AI cost per prior authorization request at a health plan: what drives it and how to measure it

Define the unit before you price it

Most disagreement between vendor quotes and internal estimates starts with the denominator. CMS describes a prior authorization in two parts: the prior authorization request, which is the provider's workflow and associated information and documentation, and the prior authorization decision, which is the payer's processes and associated information and documentation. That vocabulary is a practical basis for a cost unit.

A workable definition is one prior authorization request, meaning one provider submission, taken through to a decision. Then state how the edge cases are counted. A resubmission after incomplete documentation, an appeal, and a case that moves into extended review can each be treated as part of the original request or as a new unit. Either choice is defensible. Mixing them across estimates is not.

CMS metrics already treat approvals, denials, approvals after appeal and approvals after an extended review timeframe as distinct outcome paths. Cost reporting should follow the same split. A straight-through average presented as the total cost hides the requests that consume the most reviewer time.

Cost components and how they behave

Each component below should appear as its own line in an estimate. The variable or fixed classification is analytical guidance for modeling, not a published standard, and the right split depends on how a plan or vendor structures pricing.

• Document ingestion and processing: Mostly variable. Scales with page count, scan quality and whether intake is structured or document-based.
• Retrieval: Variable per request, with a fixed base for index and storage infrastructure.
• Model inference: Variable. Scales with token volume, model selection and retries.
• Human review and exception handling: Variable, driven by escalation rate, reviewer time and appeal or extended-review share.
• Runtime policy enforcement: Mostly fixed platform cost, plus a variable component where each interaction is evaluated.
• Evidence retention: Fixed storage and control infrastructure, with a variable component that grows with record volume and retention period.

What drives the variable cost

Token volume is set largely by the clinical documents attached to a request. A short structured submission and a long set of scanned records produce very different input sizes, so intake format is worth recording as a separate dimension. CMS describes direct submission from an EHR or practice management system through the Prior Authorization Support Implementation Guide, and a structured path like that changes what the AI has to read.

Retrieval adds steps before and between model calls, for example looking up coverage criteria or pulling relevant record sections. Model selection matters because a plan may route routine cases to a smaller model and complex ones to a larger one. Retries add cost whenever an output fails validation or a policy check and the step runs again.

The largest swing is usually human review. Count it consistently: reviewer minutes per request, the share of requests escalated, and the time to re-review after a retry. Record who performs the review and at what assumed labor rate. These drivers must be measured from the plan's own telemetry or from vendor data supplied for the plan's request mix. General averages are not a substitute.

Regulatory constraints that shape the workflow

Two timeline layers apply. Since January 1, 2026, impacted payers must send decisions for medical items and services within 72 hours for expedited requests and 7 calendar days for standard requests, with an extension of up to 14 days in certain circumstances. Prior Authorization API compliance dates follow in 2027: by January 1, 2027 for Medicare Advantage organizations and state Medicaid and CHIP fee-for-service programs, for rating periods beginning on or after that date for Medicaid and CHIP managed care, and for plan years beginning on or after that date for QHP issuers on the federally-facilitated exchanges.

These clocks bound how long a request can wait in a review or exception queue, so escalation design affects both cost and compliance. Record when human escalation occurs relative to the clock.

As of October 2026, a CMS proposed rule would extend electronic prior authorization to drugs covered under a medical benefit, with a proposed compliance date of October 1, 2027, and would require a specific reason for denying drug requests. It is proposed only. Design should not depend on it, but request-level records that can be reconstructed will make adoption easier if it is finalized.

For any system that handles PHI, HIPAA audit controls at 45 CFR 164.312(b) belong in the scoping discussion. The cost question is what evidence each request produces, where it is stored and for how long. Plans should also document what the AI is permitted to do, whether assisting reviewers, recommending or deciding, because that scope determines how much human review and evidence the workflow needs. Some plans publicly state limits on AI use in these decisions.

Runtime enforcement and evidence as a cost line

In a regulated enterprise, policy enforcement and audit evidence are not overhead to be added at the end. If an AI step can read PHI, call a tool or hand a case to a reviewer, something must decide in the execution path whether that action is allowed, redacted, blocked or escalated for human approval, and something must record what happened. Both have a cost, and both belong in the per-request figure.

Trussed enforces policy in the execution path across models, agents, tools and MCP servers, with actions that include allow, redact, block, rate limit and escalate for human approval. Enforcement generates audit-ready evidence mapped to HIPAA, among other frameworks. It can be deployed self-managed in the customer's cloud, with configurable retention and data residency, so retention is a sizing decision a plan makes explicitly. Trussed runs in production with healthcare and pharma organizations.

Scope matters for cost modeling. Enforcement and evidence apply to individual interactions and tool calls. One prior authorization request may involve many of them, so a plan should define how interaction-level evidence is grouped under the request unit it has chosen.