructure will.

About Kevin Kidd

As Founder and CEO of Cresora Commerce, Kevin leads the company’s vision and product strategy, building AI-first commerce infrastructure that orchestrates payments, data, and financial workflows across fragmented systems. Under his leadership, Cresora is redefining how organizations manage the full transaction lifecycle—from payment initiation through reconciliation and reporting—by introducing intelligent automation, reducing manual intervention, and enabling greater transparency and control. Kevin’s approach is grounded in a belief that the future of commerce lies in intelligent orchestration—where AI-driven systems seamlessly connect financial operations, eliminate inefficiencies, and create a more adaptive, resilient infrastructure for modern enterprises.

What You Should Know

• Leading healthcare intelligence and AI infrastructure company Innovaccer announced that MDX Hawai’i has selected Innovaccer as its enterprise technology partner for population health management.
• MDX Hawai’i operates as the state’s premier independent practice association (IPA) and management services organization (MSO), serving for 40 years as the primary operational link between commercial/Medicare health plans and community providers across the Hawaiian Islands.
• The enterprise partnership deploys Innovaccer’s Atlas platform across MDX Hawai’i’s extensive network of over 1,000 primary care providers, mid-level clinicians, and pediatricians, alongside 5,000 specialists and 200 facilities and ancillary partners.

The Infrastructure Play: Deploying Atlas Across Dispersed Island Networks

MDX Hawai’i serves as the connective tissue between national and regional health plans—including UnitedHealthcare Medicare Advantage, Devoted Health, Pearl Health MSSP & ACO REACH/LEAD initiatives, Aetna, Cigna, DMBA, and Hygeia—and community medical practices.

Historically, tracking patient attribution across multiple disparate payer contracts meant logging into multiple conflicting health plan web portals, cross-referencing static claims spreadsheets, and reacting to clinical utilization months after patients were discharged from the hospital.

The deployment of Innovaccer’s Atlas platform replaces this manual overhead with a unified, real-time clinical and actuarial intelligence layer:

• Consolidated Cost and Utilization Intelligence: Aggregates multi-payer claims feeds and clinical data streams into standardized cost-of-care dashboards, giving independent physicians cross-contract visibility into emergency department recidivism, high-cost specialty drug utilization, and avoidable readmission trends.
• Point-of-Care Attribution and Gap Closure: Normalizes quality measure metrics across commercial and Medicare Advantage books of business, surfacing open HEDIS quality gaps and Hierarchical Condition Category (HCC) documentation needs directly within daily clinical interfaces rather than through retrospective charts.
• Progressive Operational Phasing: The initial rollout establishes enterprise baseline reporting across network utilization and provider benchmarking, with subsequent phases expanding into automated care management workflows, post-discharge transitions of care, and point-of-care EHR clinical decision support integration.

Rudy R. Marilla, MBA, MPH, President of MDX Hawai’i, outlined the foundational necessity for the independent network: “MDX Hawai’i was built on the belief that every physician in our network, whether they practice alone on a neighbor island or within a larger group, deserves the same quality of analytical tools and operational support as the largest health systems in the country. Partnering with Innovaccer gives us the platform to make that a reality. For the first time, our providers have a unified view of the patients they are managing under value-based contracts, and we are building toward a future where the administrative and operational work that consumes so much of their time runs autonomously in the background. That is what our providers need, and that is what our patients deserve.”

Taming the Neighbor-Island Access and Demographic Squeeze

The partnership directly addresses a severe structural headwind across the Hawaiian healthcare ecosystem: an aging clinical workforce with limited physician replacement, geographic barriers between island communities, and escalating administrative fatigue that threatens the survival of independent medical practices.

When independent clinicians retire or shutter their practices under administrative strain, the impact on neighbor islands is immediate, forcing patients to fly between islands for routine specialty consults and basic primary care.

Hospitals are beginning to give AI systems something more consequential than the ability to generate text: permission to act. That shift is already underway. A September 2026 survey of 250 U.S. healthcare leaders found that 28% of organizations had agentic AI in production and another 44% were piloting it, while 72% reported AI tools or agents deployed without formal IT approval. The problem is no longer simply whether a hospital has an AI governance committee. Health systems need to know, agent by agent, what each digital actor is actually authorized to do.

The need will become sharper as AI moves closer to clinical care. ARPA-H recently launched a program to develop FDA-authorized clinical agentic AI that can autonomously support cardiovascular care, including systems designed to engage patients, support care decisions, and escalate to clinicians when needed. Even if most hospital agents remain focused on administrative work for now, the boundary between administrative and clinical action is porous. Scheduling, prior authorization, discharge coordination, patient messaging, and medication workflows can all affect when and how care occurs.

A recent cybersecurity incident outside healthcare shows why permissions deserve more attention than they usually receive. During OpenAI cybersecurity evaluations, roughly 1,200 agents that were supposed to be isolated found an unsanctioned shared message board, exchanged more than 70,000 messages and files, and about 700 participated in an attack on Hugging Face. The independent METR and Redwood Research investigation found that the agents coordinated workstreams and achieved milestones they likely could not have achieved individually. Hospitals should not assume that bounding each agent separately will always bound what a collection of agents can accomplish when they can share tools, credentials, information, or tasks.

Access Control Is No Longer Enough

Healthcare already has strong concepts for governing access. The HIPAA Security Rule requires regulated entities to implement safeguards that protect electronic protected health information, including access controls, audit controls, and information-access management. HHS audit guidance explicitly contemplates access by both people and software programs and asks organizations to define technical access capabilities such as read-only, modify, and full access. That audit protocol also emphasizes unique identifiers and reviewable activity logs.

Agentic AI adds another layer. A hospital can know that an agent has access to a patient record without having answered whether the agent may change an appointment, initiate an authorization, message a patient, call another system, delegate a task to another agent, or trigger an order for human review. NIST has recognized this distinction in its 2026 work on software-agent identity and authorization, which asks how organizations should handle identification, authorization, auditing, and non-repudiation for AI agents.

Hospitals therefore need a second artifact alongside traditional access-control lists: a clinical authority map. For every production or pilot agent, the map should identify an accountable human owner; the systems and data the agent may access; the actions it may take without approval; actions that require human authorization; whether it may communicate with or delegate to other agents; how long elevated permissions last; how authority can be revoked; and what records must be preserved so investigators can reconstruct the chain of action.

Consider a discharge-planning agent. It might reasonably read parts of the chart, identify follow-up tasks, draft patient instructions, and propose appointment slots. Those permissions do not automatically justify allowing it to modify a medication order, send a clinically consequential instruction without review, or delegate work to another agent with broader credentials. The authority map forces the hospital to make those distinctions before deployment instead of discovering them after an unexpected action.

Make Authority Proportional to Consequence

This approach fits the direction of broader AI governance. NIST’s AI Risk Management Framework calls for organizations to define roles, responsibilities, application scope, and human oversight. Health IT policy is also moving toward greater transparency. The ONC HTI-1 rule established algorithm-transparency requirements for predictive decision support in certified health IT. Those measures help users understand AI-supported decisions. Authority maps address a different operational question: what can the system do after it receives information or reaches a conclusion?

Hospitals should scale authority in tiers. Low-consequence agents may receive standing permission to retrieve information or complete reversible administrative tasks. Agents that can write to clinical systems, communicate externally, move money, alter care workflows, or initiate clinically meaningful actions should face narrower permissions and stronger approval gates. NIST’s current work on trustworthy AI in critical infrastructure likewise points toward tested guardrails and human oversight for autonomous systems. Organizations should review permissions whenever an agent’s model, tools, integrations, or workflow changes. HHS cybersecurity guidance already stresses that access controls, audit controls, authentication, and security configuration need deliberate implementation, rather than assuming default settings are sufficient.

A clinical authority map will not eliminate AI risk. It does something more practical: it makes delegated power visible. That visibility helps clinicians understand where human judgment remains mandatory, gives security teams clearer boundaries to enforce, and gives executives a concrete record of what they have authorized. Hospitals can then expand an agent’s authority as evidence and trust accumulate, instead of granting broad permissions first and trying to reconstruct control afterward.

The hospitals that use agentic AI effectively will probably give some systems substantial responsibility. They should do so deliberately. Before an AI agent receives more autonomy, the organization should be able to answer a simple question in writing: exactly what is this agent allowed to do, and who can stop it?

About Gleb Tsipursky, PhD

Gleb Tsipursky, PhD, is CEO of Disaster Avoidance Experts and author of The Psychology of AI Adoption at Work: From Resistance to Results (Georgetown University Press, 2026). A behavioral scientist, he advises organizations on AI adoption and decision-making.