Key Takeaways:

• Agents carry revenue cycle work through to completion. They move across the EHR, clearinghouse, payer portals, phone, and fax to finish multi-step tasks, and the strongest deployments start where data already flows electronically and keep people on clinical judgment and high-stakes submissions.
• HIPAA already covers agents. The Security Rule’s access control standard applies to “persons or software programs,” so each agent needs its own identity, least-privilege access, audit logging, and a business associate agreement with its vendor.
• Prior authorization is moving to APIs. CMS requires impacted payers to offer FHIR-based prior authorization APIs by January 1, 2027, and more than 50 insurers have pledged real-time answers for at least 80% of electronic approvals that year, so build agents that can switch channels as payers come online.

If you’re a health system CTO or a digital health founder evaluating AI for revenue cycle operations, you’re choosing between automation that completes whole workflows and tools that help staff at individual steps. Investors are betting on the first. On September 8, 2026, GenHealth.ai announced a $16.5 million Series A led by Flare Capital Partners, bringing its total funding to $30 million, to expand AI agents that handle intake, eligibility, prior authorization, billing, and denials inside the systems providers already use.

The pressure behind that bet is easy to see. Administrative costs account for nearly a quarter of U.S. healthcare spending, according to an NBER analysis by McKinsey and Harvard researchers, which estimated that wider AI adoption could save 5% to 10% of total spending, roughly $200 billion to $360 billion a year in 2019 dollars. On the revenue side, a Premier survey found that private payers initially deny nearly 15% of claims, and providers spend an average of $43.84 per claim fighting denials.

The decision in front of you is architectural: connect agents to the systems you already run, adopt the AI your EHR vendor ships, or build workflows of your own. This guide covers where agents fit in the revenue cycle, how they integrate, what HIPAA requires of them, how to set their guardrails, how prior authorization rules are shifting, and how to measure the return.

What AI Agents Do That Assistive AI Doesn’t

Assistive AI responds to a request inside one application. A reviewer opens a chart and gets a summary, or a coder gets a suggested code. Iodine Software, for example, reports that users of its generative AI tools cut the time spent on initial medical reviews by 63%, from about 15 minutes to as few as five. The person still does the work, faster.

An agent plans and executes the work itself. It reads a patient record in the EHR, checks coverage, determines whether a service needs prior authorization, assembles the documentation, submits the request, monitors for a decision, and updates the billing system when the answer arrives. GenHealth describes its agents running intake, eligibility, prior authorization, billing, and denials end to end across EHRs, payer portals, fax, and phone. They onboard much like a new hire: staff show the agents their workflows, and the practice creates user accounts for the AI. That detail matters for compliance, as the HIPAA section below explains.

Health system leaders are moving in this direction. In a Deloitte survey of 100 health care technology executives conducted in September 2025, more than 80% of health systems said they’re prioritizing agentic AI for clinical operations and revenue cycle management. Payers are too: 70% of the health plans surveyed are prioritizing agentic AI for utilization management, prior authorization, and claims. Your agents will increasingly be dealing with theirs.

Where Agents Fit in the Revenue Cycle

Agents can work at nearly every stage of the revenue cycle, but the channel, the risk, and the right level of autonomy differ by stage.

Stage	What an agent does	Main channels	Where people stay involved
Intake and scheduling	Collects demographics and insurance, flags missing documents, sends reminders	EHR, patient portal, text	Exceptions and patient questions
Eligibility and benefits	Verifies coverage, finds secondary insurance, prepares cost estimates	Standard X12 270/271 transactions, payer portals	Coverage mismatches
Prior authorization	Checks requirements, assembles documentation, submits, tracks decisions	Payer portals, fax, phone, and payer APIs from 2027	Clinical justification and peer-to-peer reviews
Coding and charge capture	Suggests codes and flags documentation gaps	EHR	Coder approval
Claim scrubbing and submission	Applies payer rules and edits before submission	X12 837 through a clearinghouse	Flagged claims
Claim status and follow-up	Checks status and chases stalled claims	X12 276/277, payer portals, phone	Escalations
Denials and appeals	Classifies denials, fixes routine errors, resubmits, drafts appeals	X12 835 remittances, payer portals	Appeals that need clinical argument
Payment posting	Reconciles remittances and deposits	X12 835, bank feeds	Variances

Much of the revenue cycle already runs on HIPAA’s standard electronic transactions, and prior authorization is the major exception. That’s where most of the manual work, and most of the portal and fax automation, still lives.

How to Integrate Agents With EHR, Clearinghouse, and Payer Systems

Most deployments combine more than one kind of connection, each with its own tradeoffs.

Standard electronic transactions. HIPAA requires health plans to support standard electronic transactions for eligibility, claims, claim status, remittance, and prior authorization, usually exchanged through a clearinghouse. These are the most dependable channels an agent can use. The 2025 CAQH Index found claim status inquiries 81% electronic and claim payments 78%, while medical prior authorization reached only 40%. CAQH estimates that automating the remaining manual transactions could save more than $20 billion a year.

APIs. EHRs expose FHIR and proprietary APIs for reading demographics, coverage, and documentation and for writing results back. API connections produce clean logs and scale well, but they depend on what each vendor exposes. Payer APIs are expanding, with impacted payers required to offer FHIR-based prior authorization APIs by January 2027 under the CMS rule covered below.

Portal automation. Where no API or standard transaction exists, agents log into payer portals and work through screens the way a person would, using robotic process automation or browser automation. It works with almost any web interface, and it’s brittle: a portal redesign can break an agent overnight, so budget for ongoing maintenance and review each portal’s terms of use before automating it. GenHealth’s CEO has said the company designs its agents to be nearly deterministic, avoiding the cost and variability of image-based computer models.

Native EHR agents. EHR vendors now ship agents of their own. Epic’s revenue cycle AI, Penny, has been live since 2025 for coding and denial appeal letters. Epic reports that coding-related denials fell by more than 20% at its most active users, and that Summit Health cut medication prior authorization submission time by 42%. Epic says Penny will eventually complete coding and appeal submissions on its own within each organization’s guardrails, and its Agent Factory lets health systems build and monitor their own agents inside Epic. Native tools fit your EHR cleanly but follow the vendor’s roadmap and scope.

The orchestration layer. Above these connections sits the layer that sequences the work: pull the order and coverage from the EHR, check requirements, submit through whichever channel the payer supports, wait for a decision, and write the result back. This layer also holds workflow state, retries failed steps, prevents duplicate submissions, and routes exceptions to the right person. Most of an agent’s reliability lives here, so give it the same engineering attention as the model. Dogtown’s guide to EHR integration covers the data connections underneath.

HIPAA Compliance for Agents That Touch PHI

HIPAA is technology-neutral, so the rules that govern staff and software apply to agents too. The Security Rule’s access control standard already covers them: it requires systems to allow access to ePHI only to “persons or software programs” that have been granted access rights.

Give every agent its own identity. Unique user identification is a required safeguard, so each agent should run under its own account, never a staff member’s borrowed login. That’s the model GenHealth describes, with practices creating user accounts for the AI. Separate identities make audit logs meaningful and let you revoke an agent’s access without touching anyone else’s. Store portal credentials in a secrets vault, and decide how the agent handles multifactor prompts before go-live.

Apply least privilege and minimum necessary. Revenue cycle work is a payment activity, so HIPAA’s minimum necessary standard applies. An eligibility agent needs demographics and coverage, not clinical notes. A prior authorization agent needs the documentation for the specific order, not the whole chart.

Log everything the agent does. The audit controls standard requires mechanisms that record and examine activity in systems containing ePHI. For an agent, that means every record it reads, every field it writes, and every submission it makes, tied to the agent’s identity and a timestamp. HIPAA doesn’t require logging the rule or reasoning behind each action, but that’s what lets your team reconstruct a bad outcome.

Encrypt in transit and at rest. Under the current Security Rule, encryption is an addressable specification, which means you assess it and document your decision. HHS proposed making encryption mandatory in January 2025, though as of mid-2026 the rule remained a proposal, with the federal regulatory agenda pointing to 2027. Encrypt anyway. PHI encrypted to HHS’s standards isn’t “unsecured,” so losing it doesn’t trigger breach notification.

Sign a business associate agreement first. An AI vendor whose agents create, receive, maintain, or transmit PHI for you is a business associate, and the agreement has to be in place before PHI flows. HIPAA requires it to set permitted uses and disclosures, require safeguards, require the vendor to report breaches and security incidents, flow the same terms down to subcontractors, give HHS access to the vendor’s records, and return or destroy PHI at the end. Business associates must report breaches to the covered entity without unreasonable delay and no later than 60 days after discovery. For agents, negotiate past the minimum: name the model and cloud providers acting as subcontractors, prohibit training on your PHI without approval, and add audit rights.

Plan for agent-caused breaches. The realistic scenario is an agent that sends the wrong patient’s records to a payer or writes to the wrong account. When a breach of unsecured PHI occurs, the covered entity notifies affected individuals without unreasonable delay and within 60 days of discovery, notifies HHS in the same window when 500 or more people are affected (or in an annual log for smaller breaches), and notifies the media when a breach affects more than 500 residents of a state. Patient-matching checks before every write are a strong safeguard. Dogtown’s HIPAA-compliant app development work builds these controls into the architecture.

Guardrails: Deciding What an Agent Does Alone

Autonomy should follow risk. Sort every action an agent can take into tiers, and decide in advance which ones it may complete without a person.

• Reading data, such as checking a claim’s status or a patient’s coverage, can run autonomously from day one.
• Reversible internal writes, such as updating a work queue or adding a note to an account, can run autonomously with regular QA sampling.
• External submissions, such as sending a claim, a corrected claim, or a prior authorization request, can run autonomously when the logic is rule-based and the stakes are routine, with approval gates for high-dollar claims and anything unusual.
• Clinical judgment, such as arguing medical necessity or handling a peer-to-peer review, stays with clinicians.

Generative steps need extra care. An appeal letter drafted by a language model can state clinical facts that aren’t in the chart, so ground every draft in retrieved documentation, cite the source notes, and require human review before any appeal that makes a clinical argument goes out. Set confidence thresholds that send uncertain cases to a person, and give operators a way to pause an agent instantly. Dogtown’s AI compliance and risk mitigation practice designs these controls.

Coding agents carry a specific legal risk. The provider remains responsible for every claim it submits, and systematic coding errors repeated across thousands of claims can create False Claims Act exposure. Audit coding agents the way you’d audit a new coder, with heavier sampling at the start, and watch for drift when payer rules or code sets change.

What an Agent-Run Prior Authorization Looks Like

Here’s how a single request might move through a well-governed agent, using a hypothetical outpatient MRI order.

Step	What the agent does	Autonomy	What gets logged
Trigger	Detects a new lumbar spine MRI order in the EHR work queue	Autonomous read	Order, patient, timestamp
Requirement check	Looks up the payer’s rules and confirms authorization is required	Autonomous read	Rule version applied
Documentation	Pulls the relevant notes, imaging history, and therapy records for this order only	Autonomous read, minimum necessary	Each document accessed
Submission	Builds the request and submits it through the payer’s portal	Autonomous routine submission	Submission ID and channel
Follow-up	Checks status on schedule and receives a request for physical therapy notes	Autonomous read	Each status check
Response	Retrieves the therapy notes and submits them	Autonomous routine submission	Documents sent
Decision	Records the approval and authorization number in the EHR and billing system	Autonomous reversible write	Fields written
Exception path	Routes a denial or peer-to-peer request to the clinical team with a case summary	Human	Handoff and assignee

Every step runs under the agent’s own identity, so a reviewer can reconstruct the whole case from the log. And when the payer’s Prior Authorization API comes online, only the submission and follow-up steps change.

Which RCM Use Cases Deliver the Highest ROI

Start with denials. Premier’s national survey of hospitals and health systems found that nearly 15% of claims to private payers are initially denied, 15.7% for Medicare Advantage, and that 54% of those denials are eventually overturned and paid after appeals. At $43.84 per claim, providers spend about $19.7 billion a year fighting denials, and Premier estimates that $10.6 billion of it goes to claims that should have been paid when submitted. Recoverable revenue that demands persistent, repetitive follow-up is exactly what agents are built for.

Claim scrubbing reviews each claim before submission, flags coding errors and missing documentation, and checks it against payer-specific rules. Preventing a denial costs less than fighting one, and cleaner claims move through adjudication faster.

Denial management reads each denial reason, retrieves missing documentation or corrects the error, and resubmits. The best targets are high-volume, low-complexity denials such as missing authorization numbers, incorrect patient identifiers, and simple coding mismatches. Complex denials that need clinical review still go to people, who now spend their time on the cases that need them.

Prior authorization checks whether a payer requires authorization, assembles documentation from the EHR, submits, monitors for a decision, and answers requests for more information. It’s one of the most labor-intensive workflows in the revenue cycle. Guidehealth, a GenHealth customer, reports a fourfold productivity increase across intake and prior authorization and expects to save nearly $1.2 million a year. Treat vendor and customer figures like these as a starting point, and ask for the baseline behind any number you’re shown.

Eligibility and benefits verification sits at the front of the cycle. Most eligibility checks already run through standard electronic transactions, so the agent’s value lies in acting on the results: catching inactive coverage, finding secondary insurance, flagging mismatches between registration data and payer records, and preparing patient cost estimates before the visit.

Patient intake and scheduling covers the very start of the cycle: scheduling, reminders, collecting demographics and insurance before the visit, and flagging missing documents. Cleaner data at intake prevents denials downstream.

Prior Authorization Is Changing Under Your Agents

Any prior authorization agent you build now has to keep working as the rules change beneath it.

CMS’s Interoperability and Prior Authorization final rule applies to impacted payers: Medicare Advantage organizations, state Medicaid and CHIP programs and their managed care plans, and qualified health plan issuers on the federally facilitated exchanges. Since January 1, 2026, impacted payers other than those exchange plans must decide standard requests within seven calendar days and expedited requests within 72 hours, and they must give a specific reason for each denial. Public reporting of prior authorization metrics began by March 31, 2026, and by January 1, 2027, impacted payers must offer a FHIR-based Prior Authorization API. CMS is also adding an electronic prior authorization measure to its Promoting Interoperability and MIPS programs starting with the 2027 performance period, which gives hospitals and clinicians a reason to submit through those APIs.

Commercial insurers are moving too. In June 2025, more than 50 insurers pledged to standardize electronic prior authorization by January 1, 2027, and to answer at least 80% of electronic approvals in real time in 2027. The plans cover 257 million people, and the pledge is voluntary, with CMS saying it will monitor progress. In traditional Medicare, CMS’s WISeR model began in 2026, using technology vendors with AI to run prior authorization for selected services.

Build for that transition. Give your prior authorization agent a channel layer, so the same workflow can submit by portal, fax, or phone today and switch to each payer’s API as it comes online, without rebuilding the logic above it.

How to Measure ROI and Build the Business Case

Start with a baseline, measured before any agent goes live: cost to collect, initial denial rate, clean claim rate, days in accounts receivable, touches per claim, staff hours per prior authorization, and cost per transaction for eligibility, claim status, and authorization work. Measure the same things after deployment, and compare like with like, by payer and by claim type.

Labor shifts away from manual transactions, where CAQH puts the remaining industry savings opportunity at more than $20 billion a year. Each denial you prevent saves the cost of fighting it. Cash also arrives sooner. Take a hypothetical system processing 100,000 claims a month at an average of $1,500 each, about $150 million a month or $5 million a day. Cutting days in accounts receivable by five pulls about $25 million into cash sooner. That’s a one-time improvement in working capital, so keep it separate from recurring savings in your model.

Count the full cost side too: licensing, integration engineering, portal script maintenance, the staff who work escalations and audit agent output, security and compliance work, and the time to run each phase in shadow mode. Vendor results, such as Epic’s reduction in coding denials or GenHealth’s customer figures, can help set expectations, but build the business case on your own baseline.

You can take the productivity gain as reduced headcount or as capacity. Taking it as capacity means holding revenue cycle headcount flat while volume grows and moving experienced staff to complex denials, appeals, and payer negotiations, where their judgment pays off most.

How to Phase Deployment Without Disrupting Revenue Operations

Start with high-volume back-end work that carries little clinical risk: claim status checks, eligibility discrepancies, and denial tracking. Run each agent in shadow mode first, doing the work in parallel with staff, and compare results. Move it to production when its accuracy matches or beats your team’s on the same work, and keep sampling after that.

Prior authorization comes next. Delays can postpone procedures, so start with routine requests such as standard imaging, durable medical equipment, and outpatient procedures with clear criteria. Track approval rates, turnaround times, and payer requests for more information against your baseline, and expand to complex requests only when those hold.

Patient intake and scheduling come last, because errors there land on patients at check-in. Pilot with one clinic or service line, watch check-in times and patient satisfaction, and expand when both hold steady or improve.

Change management runs alongside every phase. Revenue cycle staff need to see that the agent takes on the repetitive work that consumes their day, such as checking claim status on portals, copying data between systems, and chasing routine denials. Involve them early, show them the agent’s decision logic, and give them clear ways to override it or escalate edge cases.

Once agents are live, track their operating metrics alongside the financial ones: the share of tasks completed without escalation, escalation and override rates, error rates by action type, portal failure rates, and turnaround time for each workflow. A rising override rate is often the first sign that a payer’s rules have changed.

Build, Buy, or Extend Your EHR

The build decision comes down to where your workflows live. If your organization runs on Epic and your needs match what Penny covers, extending the EHR is the fastest route, and Agent Factory opens the door to custom agents inside the same environment. Agent platforms such as GenHealth bring prebuilt workflows and their own connections to payers. Evaluate them on how they connect (standard transactions and APIs first, screen automation last), what their BAA covers, how they log agent actions, and how openly they share the baselines behind their results.

A custom build makes sense when your workflows span multiple EHRs or practice management systems, when you’re a digital health company building revenue cycle capability into your own product, or when your payer mix and specialty workflows don’t fit a vendor’s templates. A hybrid often works well: a vendor or EHR agent for standard tasks, plus custom orchestration for the workflows that set your organization apart. Dogtown Media’s AI-powered healthcare app development team builds that orchestration and integration layer.

Whichever path you choose, put every vendor through the same questions:

• How does the agent connect to each of our top payers, and what happens when a portal changes?
• How are agent identities and credentials provisioned, and can we revoke them ourselves?
• Which subcontractors, including model and cloud providers, touch our PHI, and does the BAA name them?
• Can we see every action log, and how long are logs retained?
• What share of tasks completes without escalation at customers like us, and what’s the error rate?
• How are model and workflow updates tested before they reach our environment?
• Who configures our workflows and payer rules, and how quickly can changes ship?
• How is pricing structured: per action, per transaction, or per workflow?

An RCM Agent Readiness Checklist

Before an agent touches production data, confirm each of these is in place.

• Baseline measured. Denial rate, clean claim rate, days in accounts receivable, cost per transaction, and staff hours are recorded by payer and claim type.
• BAA signed. The agreement covers the agent vendor and its model and cloud subcontractors, with breach reporting and terms on training with your PHI.
• Identities issued. Each agent has its own accounts, with credentials in a vault and a plan for multifactor prompts.
• Access scoped. Permissions follow minimum necessary for each workflow.
• Logging live. Every read, write, and submission is logged with the agent’s identity, the record, and a timestamp.
• Autonomy tiers set. Each action is classified, with approval gates on high-dollar and clinical work.
• Channels mapped. Each payer is matched to its best channel (standard transaction, API, portal, or phone), with a plan to move to APIs.
• Safeguards tested. Patient matching, duplicate prevention, and the pause control all work in shadow mode.
• Escalations owned. Someone owns the exception queue, with service levels for working it.
• Staff briefed. The revenue cycle team knows what the agent does and how to override it.

Why Partner With Dogtown Media

Dogtown Media builds AI-powered healthcare applications and health system and hospital apps that connect to the EHR, billing, and payer systems organizations already run. Our AI compliance practice designs the identity, logging, and guardrail layers agents need, and our integration work covers the data connections underneath. Whether you’re extending an EHR, wrapping a vendor platform with custom workflows, or building revenue cycle automation into a digital health product, our development process puts HIPAA controls into the architecture from the first sprint.

If you’re planning back-office automation, request a free consultation to map your workflows to an architecture that scales.

Frequently Asked Questions

Do staff who oversee AI agents need additional HIPAA training?

Yes. In most cases, that means updating existing training. HIPAA already requires security awareness training for the workforce, and staff who configure, monitor, or review agents should understand what PHI each agent can access, how its audit logs work, and how to recognize and report a problem, such as an agent opening the wrong patient’s record. Treat each agent as a new category of user that works under your organization’s policies.

Can AI agents handle prior authorizations that require peer-to-peer review?

Not on their own. When a payer requests a peer-to-peer review, a physician has to discuss the case with the payer’s medical reviewer. An agent can prepare for that call by summarizing the clinical rationale, pulling relevant chart notes, and scheduling the conversation, then track the outcome and update the request.

What happens when a payer changes its portal and breaks an agent?

A well-built agent fails safely: it stops the task, logs the error, and routes the work to a person. Someone then updates and retests the automation before it resumes. This maintenance burden is the main reason to prefer standard transactions and APIs wherever they exist. Relief is coming for prior authorization, since CMS requires impacted payers to offer FHIR-based Prior Authorization APIs by January 1, 2027, and commercial plans in the industry pledge are targeting standardized electronic submission the same year.

How do you prevent an AI agent from submitting duplicate claims?

Check before every submission. The agent queries the billing system for an existing claim with the same patient, date of service, procedure codes, and provider, and submits only when there’s no match. Assign each submission a unique transaction key so a retried step can’t send the same claim twice, and log every submission so billing staff can audit for duplicates if a payer flags one. Duplicate detection is deterministic logic and doesn’t need machine learning.

Are there regulatory limits on how much of the revenue cycle can be automated?

No federal rule caps revenue cycle automation, but responsibility stays with the organization. Providers remain accountable for every claim they submit, so automated coding needs audits and human review. On the payer side, CMS has required impacted payers to decide standard prior authorization requests within seven calendar days and expedited requests within 72 hours since January 1, 2026, which rewards agents that submit complete requests quickly. The real regulatory risk lies in governance gaps: agents running without BAAs, unique identities, audit logs, and human oversight.