Please subscribe to Agentman's newsletters
Subscribe
CoverMyMeds publishes that patients get their medications 13.2 days sooner when prior auths are started at the point of prescribing. Their own survey found only 17% of providers do it. The gap isn't ignorance — there's a real argument for waiting that nobody has written down.
A prescription goes out. The pharmacy tries to fill it. The claim rejects. That rejection generates a prior authorization request that arrives back at the practice as a fax — the same clinical event, now a second document, landing in the same pile as everything else.
In a year-long study at a federally qualified health center, 36% of refill requests carried a clinical finding — a patient overdue for labs, a dose that should have changed, a drug that should have stopped. The more troubling number: of the drug therapy problems found, 55% were never addressed.
Every vendor selling refill automation answers the same question: what percentage can you auto-approve? It's the wrong question. A refill request has no identity until someone reads it — and in our production triage system, it can turn out to be any of six different jobs.
We analyzed one practice's denials and found $98 worth worth appealing. Then we read the actual remittances and found $5,413 — in the same month, at the same practice. The first method was structurally blind, and it's the method most denial reports use.
A security questionnaire a small practice can actually run — no procurement team required. Copy the list, send it, and read the answers for artifacts rather than adjectives. We answer all 21 ourselves at the bottom.
Yes — with a BAA and the right safeguards. The harder questions are where the data travels during inference, how little of it the agent actually needs, and what ends up sitting in prompt logs nobody thought to check.
A SOC 2 report is real evidence — but the vendor helped choose what was examined, and the badge on the website tells you none of that. What to ask for, how to read the report, and why 'SOC 2 ready' means nothing at all.
An AI agent that touches patient data is a business associate, with direct legal liability. Here's what the BAA has to cover, which AI-specific questions older templates miss, and what an audit trail needs to contain when an agent acted instead of a person.
HHS does not certify anyone as HIPAA compliant — it says so in writing. Here's what the label actually means when an AI vendor uses it, what to ask for instead, and the one document that carries legal weight.
See how production-grade AI agents handle your toughest workflows.