For years, healthcare provider organizations have pursued automation to improve revenue cycle efficiency. Rules-based workflows, robotic process automation, predictive analytics, and machine learning have each helped reduce manual intervention and accelerate the completion of repetitive tasks.

But reimbursement for specialty healthcare services, such as laboratory, radiology, pathology, and specialty pharmacy, is becoming too complex for efficiency alone to solve.

The challenge facing provider organizations today is not simply the volume of claims they must process. It is the speed at which reimbursement conditions can change, the complexity of determining why payment did not occur as expected, and the operational burden of deciding what to do next—often across thousands of claims simultaneously.

That distinction matters.

The next evolution of revenue cycle management may therefore be less about automating more tasks and more about creating systems capable of recognizing reimbursement friction, determining an appropriate response, taking action within established guardrails, and learning from the outcome.

That is the promise of agentic AI.

The Revenue Cycle Has Become an Information Problem

Traditional revenue cycle workflows were largely designed around transactions: submit a claim, receive a response, correct an error, appeal a denial, post a payment.

Today, reimbursement increasingly depends on a much broader information ecosystem.

Coverage policies change. Prior authorization requirements evolve. Coding and billing rules are updated. Documentation requests increase. Payor edits can affect entire populations of claims. A change that initially appears to be an isolated denial may actually represent a broader adjudication pattern.

The operational challenge is identifying that distinction quickly.

Consider a diagnostic organization accustomed to receiving, on average, 200 requests per month for additional information. If that volume suddenly increases to 15,000, processing each request individually is no longer scalable. Even if adding staff members were practical, it does not address the underlying problem.

The underlying questions that must be considered are strategic:

• What changed?
• Is the activity isolated or systemic?
• Which claims, services, locations, or payors are affected?
• What evidence is required to respond?
• And should the organization continue managing individual transactions—or address the underlying issue?

These are not simply automation questions. They require context, pattern recognition, reasoning, and coordinated action.

From Task Automation to Intelligent Orchestration

Traditional deterministic automation generally begins with a predefined instruction based on rules or business logic: When X happens, perform Y.

That model remains extremely valuable. Many revenue cycle activities are predictable and should be automated in this way whenever possible.

AI, and specifically Agentic AI, introduce a complementary set of capabilities.

Rather than simply executing an assigned task, an agentic system can work toward an objective by gathering information, evaluating conditions, selecting among possible actions, executing approved steps, and assessing the results.

Within healthcare revenue cycle management, that could eventually mean multiple specialized AI agents working together across the reimbursement lifecycle.

For example, an intake agent can be deployed to recognize an incoming payor request. An extraction agent could identify the relevant patient, claim, diagnostic service, and documentation requirements. A strategy agent could evaluate the appropriate response using historical outcomes, payor requirements, and organizational policies. Other agents might navigate external systems, complete forms, assemble supporting documentation, or route exceptions to the appropriate subject-matter expert.

The significant change is not any one of these capabilities.

It is their orchestration.

Instead of asking employees to move between disconnected systems, identify the problem, gather information, determine the next step, and execute it manually, organizations can begin designing systems in which technology coordinates much of that activity while people provide oversight where judgment and expertise matter most.

The Goal Should Not Be an AI Arms Race

There is another important consideration as healthcare organizations adopt increasingly sophisticated technology.

The conversation about AI in reimbursement can easily become adversarial: payors automate, therefore providers must automate faster.

That framing misses a larger opportunity.

Payors have legitimate responsibilities related to appropriate utilization, coverage criteria, payment integrity, and affordability. Provider organizations have equally important responsibilities to deliver medically appropriate services, document those services accurately, and support appropriate and timely reimbursement.

Both sides also bear the cost of unnecessary administrative complexity.

A claim that generates repeated documentation requests, manual reviews, appeals, and resubmissions creates expense throughout the healthcare system. Reducing avoidable friction should therefore be a shared objective.

AI may provide an opportunity to identify where that friction originates.

For example, if thousands of claims begin receiving the same request or denial, AI can help provider organizations identify the pattern earlier. That information can support a more productive conversation with the payor: What is driving the change? Is additional information required? Has an adjudication rule changed? Is there an unintended consequence that should be addressed?

Used effectively, AI can help move the relationship from transaction-by-transaction dispute resolution toward data-informed problem solving.

That is a far more valuable application than simply automating one stand-alone task in a workflow.

Human Expertise Becomes More Valuable, Not Less

Agentic AI also raises an understandable question: If technology can determine and execute the next action, where does that leave the revenue cycle professional?

The answer may be that expertise becomes even more important.

AI systems still require objectives, guardrails, escalation thresholds, validated data, and accountability. They also need people capable of recognizing when an automated conclusion does not reflect clinical, regulatory, contractual, or reimbursement reality.

Experienced reimbursement professionals possess something extraordinarily difficult to replicate: context.

They understand that two denials carrying the same adjustment code may have very different underlying causes. They recognize when a payor request is unusual. They understand the difference between a coding issue and a coverage issue, or between an isolated processing error and an emerging reimbursement trend.

The objective should therefore not be to remove humans from revenue cycle management.

It should be to change where human expertise is applied.

Instead of asking highly experienced professionals to spend much of their day finding information, moving between portals, assembling documents, and repeating predictable actions, AI can potentially absorb more of that administrative work.

People can then concentrate on exceptions, strategy, policy interpretation, payor engagement, and complex reimbursement decisions.

Speed of Learning May Become the Real Competitive Advantage

Perhaps the most consequential benefit of agentic AI is not faster claim processing.

It is faster organizational learning.

Historically, diagnostic organizations may not recognize a reimbursement issue until denial volumes increase, accounts receivable ages, or payment trends deteriorate. By that point, weeks or months of claims may already be affected.

A more intelligent revenue cycle creates the possibility of compressing that timeline:

Signal → Pattern → Insight → Action → Outcome → Learning

Imagine detecting an unusual increase in a denial category within days rather than months. The system identifies the affected claim population, evaluates common attributes, compares the pattern against historical behavior, and alerts a reimbursement expert that the activity may represent an emerging payor issue.

The expert validates the finding and determines the appropriate intervention.

The outcome then becomes part of the organization’s institutional knowledge.

Over time, the advantage is no longer simply that one organization processes claims faster than another. It is that the organization recognizes changes in reimbursement patterns earlier and adapts more quickly.

Preparing for an Agentic Revenue Cycle

The transition will not happen simply by purchasing an AI tool.

Organizations considering agentic capabilities should first examine the foundations of their revenue cycle: data quality, workflow standardization, interoperability, governance, escalation protocols, and measurable outcomes.

They should also be deliberate about where autonomy is appropriate.

A low-risk administrative task may require little human intervention. A complex coverage determination, significant payor escalation, or decision involving regulatory interpretation may require considerably more oversight.

The appropriate model is not unrestricted autonomy.

It is graduated autonomy supported by strong governance and guardrails—allowing technology greater independence where the rules, evidence, and risk tolerance support it while preserving human judgment where the consequences are greater.

That distinction will become increasingly important as AI capabilities mature.

The Next Question for Revenue Cycle Leaders

The first era of revenue cycle automation asked:

• What tasks can we automate?

The next era will ask:

• What outcomes can intelligent systems help us achieve?

That is a fundamentally different question.

For healthcare leaders, the opportunity is not simply to process more claims with fewer manual touches. It is to build a reimbursement operation capable of detecting change earlier, understanding its implications faster, responding more intelligently, and continuously learning from the results.

Agentic AI will not eliminate reimbursement complexity. Nor will technology replace the need for productive collaboration among provider organizations, payors, clinicians, policymakers, and patients.

But it can change how effectively organizations navigate that complexity.

And ultimately, that may be the more meaningful transformation: moving revenue cycle management from a predominantly reactive function toward an increasingly adaptive one.

About Clarisa Blattner, CCS, CPC

Clarisa Blattner is the Senior Director of Reimbursement Strategy & Industry Affairs at XiFin, Inc. She serves as a subject matter expert in revenue cycle management (RCM) and payor and market strategies, focusing on achieving operational efficiencies and maximizing revenue. With over 25 years of experience in the healthcare sector, Clarisa has an extensive background in revenue cycle management, particularly within the healthcare industry. Previously, she oversaw the billing and reimbursement operations for the outsourced billing department

When was the last time your team won an appeal on a clinical validation downgrade? If you have to stop and think about it, you are not alone.

Payer behavior has made this harder than it used to be. Clinical validation audits are driving a marked rise in Diagnosis-Related Group (DRG) downgrades, forcing hospitals to defend diagnoses that, for years, were accepted on the strength of a physician’s documentation alone. As audits grow more frequent and the criteria keep shifting, traditional coding and documentation practices no longer secure full reimbursement.

The exposure is real. In 2025, hospitals spent nearly $18 billion overturning claims denials, according to the American Hospital Association. Against margins this thin, even a modest rate of downgrades adds up quickly.

But the teams that protect the most revenue don’t just win more appeals. They reduce their exposure earlier, before claims are submitted and contracts are signed.

Understanding the difference between DRG and clinical validation audits

Traditional DRG validation audits confirm that diagnoses and procedures are coded and sequenced correctly, in line with the official ICD-10-CM guidelines. In that review, a provider’s statement that a condition exists is generally enough for code assignment, because the focus is on applying coding rules rather than second-guessing the clinical reasoning behind the diagnosis.

Clinical validation audits work differently. Since their introduction in the 2011 Recovery Audit Contractor (RAC) Statement of Work, payers have applied a separate standard, testing whether objective evidence in the medical record, such as laboratory results, imaging, clinical signs, and treatment response, supports the diagnosis itself. Here the clinician’s opinion, however expert, is not the deciding factor. A correctly coded diagnosis can still be disputed if the payer decides the record does not support it.

The practical effect is significant. A case coded correctly as sepsis can be downgraded to a less severe infection, or removed entirely, if the payer judges the objective evidence insufficient.

What’s driving the increase

The rise in downgrades is not random. Payers are deploying machine learning and audit tools that flag far more claims for review, and the diagnoses that carry the highest reimbursement, such as sepsis, acute respiratory failure, acute kidney injury, and severe malnutrition, are the most frequent targets.

Adding to the friction, payers often apply different clinical criteria than the treating physicians. For example, clinicians have largely moved to Sepsis-3 definitions, yet many payers still review claims against Sepsis-2. Neither the ICD-10-CM Official Guidelines nor AHA Coding Clinic requires Sepsis-3 for diagnosis coding, so a payer imposing that threshold is applying a standard that exceeds CMS coding guidance. That is a contestable overreach, not a legitimate basis for denial, but only if your team recognizes it as one.

There’s a deeper, structural problem. Payers, clinicians, and federal programs often apply different criteria to the same DRG, and most contracts say nothing about how downgrades will be handled, so hospitals start at a disadvantage before any appeal is filed. Payers can also change terms with little notice, since many contracts let an amendment take effect without the provider’s signature. Payers can introduce new criteria or downgrade procedures without warning, in part because many contracts contain language stating that “the signature of Provider will not be required in order for the amendment to take effect.”

Get the terms right before a dispute

The best defense against a downgrade is written into the contract long before a claim is audited. When negotiating or renewing payer agreements, several provisions are worth asking for.

• Defined, published criteria. Require payers to use recognized, published clinical definitions rather than internal or undisclosed criteria when questioning a diagnosis.
• Physician-level review. Mandate that only a qualified physician, not a coder or an algorithm, can overturn a treating physician’s documented diagnosis.
• Peer-to-peer rights. Guarantee your physician a direct conversation with the payer’s reviewing physician before a downgrade is finalized.
• Advance notice of changes. Require written notice before any change to clinical criteria or downgrade procedures takes effect.
• Audit limits. Set explicit caps: a percentage limit (e.g., no more than 5% of DRG claims reviewed per quarter), a fixed volume limit, a defined lookback window such as 12 months from date of service, and restrictions on extrapolating findings from a small sample across a broader population of claims.

Regulation can reinforce these positions. Under CMS-4208-F, effective January 1, 2026, once a Medicare Advantage plan approves an inpatient admission, it generally cannot reverse that approval based on information gathered after the fact, absent fraud or obvious error. Hospitals unaware of that protection may be conceding reversals they no longer have to accept.

Close the gaps you cannot negotiate away

Contract terms reduce exposure, but they do not eliminate it. The rest of the defense is operational.

• Validate high-risk DRGs before billing. A pre-bill clinical validation review on those high-risk DRGs catches weak documentation while it can still be fixed.
• Make CDI concurrent, not retrospective. Documentation gaps are far easier to close during the encounter than after discharge, and a concurrent query is far more effective than a post-discharge appeal.
• Monitor trends by payer and DRG. Track how often downgrades occur and which payers and diagnoses drive them. A repeated pattern from one payer on one DRG is a signal of systemic audit activity, and for public payers it can precede extrapolated recoupment across a wider set of claims.
• Measure what overturns denials. Analyze which appeal strategies succeed and apply those lessons across the organization. In Medicare Advantage, roughly 57% of denied claims are ultimately overturned, a sign that a large share of denials are reversible when challenged. The revenue is recoverable, if your process is built to capture it.

Moving forward

The teams that protect the most revenue treat audits as moving targets and defend accordingly, starting with the contract, reinforced at the point of care, and backed by the discipline to spot patterns early. Handled that way, DRG downgrades stop being an unpredictable drain and become a manageable, measurable part of revenue integrity. There’s a clinical payoff, too. When you run the revenue side this way, physicians and coding teams spend less time defending documentation after the fact and more time on the patients in front of them. Few teams can sustain this alone, and no contract enforces itself, so the strongest defenses pair disciplined internal work with the right outside expertise.

And the next time someone asks when your team last won a clinical validation appeal, you’ll have an answer ready.

About Adele Frias

Adele Frias is Vice President of Specialty Revenue Cycle Solutions, EnableComp.

Artificial intelligence (AI) has now reached a crucial tipping point in the way U.S. healthcare plans carry out their operations. A study by Everest Group, supported by Sagility, found that 70% of health plans have introduced AI tools to streamline both administrative and clinical activities. Nevertheless, 84% of payer executives say that they have seen limited benefits from these implementations and just 10% have noticed measurable improvements in operations.

The fact that these systems are not aligned points to a fundamental error in the digital transformation of healthcare, namely the belief that simply adding automated tools to the scattered existing infrastructure will automate the current state of chaos instead of enabling operational efficiency.

Healthcare administrative spending in the U.S. is approximately $1 trillion annually, costs that result in part from manual processes, complex clinical reviews, and the lack of systems integration. Although technology frequently functions as a quick fix, achieving true operational efficiency involves some fundamental rework. Before introducing automated tools, health plans should re-engineer their workflows end-to-end to ensure the optimal use of AI. Only by restructuring workflows will health plans harness AI as an intelligence amplifier for human healthcare experts to implement specialized clinical judgment rather than replace it.

The Flaw of Overlaying Tech on Legacy Chaos

For many years the administrative and clinical operations of health plans have worked in isolation. The handling of claims, utilization management (UM), payment integrity, and member services have usually depended on separate platforms, manual transfers between them, and outdated rules engines.

When health plans try to modernize by adding AI models or robotic process automation (RPA) directly onto these disjointed systems, the fundamental problems still exist. Imagine an AI system that flags claims for investigation. If the underlying contract terms or prior authorization rules are wrong, the AI may identify thousands of claims that never needed review in the first place. Instead of saving time, claims staff are left sorting through unnecessary alerts and correcting avoidable errors.

To achieve a meaningful return on investment, healthcare operations must build a stronger operational foundation by standardizing workflows, improving data quality, and establishing consistent governance before deploying AI and automation at scale.

Indeed, AI code depends on health plans mapping the full lifecycle of a transaction, whether it’s a prior authorization request or a complicated inpatient claim. Identifying policy gaps, eliminating redundant hand-offs, and standardizing data inputs creates the necessary operational baseline. Technology can deliver true scalability and efficiency only on a clean, connected foundation.

Why AI Is an Intelligence Amplifier Paired with Domain Expertise

A related misconception in the field of healthcare technology involves the idea that AI is a solo solution that can solve complex problems entirely on its own. By extension, AI can replace human expertise entirely, including in complicated administrative and clinical processes. Yet, research reveals that 94% of payer executives stress the importance of having human oversight when introducing automated tools.

Healthcare operations depend on deep clinical, payment integrity, and operational knowledge that generic algorithms can’t replicate. Healthcare is by its nature complex, dynamic and full of high stakes. Although AI is good at processing large amounts of data, recognizing patterns and automating routine administrative work, it lacks the kind of nuanced reasoning needed for complex decisions. In clinical areas like UM, complex case management and claims appeals, full automation opens the door to substantial financial and regulatory risk.

Augmented intelligence is the best method of handling this complexity. Technology from this point of view amplifies intelligence for registered nurses, certified coders, and claims specialists. For example, generative AI tools help RNs by examining hundreds of pages of unstructured medical records, and clinical history and comparing the data with evidence-based protocols within minutes. RNs can then review the combined evidence to make the final clinical decision.

Instead of focusing on pure automation, organizations should redesign their operating models so AI and healthcare professionals work together as an orchestrated team. This human-in-the-loop approach greatly reduces manual review times without losing the important clinical judgement of experienced healthcare professionals. It changes frontline experts from administrative paper-chasers into valuable decision-makers.

Knocking Down Silos Across the Claims and Clinical Lifecycle

AI and automated decision engines can only deliver on their promise when fed clean, integrated data across the entire organization. For health plans to achieve sustainable financial and operational value from these technologies, they need to break down the barriers separating clinical oversight from financial settlement. Usually, functions like UM and payment integrity have worked as separate, reactive departments. Payment integrity in particular has been concerned with post-pay recovery, pursuing improper payments months after claims have been resolved.

Connecting operations across the entire claims lifecycle creates a continuous feedback loop that directly links workflow redesign to measurable clinical and financial outcomes:

• Prevent: By carrying out clinical interventions at the upstream level, agreeing on prior authorization, and validating benefit configurations, errors are prevented before adjudication occurs, improving first-pass accuracy.
• Detect: Before any payment is made, high-impact editing rules, pre-payment clinical reviews, and risk-scoring algorithms flag potential overpayments or coding anomalies, mitigating financial leakage.
• Resolve/Recover: Outlier claims are sent to specialized auditors and clinicians for a specific review, while normal claims go through without issue, reducing administrative burden and provider abrasion.
• Learn: The root causes are identified by systemically analyzing the findings from downstream audits, appeal outcomes, and payment trends, driving better decision-making.
• Prevent (continuous feedback): Insights gained from post-pay findings fed back into upstream configuration, clinical guidelines and adjudication rules to prevent repeated errors.

When clinical context, contract logic, and processing of claims work together as an integrated ecosystem powered by re-engineered workflows and domain-specific AI, health plans reduce the number of errors on the first submission, remove provider friction and cut down on administrative overhead.

The Path Forward Through Intelligent Operations

With narrow profit margins a common concern for health plans, along with changing CMS requirements and persistent clinical workforce shortages, technology ROI will become increasingly important. 

To future-proof payer operations, the path forward is domain-led intelligent operations, a strategy that combines the use of purpose-built AI, re-engineered workflows, and licensed healthcare professionals who are familiar with the intricacies of clinical care and payment policy. By giving priority to workflow design, human-AI orchestration, and deep healthcare expertise, health plans will finally be able to bridge the AI ROI gap and secure both financial and operational resilience.

About Anand Biradar 

Anand Biradar is the Chief Go-to-Market Strategy & Enterprise Transformation Officer at Sagility.

Over the past two years, healthcare leaders have been forced to rethink what operational resilience really means.

The cyberattack on Change Healthcare demonstrated how dependent providers had become on a single third-party platform for everything from claims processing to cash flow. The attack on Ascension showed how quickly disruptions to technology can spill over into clinical operations, delaying care, forcing clinicians back to paper documentation, and disrupting the day-to-day functioning of hospitals across the country. While the headlines focused on cybersecurity, both events underscored a much broader lesson: healthcare organizations are only as resilient as the network of third parties they depend on every day.

Most hospitals responded by strengthening cybersecurity, evaluating supplier risk, and reassessing business continuity plans. Those were the right priorities. But another question deserves equal attention. Do hospitals truly understand every third party that has meaningful access to their facilities, systems, and operations?

For decades, vendor credentialing has been built around a straightforward assumption: the highest risk comes from the people working closest to patients. That philosophy shaped accreditation standards, influenced hospital policies, and created rigorous oversight for medical device representatives and other clinical vendors entering operating rooms and procedural areas.

It was an effective model because it reflected the way hospitals operated at the time. Today’s hospitals operate very differently.

Modern health systems rely on an extensive network of third-party personnel who rarely fit the traditional definition of a clinical vendor. Biomedical technicians maintain connected medical equipment. Facilities contractors oversee mechanical systems that support patient care environments. Environmental services teams work throughout patient units. Food service vendors, elevator mechanics, security contractors, IT specialists, construction crews, and maintenance personnel move throughout hospitals every day to keep operations running.

Most of these individuals never step inside an operating room. Many have access to patient care areas, restricted spaces, connected technologies, or critical infrastructure that directly supports clinical operations. Yet they often fall outside the oversight models hospitals originally built for vendor credentialing.

That disconnect is becoming increasingly difficult to ignore because the nature of hospital risk has changed.

Healthcare has become one of the most operationally complex industries in the world. Clinical care depends on digital infrastructure. Building systems are increasingly connected. Medical devices communicate across networks. Critical utilities are monitored electronically. Hospitals rely on outside organizations not simply to deliver products but to maintain the systems that allow patient care to continue uninterrupted.

In other words, operational resilience and patient safety are no longer separate conversations.

A contractor repairing an air handling unit serving an intensive care unit may never interact directly with a patient, but the reliability of that system is fundamental to patient care. A biomedical technician servicing network-connected infusion pumps may never be classified as a traditional clinical vendor, yet their work intersects with cybersecurity, clinical engineering, and operational continuity. Even environmental services personnel routinely move throughout patient care areas where infection prevention, physical security, and operational efficiency all converge.

None of these examples represents an unusual circumstance. They represent an ordinary day inside a modern hospital. The challenge is that many credentialing programs continue to reflect yesterday’s assumptions about where vendor risk exists rather than today’s operational reality.

Healthcare has invested years building thoughtful credentialing programs that have strengthened accountability and improved patient safety. The issue is that those programs were designed around a narrower understanding of third-party access than hospitals manage today.

Expanding oversight does not mean treating every contractor exactly the same. A one-size-fits-all approach would simply create more administrative work without producing better outcomes. Instead, hospitals should begin thinking about third-party oversight the same way they approach enterprise risk management. The question should no longer be whether someone fits into an existing credentialing category. The better question is what level of operational risk that individual presents based on where they work, what systems they access, and how their activities could affect patient care or hospital operations.

That requires moving away from static credentialing toward a more dynamic understanding of third-party risk.

Annual verification may satisfy a compliance requirement, but it does little to address the reality that contractor assignments change, certifications expire, organizational relationships evolve, and access requirements shift over time. Hospitals have embraced continuous monitoring in cybersecurity because they understand risk changes every day. Third-party oversight should evolve with that same mindset.

The organizations making the greatest progress are also recognizing that vendor oversight is no longer the responsibility of a single department. It sits at the intersection of supply chain, facilities, clinical engineering, information security, compliance, infection prevention, and executive leadership. As hospitals become more interconnected, so do the risks they manage.

What Hospital Leaders Should Do Next

Rather than expanding existing credentialing programs indiscriminately, healthcare organizations should focus on aligning oversight with how hospitals actually operate today.

The first step is understanding the full third-party ecosystem. Many organizations have mature oversight for clinical vendors while maintaining far less visibility into facilities contractors, service providers, maintenance personnel, and other operational partners. Hospitals cannot effectively manage risks they have never fully defined.

Next, leaders should evaluate whether credentialing reflects current risk or historical assumptions. Oversight should be based on the environments individuals enter, the systems they access, and the potential operational impact of their work instead of broad job categories that may no longer reflect reality.

Hospitals should also rethink credentialing as an ongoing operational capability rather than a point-in-time administrative exercise. Continuous visibility into who is entering facilities, whether requirements remain current, and how access changes over time provides a more accurate picture of organizational risk than periodic verification alone.

Finally, third-party oversight should become part of broader enterprise resilience planning. The strongest organizations increasingly recognize that operational resilience depends on understanding not only the technologies that support patient care, but also the people who install, maintain, repair, and access them every day.

Healthcare has spent decades refining how it manages clinical risk. The next chapter is recognizing that operational resilience depends just as much on the people working behind the scenes as those delivering care at the bedside.

Hospitals know how to secure the operating room. The greater challenge, and the greater opportunity, is ensuring they have the same level of confidence in everyone else who walks through their doors.

About Mickey Meehan

Mickey Meehan is CEO of Green Security, where he works with healthcare organizations to strengthen vendor governance, credentialing, and operational resilience. With more than two decades of experience across healthcare operations, supply chain, and technology, he has held executive leadership roles at Premier, Mobitor, Zimmer, and MedPricer, helping health systems navigate complex purchasing, vendor, and workflow challenges.

The difference matters more than it first appears. A duplicate email is an annoyance. Treating a caregiver as the patient, or carrying a permission from one program into another, damages trust that rare-disease companies spend years building. Yet patient CRM modernization is usually planned as a platform or campaign migration. The harder work is deciding who each record represents, what communication it permits, how quickly changes reach every system, and who answers for the data when it is wrong.

In 2025 I led the data integration and migration workstream of a patient CRM modernization at a rare-disease company. We connected nine integrations spanning six websites, a patient-services environment and a legacy CRM. In the first 75 days after cutover, internal reporting showed 30% less time to plan and execute patient communications and 45% less rework from changing requirements; we later presented these results at an industry conference. These are operational results; they say nothing about clinical outcomes. The four decisions behind them apply to any technology stack.

1. Identity is a decision about relationships

The visible part of a CRM migration is rebuilding messages and campaigns. We began with a data audit and a ranked inventory of campaigns instead. Before moving any journey, we had to establish whether two records described the same patient, and whether the person acting on that patient’s behalf was someone else entirely.

Record matching is a known weak spot in healthcare. In 2018, The Pew Charitable Trusts reported that as many as one in five patients may not be matched correctly to their records even within a facility they have visited before. Marketing databases differ from clinical records, but the lesson carries over: a missed match and a false match fail in different ways, and a false match can pose a more serious privacy risk.

Our team wrote the identity and reconciliation rules together with the business owners: which identifiers could support a match, which uncertain cases went to a person for review, and how a caregiver stays linked to a patient while remaining a separate record with separate permissions. Fewer records was a side effect. The goal was an accurate account of who takes part in each relationship and whose consent applies.

2. Consent has to work wherever the data goes

A disease-awareness registration, a copay enrollment and a request for product updates grant different permissions. When those choices are scattered across platforms, compliance rests on campaign builders remembering every exception.

We made consent part of the data model: purpose, channel, source, date and withdrawal status. Eligibility is checked when an audience is activated, and a marketing opt-out stays separate from the service messages a patient still needs. Access to sensitive information is governed on its own track, with procedures reviewed through our data governance process.

Standards help with half of this. The HL7 FHIR Consent resource gives healthcare a common way to record a consent decision, and its specification states plainly that enforcement is out of scope and left to access-control mechanisms. A well-recorded permission protects no one until every downstream workflow honors it. That is why we tested withdrawals, exceptions and channel-specific rules with the same care as new opt-ins.

3. Agree on meaning and timing before you integrate

One-off integrations can turn every new campaign into a new engineering project. We standardized the single path by which website registrations, program data, patient-services records and legacy history enter the engagement environment, pass through reconciliation and become available for segmentation. Standardizing the integration path reduced the need to rebuild data pipelines when campaign requirements changed. Across the migration, internal reporting showed a 45% reduction in rework associated with requirement changes.

Timing deserves the same attention. Our sources refresh four times a day, which suits scheduled outreach and falls short of real-time interoperability. An event-triggered journey can only react as fast as the data that feeds it. For every new use case, decide how fresh the data must be, how late-arriving changes are handled and which events need a different integration pattern.

My 2026 reference architecture for FHIR-enabled healthcare CRM describes six integration patterns, among them identity matching, consent enforcement, terminology normalization, bulk synchronization and event-driven subscription. The migration predates that paper and did not implement it. Looking back, the experience reinforces a distinction my research also addresses: integration patterns define how systems exchange and manage data, but organizations must still establish who owns the data, resolves conflicts and governs its use.

4. Every important signal needs an accountable owner

Web registrations, patient-services data and legacy CRM history are usually maintained by different teams. Connecting the systems does not settle what a field means, when it should change or which source wins a conflict.

We assigned owners to the critical sources and fields and brought those owners into design decisions from the start. Definitions got resolved upstream, once, so campaign teams downstream stopped reinterpreting conflicting signals. Governance became part of the architecture from the first design meeting.

Four questions before the next integration

Before approving another patient CRM integration, I would ask:

1. Can we tell the patient from the caregiver?
2. Can every activation show the permission it relies on?
3. Do we know when each signal becomes available, and is that soon enough for the message it drives?
4. Who fixes the data when the answer is wrong?

Go back to the daughter and her father. Connecting their records may make communication more efficient, but earning their trust requires something more: recognizing each person’s role, honoring their individual preferences, and ensuring those choices are reflected before communications are sent. That is the difference between connecting patient data and building a reliable patient relationship.

About Jaymin Sutarwala

Jaymin Sutarwala is Associate CRM Strategy & Operations Director at United Therapeutics, where he leads the CRM platforms that support commercial and medical teams. His research on healthcare CRM architecture and patient privacy appears in peer-reviewed and open-access journals.

Sources cited in the text:

• The Pew Charitable Trusts, “New Report Lists Steps to Improve Patient Matching Across Electronic Health Records”, 2 October 2018.
• HL7 FHIR R4, Consent resource, section 6.2.3 “Background and Context”.
• J. H. Sutarwala, “A Reference Architecture and Integration Pattern Catalog for FHIR-Enabled Healthcare CRM Systems”, 2026, doi:10.5281/zenodo.19163604.

Healthcare executives often evaluate artificial intelligence with a familiar checklist: model accuracy, integration effort, implementation time, and license cost. That list omits the expense that determines whether an administrative AI project creates capacity or creates another system to supervise. The missing line item is exception handling.

The demand is real. In its 2026 Physician Survey on Augmented Intelligence, the American Medical Association reported that 81 percent of respondents were aware of or used AI in practice. Seventy-three percent expected administrative automation to improve physician well-being and burnout. The same survey found that physicians placed high importance on validated safety and efficacy, privacy assurances, and involvement in adoption decisions. Buyers are therefore trying to solve two problems at once: reduce operational burden and preserve accountable human control.

Feature comparisons hide operational work

A product demonstration usually shows a clean case. The input is complete, the identity matches, the portal is available, and the action follows a known rule. Real queues contain missing demographics, duplicate records, expired credentials, unclear orders, payer discrepancies, unreachable contacts, and policy questions. Those cases do not disappear when the routine path becomes faster. They become a separate queue that somebody must detect, investigate, route, and close.

This changes the economics. A tool can automate a large share of individual steps while increasing management work if staff must watch dashboards, interpret failures, and repair incomplete cases. License utilization may rise while backlog age, rework, and staff interruptions remain unchanged. A business case based only on tasks automated or minutes saved will miss that transfer of work.

Define the unit of value

Procurement teams should define value as a completed, in-scope outcome with evidence. For an eligibility queue, completion might require a verified response stored in the approved system before the visit. For a referral queue, it might require the document to be matched, indexed, advanced to the next task, and escalated when identity is uncertain. The unit should be observable and auditable.

That definition lets leaders compare software, outsourced services, staffing, and managed automation on the same basis. It also prevents a common measurement error: treating an attempted action as completed work. Calls placed, messages generated, and documents classified are activity measures. They matter, but they do not establish that the queue reached its agreed final state.

Price the exception path

Every proposal should state what happens when the normal path fails. Which administrative exceptions will the vendor resolve? How long will it continue working a case? What evidence will it retain? When must clinic staff intervene? Which decisions always remain with an authorized person? If these questions are unanswered, the buyer cannot estimate the actual operating cost.

A practical scorecard should separate routine completion, administrative exception resolution, and practice intervention. It should track eligible cases received, cases completed, turnaround time, backlog age, reopened work, unresolved exceptions, and staff touches. The goal is not a perfect automation rate. The goal is reliable capacity with a visible boundary around human authority.

Treat governance as part of the workflow

Governance cannot live only in a policy document. The NIST AI Risk Management Framework emphasizes managing risk across the AI lifecycle. In operations, that principle should appear in access controls, approval rules, escalation paths, logs, testing, and post-deployment monitoring. A Business Associate Agreement may be required, but it does not define who may change a code, make a clinical determination, accept a financial term, or act for a patient.

The same operating discipline supports the HHS guidance on HIPAA risk analysis. Buyers should map each workflow’s systems, data, permitted actions, retained evidence, and fallback procedures before expanding scope. This makes governance measurable instead of aspirational.

Start with one live queue

The most credible ROI study begins with one bounded queue and includes failure modes from the start. Capture the baseline backlog, completion time, staff effort, rework, and exception mix. Run normal cases alongside missing information, access failures, identity mismatches, and policy exceptions. Measure whether the queue closes with less staff attention while decisions outside the approved boundary still reach the right person.

Healthcare organizations do not need another favorable demonstration. They need a financial model that includes the work left behind when the happy path ends. Once exception handling appears as a priced, measured part of the operating model, leaders can tell whether an AI investment creates capacity or merely moves the burden to a different screen.

About Feynman Xu

Feynman Xu, Ph.D., is the founder and CEO of MedArise, which provides managed AI employees for defined administrative workflows in medical practices. His work focuses on workflow ownership, exception handling, and clear human authority in healthcare operations.

What You Should Know

• Clinical artificial intelligence search platform Vera Health announced the closing of a $28.5 million Series A funding round led by Threshold Ventures.
• The financing included participation from Mantis VC and SV Angel, with existing institutional backers Y Combinator and Gradient tripling down on their initial investments, bringing total capitalization to $32M.
• Operates at high capital and workforce efficiency: with an engineering and clinical team of only 12 employees, the platform has scaled to more than 800,000 clinicians across 190 countries, largely through peer recommendations.
• Penetrates key international provider markets: platform adoption includes approximately 1 in 4 practicing physicians in Spain and Italy, and 1 in 7 physicians in France.

The Architecture of Truth: Inverting the Generative Paradigm

Unlike generic AI assistants that generate text probabilistically and search for citations as a post-hoc justification, Vera Health operates on an inverse architecture: it retrieves and grades the evidence first, and only writes the answer second.

• Exhaustive Corpus Ingestion: The search engine continuously indexes more than 60 million peer-reviewed biomedical publications, clinical practice guidelines, consensus statements, and FDA/EMA drug labels.
• Algorithmic Level-of-Evidence Grading: Rather than weighting search results purely on keyword density or text semantic similarity, Vera’s retrieval pipeline programmatically evaluates underlying study designs, sample sizes, cohort power, publication recency, journal impact factor, and citation velocity.
• Making Uncertainty Visually Explicit: Every claim generated in a clinical summary is dynamically color-coded based on the strength of supporting evidence. When data on an orphan disease or novel off-label therapy is limited to a small retrospective case series, Vera flags the assertion in red—explicitly warning the treating physician that the underlying evidentiary ground is thin.
• Medical Society Policy Integration: Through a formal institutional partnership with the American College of Emergency Physicians (ACEP), Vera embeds official clinical policies and clinical decision trees directly into bedside search results, with source attribution verified against medical society standards.

12 Employees, 190 Countries, and Viral Clinician Referrals

Vera Health’s growth trajectory stands as an anomaly in enterprise healthcare software, where scaling typically requires massive direct sales forces and lengthy hospital procurement cycles:

• Massive Adoption Velocity: One year ago, Vera counted a few thousand active clinicians. Today, more than 800,000 healthcare professionals across 190 countries utilize the platform daily, querying the engine hundreds of thousands of times every single day.
• App Store Dominance: Every month since June 2026, Vera has ranked as the most downloaded clinical mobile application globally across both the Apple App Store and Google Play. In September alone, the platform logged more downloads than incumbent clinician networks OpenEvidence and Doximity combined.
• International Market Saturation: The platform has achieved notable penetration across European healthcare systems through peer-to-peer physician word-of-mouth, capturing approximately one in four practicing physicians in Spain and Italy, alongside one in seven physicians in France.
• Extreme Organizational Efficiency: Operating with a lean founding team of only twelve employees, Vera has maintained a zero-dollar enterprise marketing budget, driving user acquisition almost exclusively through peer-to-peer clinician recommendations.

Taieb Bennani, Co-founder of Vera Health, framed the platform’s core operating ethos: “Clinicians are the best data scientists I’ve ever met. They make the call in seconds, with more evidence than any human could ever read. The secret to building for them is to live and breathe the problem like no one else. Everyone on our team is a clinician, or the child or sibling of one, like Maxime and me. That passion translates into every detail of the product, and when you build with that kind of obsession, the product speaks for itself, and clinicians share it with their colleagues. We don’t have the biggest team or the most money. We have the people who care the most about getting it right.”

Localized Practice via “Vera Spaces”

A major barrier to global medical AI adoption is geographic divergence in clinical practice: a cardiology pathway in Paris routinely differs from guideline-directed medical therapy in Madrid or New York.

To bridge global science with institutional variance, Vera is rolling out Vera Spaces. The enterprise capability allows hospitals and regional health systems to upload and index their own internal clinical order sets, formulary restrictions, and departmental protocols alongside global biomedical literature. When an emergency physician queries an antimicrobial dosing regimen, the platform synthesizes international trial data while prioritizing the hospital’s specific local antibiogram and pharmacy restrictions.

The company affirmed that the platform will remain permanently free for licensed clinicians and medical trainees worldwide. The system operates under full HIPAA and GDPR compliance, holds SOC 2 Type II certification, and enforces a strict privacy firewall that never trains underlying AI models on clinicians’ entered patient queries.

Every executive discussion about AI eventually arrives at risk. Will AI make the wrong decision? Will it create new security vulnerabilities? Will it introduce compliance challenges that organizations aren’t prepared to manage?

Those are important questions. But when it comes to payments, they’re often not the first questions organizations should be asking. The bigger issue is that many organizations are layering AI on top of payment infrastructures that were never designed for the speed, complexity, and volume of today’s financial environments.

AI isn’t creating most of these weaknesses. It’s exposing them.

The Real Risk Is Data You Can’t Trust

AI is only as reliable as the information it receives. Data quality, governance, and consistency often present greater barriers to success than the technology itself. 

Transaction data now frequently moves across multiple systems before reaching its final destination. I’ve yet to meet an organization whose payment environment looks clean on paper and actually works that way in practice. Most are managing a mix of processors, banks, legacy systems, portals, spreadsheets, and workarounds that have accumulated over years. As transaction volumes grew, organizations adapted by adding more systems rather than creating a unified foundation. 

That approach was manageable when decisions moved at human speed. AI changes the equation. Processes that once took hours or days can now happen in seconds. Insights can be generated instantly, exceptions identified automatically, and routing decisions can become dynamic.

But accelerating a process doesn’t automatically improve it — when there are inconsistencies, it does quite the opposite. Missing metadata, timing mismatches, duplicate records, or conflicting transaction details may not seem significant in isolation, but when AI is used to automate decisions, those inconsistencies quickly become amplified.

The question isn’t whether your AI is sophisticated. It’s whether the data feeding it can be trusted.

Reconciliation Is Becoming a Strategic Control Function

One of the most overlooked consequences of AI-driven payments is what it means for reconciliation.

Ask most executives where reconciliation sits and they’ll point you toward finance. But as payment ecosystems become more complex and transaction speeds increase, reconciliation is evolving into a critical control function. When organizations rely on delayed or manual reconciliation processes, they create windows where errors, fraud, leakage, or operational issues can remain undetected. 

AI has the potential to accelerate payment activity significantly, but it also compresses the amount of time available to identify and correct problems. Security in payments has always been about control and validation, but the faster transactions move, the more important visibility becomes.

If an organization cannot clearly explain how a transaction moved from initiation to settlement, it has a control gap. That gap isn’t simply a finance issue. It’s a risk issue.

AI Needs Infrastructure, Not Just Automation

For healthcare organizations, those risks are becoming harder to ignore.

Patient payment ecosystems are far more complex than they were even a few years ago. Payments may move through financing programs, payment plans, online portals, card processors, banks, and revenue cycle platforms before they are fully reconciled. At the same time, finance teams are under pressure to improve collections, reduce administrative burden, and deliver a better patient financial experience.

AI can help achieve those goals. It can identify patterns, automate workflows, and surface exceptions faster than manual processes ever could.  But AI cannot create visibility where none exists.

If organizations cannot confidently trace how payments move across their ecosystem, they will struggle to trust the outputs AI generates. And when trust breaks down, so does the value of automation. That’s why the conversation around AI in payments needs to shift.

The Real Competitive Advantage Is Visibility

The question isn’t whether AI can streamline financial operations — we know it can. The question is whether the underlying infrastructure provides the transparency and traceability required to support it. 

That means prioritizing data integrity before automation, treating reconciliation as a strategic control rather than a monthly accounting exercise, and creating the visibility needed to understand exactly what happened to every transaction moving through the ecosystem. 

Organizations that get this right will be able to move faster, resolve issues sooner, and make better decisions. Those that don’t may find themselves scaling inefficiencies rather than eliminating them. For healthcare finance leaders, that distinction matters. As payment ecosystems become more complex and patient financial responsibility continues to grow, confidence in the data behind every payment becomes ever-more important.

In my view, the organizations that get the most value from AI won’t necessarily have the best models or rush to implement the technology the quickest. They’ll have the fewest blind spots. They’ll have redesigned workflows that make every transaction, every exception, and every dollar moving through the system visible and explainable. 

AI won’t break payments. Poor infrastructure will.

About Kevin Kidd

As Founder and CEO of Cresora Commerce, Kevin leads the company’s vision and product strategy, building AI-first commerce infrastructure that orchestrates payments, data, and financial workflows across fragmented systems. Under his leadership, Cresora is redefining how organizations manage the full transaction lifecycle—from payment initiation through reconciliation and reporting—by introducing intelligent automation, reducing manual intervention, and enabling greater transparency and control. Kevin’s approach is grounded in a belief that the future of commerce lies in intelligent orchestration—where AI-driven systems seamlessly connect financial operations, eliminate inefficiencies, and create a more adaptive, resilient infrastructure for modern enterprises.

What You Should Know

• Leading healthcare intelligence and AI infrastructure company Innovaccer announced that MDX Hawai’i has selected Innovaccer as its enterprise technology partner for population health management.
• MDX Hawai’i operates as the state’s premier independent practice association (IPA) and management services organization (MSO), serving for 40 years as the primary operational link between commercial/Medicare health plans and community providers across the Hawaiian Islands.
• The enterprise partnership deploys Innovaccer’s Atlas platform across MDX Hawai’i’s extensive network of over 1,000 primary care providers, mid-level clinicians, and pediatricians, alongside 5,000 specialists and 200 facilities and ancillary partners.

The Infrastructure Play: Deploying Atlas Across Dispersed Island Networks

MDX Hawai’i serves as the connective tissue between national and regional health plans—including UnitedHealthcare Medicare Advantage, Devoted Health, Pearl Health MSSP & ACO REACH/LEAD initiatives, Aetna, Cigna, DMBA, and Hygeia—and community medical practices.

Historically, tracking patient attribution across multiple disparate payer contracts meant logging into multiple conflicting health plan web portals, cross-referencing static claims spreadsheets, and reacting to clinical utilization months after patients were discharged from the hospital.

The deployment of Innovaccer’s Atlas platform replaces this manual overhead with a unified, real-time clinical and actuarial intelligence layer:

• Consolidated Cost and Utilization Intelligence: Aggregates multi-payer claims feeds and clinical data streams into standardized cost-of-care dashboards, giving independent physicians cross-contract visibility into emergency department recidivism, high-cost specialty drug utilization, and avoidable readmission trends.
• Point-of-Care Attribution and Gap Closure: Normalizes quality measure metrics across commercial and Medicare Advantage books of business, surfacing open HEDIS quality gaps and Hierarchical Condition Category (HCC) documentation needs directly within daily clinical interfaces rather than through retrospective charts.
• Progressive Operational Phasing: The initial rollout establishes enterprise baseline reporting across network utilization and provider benchmarking, with subsequent phases expanding into automated care management workflows, post-discharge transitions of care, and point-of-care EHR clinical decision support integration.

Rudy R. Marilla, MBA, MPH, President of MDX Hawai’i, outlined the foundational necessity for the independent network: “MDX Hawai’i was built on the belief that every physician in our network, whether they practice alone on a neighbor island or within a larger group, deserves the same quality of analytical tools and operational support as the largest health systems in the country. Partnering with Innovaccer gives us the platform to make that a reality. For the first time, our providers have a unified view of the patients they are managing under value-based contracts, and we are building toward a future where the administrative and operational work that consumes so much of their time runs autonomously in the background. That is what our providers need, and that is what our patients deserve.”

Taming the Neighbor-Island Access and Demographic Squeeze

The partnership directly addresses a severe structural headwind across the Hawaiian healthcare ecosystem: an aging clinical workforce with limited physician replacement, geographic barriers between island communities, and escalating administrative fatigue that threatens the survival of independent medical practices.

When independent clinicians retire or shutter their practices under administrative strain, the impact on neighbor islands is immediate, forcing patients to fly between islands for routine specialty consults and basic primary care.

Hospitals are beginning to give AI systems something more consequential than the ability to generate text: permission to act. That shift is already underway. A September 2026 survey of 250 U.S. healthcare leaders found that 28% of organizations had agentic AI in production and another 44% were piloting it, while 72% reported AI tools or agents deployed without formal IT approval. The problem is no longer simply whether a hospital has an AI governance committee. Health systems need to know, agent by agent, what each digital actor is actually authorized to do.

The need will become sharper as AI moves closer to clinical care. ARPA-H recently launched a program to develop FDA-authorized clinical agentic AI that can autonomously support cardiovascular care, including systems designed to engage patients, support care decisions, and escalate to clinicians when needed. Even if most hospital agents remain focused on administrative work for now, the boundary between administrative and clinical action is porous. Scheduling, prior authorization, discharge coordination, patient messaging, and medication workflows can all affect when and how care occurs.

A recent cybersecurity incident outside healthcare shows why permissions deserve more attention than they usually receive. During OpenAI cybersecurity evaluations, roughly 1,200 agents that were supposed to be isolated found an unsanctioned shared message board, exchanged more than 70,000 messages and files, and about 700 participated in an attack on Hugging Face. The independent METR and Redwood Research investigation found that the agents coordinated workstreams and achieved milestones they likely could not have achieved individually. Hospitals should not assume that bounding each agent separately will always bound what a collection of agents can accomplish when they can share tools, credentials, information, or tasks.

Access Control Is No Longer Enough

Healthcare already has strong concepts for governing access. The HIPAA Security Rule requires regulated entities to implement safeguards that protect electronic protected health information, including access controls, audit controls, and information-access management. HHS audit guidance explicitly contemplates access by both people and software programs and asks organizations to define technical access capabilities such as read-only, modify, and full access. That audit protocol also emphasizes unique identifiers and reviewable activity logs.

Agentic AI adds another layer. A hospital can know that an agent has access to a patient record without having answered whether the agent may change an appointment, initiate an authorization, message a patient, call another system, delegate a task to another agent, or trigger an order for human review. NIST has recognized this distinction in its 2026 work on software-agent identity and authorization, which asks how organizations should handle identification, authorization, auditing, and non-repudiation for AI agents.

Hospitals therefore need a second artifact alongside traditional access-control lists: a clinical authority map. For every production or pilot agent, the map should identify an accountable human owner; the systems and data the agent may access; the actions it may take without approval; actions that require human authorization; whether it may communicate with or delegate to other agents; how long elevated permissions last; how authority can be revoked; and what records must be preserved so investigators can reconstruct the chain of action.

Consider a discharge-planning agent. It might reasonably read parts of the chart, identify follow-up tasks, draft patient instructions, and propose appointment slots. Those permissions do not automatically justify allowing it to modify a medication order, send a clinically consequential instruction without review, or delegate work to another agent with broader credentials. The authority map forces the hospital to make those distinctions before deployment instead of discovering them after an unexpected action.

Make Authority Proportional to Consequence

This approach fits the direction of broader AI governance. NIST’s AI Risk Management Framework calls for organizations to define roles, responsibilities, application scope, and human oversight. Health IT policy is also moving toward greater transparency. The ONC HTI-1 rule established algorithm-transparency requirements for predictive decision support in certified health IT. Those measures help users understand AI-supported decisions. Authority maps address a different operational question: what can the system do after it receives information or reaches a conclusion?

Hospitals should scale authority in tiers. Low-consequence agents may receive standing permission to retrieve information or complete reversible administrative tasks. Agents that can write to clinical systems, communicate externally, move money, alter care workflows, or initiate clinically meaningful actions should face narrower permissions and stronger approval gates. NIST’s current work on trustworthy AI in critical infrastructure likewise points toward tested guardrails and human oversight for autonomous systems. Organizations should review permissions whenever an agent’s model, tools, integrations, or workflow changes. HHS cybersecurity guidance already stresses that access controls, audit controls, authentication, and security configuration need deliberate implementation, rather than assuming default settings are sufficient.

A clinical authority map will not eliminate AI risk. It does something more practical: it makes delegated power visible. That visibility helps clinicians understand where human judgment remains mandatory, gives security teams clearer boundaries to enforce, and gives executives a concrete record of what they have authorized. Hospitals can then expand an agent’s authority as evidence and trust accumulate, instead of granting broad permissions first and trying to reconstruct control afterward.

The hospitals that use agentic AI effectively will probably give some systems substantial responsibility. They should do so deliberately. Before an AI agent receives more autonomy, the organization should be able to answer a simple question in writing: exactly what is this agent allowed to do, and who can stop it?

About Gleb Tsipursky, PhD

Gleb Tsipursky, PhD, is CEO of Disaster Avoidance Experts and author of The Psychology of AI Adoption at Work: From Resistance to Results (Georgetown University Press, 2026). A behavioral scientist, he advises organizations on AI adoption and decision-making.

What You Should Know

• Global laboratory informatics provider Clinisys officially unveiled its AI Innovation Roadmap, establishing an open, governed platform strategy designed to embed artificial intelligence, analytics, and workflow automation into routine laboratory operations.
• The roadmap articulates a compounding evolutionary progression that advances laboratory informatics across four distinct architectural phases: from a System of Record to a System of Workflow, a System of Intelligence, and ultimately an autonomous System of Orchestration.
• The operational paradigm enables clinical, diagnostic, and life sciences laboratories to mature through three distinct stages of technological capability: Inform (descriptive operational insights), Optimize (predictive analytics and instrument anomaly detection), and Transform (agentic workflow orchestration governed by human-in-the-loop oversight).

The Digital Maturity Progression: Compounding Laboratory Intelligence

The roadmap advances the Clinisys Connected Laboratory Intelligence value chain through a compounding maturity progression that shifts the laboratory from a static System of Record focused on descriptive insight, to a System of Workflow standardizing task execution, to a System of Intelligence optimizing operations via prediction and anomaly detection, and ultimately to an agentic System of Orchestration that executes workflows under human approval. CTO Shay Hassidim noted that this framework ensures every laboratory decision—from sequencing specimens to advancing therapeutic discovery—is informed by governed, generative AI grounded in trusted laboratory context while maintaining clinicians in full control.

Open Architecture Foundations: CLS MCP and No-Code Decisioning

Rather than locking healthcare organizations into a single proprietary ecosystem, Clinisys established two open foundation paths running on the Clinisys Laboratory Solution Extended API and shared platform services. The CLS Model Context Protocol foundation adopts the emerging MCP standard to allow advanced IT teams to safely connect approved enterprise AI assistants to governed laboratory information with strict organizational permissions, guardrails, and auditability. In parallel, the CLS NoCode AI foundation leverages pre-built components to let frontline lab teams configure automated, governed workflows—such as reflex testing, result verification, and corrective actions—without writing software code. These capabilities are intended to scale across a planned Clinisys AI Marketplace that will distribute certified agents, skills, and third-party extensions.

The broader strategy organizes shared AI capabilities into five targeted outcome domains, spanning embedded Workflow Copilots, conversational and predictive Advanced Analytics, automated specimen and turnaround-time Orchestration, the AI Marketplace, and an Intelligent Lab Command Center designed to unify instrument telemetry and agent oversight. Demonstrating this architecture in practice, Clinisys previewed two initial agent experiences: the Analytics Agent, which conversationally guides authorized personnel through asking, visualizing, analyzing, exporting, and scheduling governed datasets; and the Equipment Care Agent, which evaluates analyzer activity, quality-control metrics, and maintenance logs to detect mechanical issues early and eliminate avoidable test reruns. Director of AI Analytics and Agentic Platforms Prashant Prabudh emphasized that the ultimate advantage is not any single agent, but rather this open, governed intelligence layer that connects data, APIs, and workflows to sustain continuous operational innovation across the more than 7,000 laboratories Clinisys serves worldwide.

What You Should Know

• Counsel Health officially launches its dedicated weight management program, integrating obesity pharmacotherapy with comprehensive primary care.
• As part of the commercial rollout, Counsel Health is collaborating with LillyDirect, the direct-to-consumer digital pharmacy initiative developed by Eli Lilly and Company.
• The program responds to sharp shifts in national prescribing patterns, with the percentage of American adults taking GLP-1 medications for weight loss climbing to 11% in 2026, up from 3% in 2024.

Whole-Person Primary Care vs. Isolated Prescribing

Founded by physician and former Notable Health Chief Medical Officer Dr. Muthu Alagappan, Counsel Health differentiates its model by rejecting the notion that obesity can be treated as an isolated cosmetic concern. Because obesity frequently coexists with complex metabolic and mechanical comorbidities, Counsel wraps weight management inside a full-stack, longitudinal primary care practice:

• Comprehensive Chronic Condition Management: Rather than siloing weight loss, Counsel’s board-certified physicians manage obesity in the context of associated conditions, including essential hypertension, type 2 diabetes, hyperlipidemia, obstructive sleep apnea, and musculoskeletal joint pain.
• Proactive Medical AI & Rapid Physician Escalation: Operating across the 44 states where Counsel is licensed, the platform deploys clinically supervised medical AI that proactively checks in on patient progress, monitors titration tolerance, and flags adverse gastrointestinal side effects. Members can query the AI at any time at zero cost or connect with an in-house physician on demand—typically within minutes.
• Expanded Pharmacotherapy Formulary: Following digital clinical intake and comprehensive physician evaluation, Counsel clinicians prescribe guideline-directed therapies when clinically indicated, spanning subcutaneous injectables like Zepbound® (tirzepatide) and Wegovy® (semaglutide), as well as emerging oral small-molecule options including Foundayo (orforglipron).

Dr. Muthu Alagappan emphasized the care philosophy: “GLP-1s are powerful medications, but a prescription alone is not a care model. Patients managing obesity benefit from ongoing access to physicians who understand their health journey and take a holistic approach to primary care. We built Counsel to democratize this experience for millions of people.”

Disrupting DTC Economics: Cash-Pay Transparency and Direct LillyDirect Integration

A core barrier to sustained cardiometabolic therapy is the high out-of-pocket cost of digital clinic memberships, which often run between $99 and $149 per month on top of prescription pharmacy costs. Counsel leverages its AI-native triage and intake platform to reduce clinician overhead, offering low-cost cash pricing designed to drive multi-year retention.

Counsel Signature Annual Membership offers unlimited on-demand access to Counsel physicians for $300 per year (equivalent to $25 per month), covering both weight management and broader primary and urgent care needs. For patients seeking episodic oversight, the platform provides a $29 per-visit option with no ongoing membership commitment.

Consumers accessing care through the LillyDirect digital health portal can select Counsel Health alongside other virtual providers. The integration routes patients into Counsel’s chat-first clinical engine, connecting them with a physician in an average of fifteen minutes to coordinate clinical evaluation, home delivery, or local pharmacy pickup.

For decades, the industry has organized itself around a single question: how do we discover more, and better, drug candidates? Target identification keeps getting smarter, molecule generation keeps getting faster, and AI has now touched nearly every stage of early discovery. Yet a molecule is only ever as good as the patients it happens to be tested on, and that half of the equation has received a fraction of the innovation investment.

Consider what happened across non-small cell lung cancer last year. Seven new FDA approvals arrived in 2025, each tied to a specific genomic alteration rather than a broad diagnosis, spanning antibody-drug conjugates, bispecific antibodies, and targeted kinase inhibitors. That wave didn’t happen because the underlying biology of lung cancer changed. It happened because the field finally had the tools to see that “lung cancer” was never one disease to begin with, and to match each therapy to the subset of patients whose tumors were actually driven by the mechanism it targets.

Contrast that with a 2023 JAMA Internal Medicine analysis of drugs the FDA approved between 2018 and 2021, which found that roughly one in ten had failed to meet its primary efficacy endpoint in the pivotal trial that supported approval. Some of those drugs went on to help real patients anyway. But a meaningful share of what looks like scientific failure in this industry is actually a measurement failure: a real effect, diluted past the point of statistical detection by a population that was never properly stratified in the first place.

Why patient selection is harder than it sounds

The instinct, when a trial disappoints, is to blame the molecule. Increasingly, that instinct deserves scrutiny. A 2025 study in a Nature portfolio journal found that oncology trials using biomarkers to stratify patients tend to show meaningfully higher success rates than trials that don’t, and the FDA has now recognized dozens of genes, along with markers like MSI-H and tumor mutational burden, as validated predictors of response across cancer types. That is real progress, and it still understates how much work remains, because a biomarker that predicts response in an observational cohort does not automatically hold up once it’s tested prospectively.

The PROFILE trial in Crohn’s disease is instructive here. A blood-based biomarker had shown real promise in earlier observational research, predicting which newly diagnosed patients were likely to face an aggressive disease course. When that same biomarker was tested in a properly powered interventional trial, it failed to demonstrate the treatment interaction researchers were looking for. The result wasn’t a wasted trial; researchers now know, with far greater confidence, that this particular signal isn’t the one to build a stratification strategy around, which is exactly the kind of finding that should redirect resources rather than get quietly filed away as a disappointment.

That is the deeper lesson pharma needs to sit with. Stratifying patients well is not a matter of bolting one more biomarker onto an inclusion checklist and calling it precision medicine. It requires understanding how a patient’s underlying biology behaves before treatment starts, how confidently that behavior predicts response, and whether the signal actually replicates once real dollars and real patients are on the line.

What separates the companies that will win this decade

Bringing a new drug to market now costs an average of $2.67 billion for large pharmaceutical companies, according to a recent Deloitte estimate, and a substantial share of that cost has nothing to do with the underlying chemistry or biologic design. It comes from enrolling patients who were never going to respond, dosing without a clear rationale for who needs more and who needs less, and running trials against populations so heterogeneous that a genuine effect gets lost in the noise before anyone has a chance to see it.

Every company chasing AI-driven drug discovery right now has access to increasingly similar tools for generating candidates faster, which means discovery speed is likely to commoditize as a source of advantage much sooner than most pharma strategy decks currently assume. What won’t commoditize as easily is the discipline of knowing, earlier and with more precision, which patients a given mechanism is actually built for, paired with the infrastructure to prove that before a trial is designed rather than after it fails.

The companies that build that discipline into how they run trials, not just how they design molecules, are the ones whose late-stage failure rates will start to look structurally different from everyone else’s over the next several years. That is a harder capability to build than a better screening algorithm, and precisely because it’s harder, it’s the capability that will end up mattering more.

The next generation of breakthrough therapies won’t just be better designed. They’ll be better matched to the patients who were always going to benefit from them, identified early enough that the trial actually has a chance to prove it.

About Noam Solomon

Noam Solomon is the co-founder and CEO of Immunai, a biotech startup using single-cell genomics and machine learning to discover and develop novel therapeutics that reprogram the immune system. Noam, who began his studies at Tel Aviv University at the age of 14 and earned his bachelor’s degree in computer science by 19, continued his academic journey earning two PhDs at MIT and Harvard. While at MIT, Noam met his co-founder, Luis Voloch, and launched Immunai in 2018. Under Noam’s leadership, Immunai has partnered with top pharmaceutical companies and academic institutions to improve clinical trial success rates and therapy effectiveness.

What You Should Know

• The Office of the National Coordinator for Health Information Technology (ONC) at the U.S. Department of Health and Human Services (HHS) officially released the Health Data, Technology, and Interoperability: ONC Deregulatory Actions to Unleash Prosperity (HTI-5) Final Rule.
• Directly implements the administration’s regulatory reform directives under Executive Order 14192 (Unleashing Prosperity through Deregulation) and Executive Order 14267 (Reducing Anti-Competitive Regulatory Barriers).
• Delivers a net present value of $1.55B in cost savings ($108.1 million annualized net savings discounted at 7% beginning in 2027 in perpetuity) by cutting compliance and testing overhead for health IT developers.
• Projects $0 in new ongoing compliance implementation costs for developers of certified health IT.

Dismantling the AI “Model Card” Mandate: Rewiring Decision Support Interventions

ONC ultimately finalized the removal of 14 certification criteria and the revision of seven others, retaining 39 criteria completely intact. In doing so, federal regulators preserved foundational privacy and security requirements, held the line on usability and quality management baselines, extended a multi-year lifeline to legacy Consolidated CDA (C-CDA) transitions of care, and decoupled federal artificial intelligence “model card” mandates from certified EHR technology.

The most closely watched policy pivot in HTI-5 centers on Decision Support Interventions (DSI) under 45 CFR § 170.315(b)(11). In the previous HTI-1 Final Rule, ONC established stringent algorithmic transparency rules requiring health IT developers to display standardized “source attributes”—effectively nutrition labels or “model cards”—for predictive decision support interventions (PDSIs), detailing training datasets, demographic validation benchmarks, and algorithmic funding sources.

Under HTI-5, ONC finalized a complete removal of these predictive model card and intervention risk management requirements:

• Elimination of Source Attribute Display (§ 170.315(b)(11)(iv) & (v)): Developers of certified EHR modules are no longer required to build and maintain user interfaces that display underlying algorithmic training data, model provenance, or source attributes to clinicians at the point of care.
• Removal of Developer Maintenance of Certification (§ 170.402(b)(4)): Conforming edits remove the ongoing maintenance mandate requiring health IT vendors to routinely review and update risk management practices and source attribute metadata.
• Rescinding Intervention Risk Management (§ 170.315(b)(11)(vi)): Developers are relieved of federal certification audits regarding ongoing model drift monitoring and risk mitigation protocols.
• Focusing Scope on Core Clinical Data: The data classes required to trigger predictive DSIs are narrowed to data expressed in Clinical Notes and the Assessment and Plan of Treatment, eliminating burdensome mandates to configure predictive algorithms against non-clinical fields (e.g., patient phone numbers).
• Formal Deletion of Expired CDS (§ 170.315(a)(9)): Regulators formally struck and reserved the legacy clinical decision support criterion that expired on January 1, 2025.

In justifying the reversal, ONC noted that clinicians operating in high-pressure clinical workflows rarely access technical model cards, while the regulatory overhead of maintaining compliance was depressing developer investment in frontier artificial intelligence. The agency emphasized that oversight of clinical algorithmic safety is more properly anchored within the Food and Drug Administration (FDA) and civil rights non-discrimination rules (45 CFR § 92.210) rather than standard EHR certification.

The Great Compromise: Preserving Usability, Quality, and Security Floors

While developers secured substantial relief around AI compliance, provider associations, patient advocates, and safety-net organizations successfully pushed back against proposals that threatened clinical safety and software integrity:

• Privacy & Security Framework Retained (§ 170.315(d) and § 170.550(h)): ONC completely abandoned its controversial proposal to eliminate all 13 privacy and security certification criteria. The agency acknowledged overwhelming feedback from health systems and small practices warning that eliminating certified encryption, user authentication, and audit logs would strip providers of baseline verification tools required for HIPAA Security Rule compliance.
• Safety-Enhanced Design (SED) Streamlined to Attestation (§ 170.315(g)(3)): Rejecting total elimination, ONC preserved the usability mandate but converted it from a heavy summative laboratory testing regime into an attestation-based standard. This maintains the user-centered design baseline while stripping out cumbersome post-development usability reporting.
• Quality Management Systems (QMS) Preserved (§ 170.315(g)(4)): ONC retained the mandatory QMS criterion across all certified modules, affirming that baseline adherence to federal or ISO quality development frameworks remains an essential filter against substandard market entrants.
• Accessibility-Centered Design (ACD) Retained (§ 170.315(g)(5)): The agency kept the requirement that developers identify and apply accessibility standards during development, ensuring digital equity protections remain visible in certified products.
• Implantable Device List (IDL) Saved for CMS Alignment (§ 170.315(a)(14)): Proposed removal of the IDL criterion was scrapped after CMS finalized its new “Unique Device Identifiers for Implantable Medical Devices” measure in the FY 2027 IPPS final rule, maintaining UDI capture within the Base EHR definition.

The C-CDA Glidepath: A 2030 Sunset for Legacy Document Exchange

Recognizing that small clinics, long-term post-acute care (LTPAC) facilities, and behavioral health providers remain heavily reliant on document-based workflows, ONC restructured its transitions-of-care policies to establish an orderly runway toward an all-FHIR ecosystem:

• Transitions of Care Extension to 2030 (§ 170.315(b)(1)): Rather than stripping C-CDA creation and Direct secure messaging edge protocols by 2027, ONC extended the compliance sunset to January 1, 2030. This gives the healthcare ecosystem a four-year bridge to deploy mature, bidirectional FHIR-based exchange without risking patient referral drop-offs.
• CIRI Converted to a Functional Mandate (§ 170.315(b)(2)): The “clinical information reconciliation and incorporation” criterion was not eliminated. Instead, ONC stripped out rigid C-CDA document-format constraints and removed the outdated requirement to display data sources simultaneously side-by-side, converting CIRI into a flexible, functional criterion that accommodates automated and FHIR-native reconciliation workflows.
• Elimination of Redundant CDA Testing (§ 170.315(g)(6)): The secondary “Consolidated CDA creation performance” criterion was eliminated immediately, removing duplicative conformance testing for developers already certifying primary clinical exchange capabilities.

Real World Testing, SVAP, and ASTP Reversal

Beyond individual criteria, HTI-5 implements significant structural changes to the maintenance conditions governing certified developers:

• Delineating Real World Testing (RWT) (§ 170.405): Conforming to the enforcement discretion issued in June 2025, ONC eliminated the requirement for health IT developers to submit formal annual Real World Testing plans. Full RWT results reporting is now strictly confined to core API criteria (§ 170.315(g)(10) and provider prior authorization APIs § 170.315(g)(31)–(33)). For non-API criteria remaining within RWT scope (including retained cancer and survey reporting), developers need only document voluntary standards updates adopted via the Standards Version Advancement Process (SVAP).
• Preserving Public API Endpoint Transparency (§ 170.404(b)(2)): Regulators formally rejected vendor requests to eliminate the public publication of service base URLs. ONC affirmed that maintaining public directories of active FHIR endpoints is essential for third-party application onboarding and patient data access.
• Retiring ASTP Branding and Restoring ONC Authority: Conforming to administrative reorganizations, HTI-5 systematically strips all references to the “Assistant Secretary for Technology Policy (ASTP)” from 45 CFR Part 170 and the TEFCA regulations under Part 172, legally restoring the primacy and title of the Office of the National Coordinator for Health Information Technology (ONC).
• Status of Information Blocking: ONC confirmed that deregulatory proposals modifying federal information blocking disincentives and exceptions remain under active agency review and were not finalized in this release.

Clearing the Deck for the Super-Intelligence FHIR Era

The finalization of HTI-5 clarifies the federal government’s broader digital health trajectory:

• Lowering Market Entry Barriers: By stripping out 14 obsolete, duplicative, or overly prescriptive criteria, ONC directly reduces testing costs and legal overhead for emerging digital health vendors. Startups building modular tools no longer need to spend six-figure testing budgets proving compliance with legacy numerator reporting or dead-end C-CDA formatting benchmarks.
• Preparing for the Model Context Protocol (MCP) and Agentic AI: In its preamble, ONC noted that modernizing the Certification Program around FHIR APIs is a necessary prerequisite to support super-intelligence (SI) applications. The agency highlighted emerging standards like the Model Context Protocol (MCP)—which standardizes how external clinical applications feed structured context to Large Language Models—indicating that future rulemaking will prioritize dynamic, read/write FHIR APIs over static data-entry criteria.
• The Victory of Administrative Federalism: The substantial divergence between the proposed and final rules illustrates the influence of interagency coordination. ONC’s decisions to preserve the UDI implantable device list, retain cancer registries, and extend C-CDA transitions of care to 2030 were dictated by real-world alignment with CMS payment rules, CDC surveillance operations, and hospital operational realities.

National Coordinator for Health IT Tom Keane, M.D., summarized the operational pivot during Monday’s rollout: “Through HTI-5, we have taken decisive action to significantly lower the administrative compliance burden for developers so that they can spend more of their time developing solutions that improve interoperability, automation, and better healthcare for Americans. A successful certification program should establish the floor healthcare needs without becoming the ceiling innovation keeps hitting.”

Operational Verification Checklist for Health IT Developers & Provider CIOs

• Audit Active DSI Model Card Roadmaps: Halt engineering allocations dedicated to building outward-facing model card UIs under § 170.315(b)(11)(iv)–(v); redirect clinical informatics teams toward internal algorithm bias monitoring aligned with Section 1557 requirements.
• Adjust SED Usability Compliance Protocols: Transition development documentation for Safety-Enhanced Design (§ 170.315(g)(3)) from external summative lab testing reports to standardized internal user-centered design attestation packages.
• Update 2027 CEHRT Certification Bundles: Verify that hospital and ambulatory EHR software configurations maintain compliance with CMS Promoting Interoperability measures by confirming continued support for the retained IDL criterion (§ 170.315(a)(14)) and functional CIRI workflows (§ 170.315(b)(2)).
• Recalibrate C-CDA to FHIR Roadmap: Re-anchor enterprise clinical data exchange strategies around the new January 1, 2030 sunset date for C-CDA transition-of-care creation and Direct edge protocols (§ 170.315(b)(1)).
• Streamline Real World Testing Submissions: Remove RWT plan generation from upcoming developer compliance cycles; restrict annual real-world performance metric tracking strictly to certified FHIR API endpoints (§ 170.315(g)(10) and prior authorization APIs).

The EHR is poised to evolve from its original role as a place to store patient information. The next step is for it to take a more active role in the patient care journey.

As more of the journey becomes digitized, the EHR can help move work forward by connecting workflows, surfacing what needs attention, and using AI to reduce administrative burden. This shifts the EHR from a system of record to a system of action.

In ambulatory care, that shift has practical implications. Scheduling, documentation, billing, care coordination, and follow-up depend on one another. Today, much of the responsibility for keeping those processes moving still falls on people and is often spread across different systems. As EHRs become more intelligent, they can make that coordination easier by surfacing relevant information, identifying what needs attention, and helping users take an informed next step more quickly.

That does not mean removing people from the process. There are decisions that require professional judgment and always will. But there is a difference between doing the tedious, repetitive tasks and going through multiple steps required to get to that resolution. Technology should help users reach the needed destination faster and with less manual effort.

AI is an opportunity to make that shift possible at scale. Rather than simply making individual tasks faster, an AI-enabled EHR can help providers and staff navigate the broader workflows surrounding patient care and reduce the manual effort required to keep work moving across the practice. The bigger opportunity is to create a more connected experience for both the people delivering care and the patients moving through it.

Five years from now, I expect that distinction to be much more visible. Clinicians and staff will still direct care, but the EHR will increasingly be expected to recognize where work needs to go and help advance it, with appropriate support for the process and those using the process.

This evolution may also change what we mean when we talk about an EHR. For years, practices have added separate technologies around the core system to address needs that the EHR could not meet. That created an increasingly large technology stack, with different vendors responsible for different pieces of the patient and practice experiences. 

As the EHR becomes more capable, the boundaries between it and the broader technology stack will become more unified. Practices will be able to manage more of their clinical, administrative, and financial workflows through a single platform, with AI increasingly embedded across those workflows to help connect and move work forward. The important question will be how much of the practice can be managed through one platform and how well that platform can adapt as the practice changes. 

This will put more responsibility on EHR vendors. Adding individual AI capabilities is relatively easy compared to embedding them into workflows across a platform in a way that is secure, reliable, and appropriate for healthcare. Vendors will need to think carefully about permissions, transparency, and where human review belongs. 

The EHR was originally built to record what happens during care. Its next evolution will be to help surface more of what happened before, what needs to happen next, and where focus should be placed as the patient journey progresses. The goal will be to reduce the burden on providers and staff while keeping them in control of the final outcome. That is a much bigger change than simply tacking on more features. It is the evolution of the EHR into a system of action.

About Baha Zeidan

Baha Zeidan is the founder and chief strategy officer of Azalea Health. He founded the company in 2008. Over 18 years as CEO, Baha built Azalea into a provider of a cloud-based health IT platform that serves more than 7,000 providers and 22 million patients across rural and community healthcare settings. He transitioned to chief strategy officer in October 2026 and continues to serve on the board of directors. As chief strategy officer, he leads M&A and key client and partner relationships.