# Prior Authorization Agent

> An administrative prior-auth agent: checks requests against payer rules, flags missing docs, and assembles a review-ready packet. No clinical or coverage decisions.

- **Category:** Healthcare Workflows
- **Difficulty:** Advanced
- **Setup time:** 50 min
- **Stacks:** Claude, LangGraph, OpenAI
- **Version:** 2.0.0 (updated 2026-06-21)
- **Source:** https://agent-kits.com/kit/prior-auth-packet-assembler

## Overview

Checks a prior-auth request against the payer's documented checklist, identifies missing documentation precisely, and assembles a review-ready packet.

Administrative only: it verifies completeness against payer rules — it does not approve, deny, or determine medical necessity.

Minimum-necessary PHI: pulls only the data the payer requires and keeps it within scope.

Escalates clinical judgment to humans: borderline medical-necessity calls go to a clinician, never to the agent.

## When to use it

- Your staff spend hours assembling prior-auth packets and chasing missing documents before submission.
- You have payer rules/checklists and access (with appropriate controls) to the request and supporting documentation.
- You want consistent, complete submissions that reduce avoidable denials for missing information.
- You want automation for the administrative completeness work while clinicians retain all clinical decisions.

## When not to use it

- You expect it to decide medical necessity, approve, or deny — those are clinical/payer decisions it must never make.
- You can't provide payer rules or appropriate, controlled access to the necessary documentation.
- The case requires clinical judgment that should go straight to a clinician.
- You can't support HIPAA-appropriate handling of PHI in your environment.

## Architecture

- **Request intake** — Receives the prior-auth request with the patient reference, payer, ordering provider, and the requested service/procedure codes, normalized into a structured task.
- **Payer-rule lookup** — Retrieves the payer's documented prior-auth requirement set for that service/code — the administrative checklist the packet must satisfy.
- **Document inventory** — Catalogs the documents and data present in the request (clinical notes, imaging, labs, orders) using minimum-necessary access, without interpreting their clinical content.
- **Completeness engine** — Compares present items against the payer checklist and produces a precise present/missing breakdown — a purely administrative comparison, no clinical inference.
- **Clinical-judgment gate** — A deterministic guard routes anything requiring medical-necessity interpretation or clinical judgment to a clinician; the agent never makes those calls.
- **Packet assembly** — When administratively complete, assembles the documentation into the payer's expected structure, ready for human submission.
- **PHI & audit controls** — Enforces minimum-necessary access, logs what was used, and keeps PHI within scope for HIPAA-aligned auditability.

## Files in this bundle

- `system-prompt.md` — the agent's system prompt
- `tools.json` — tool/function definitions the agent expects
- `workflow.md` — step-by-step run loop
- `.env.example` — environment variables to fill in
- `kit.json` — full structured metadata
- `starters/` — minimal starter snippets
- `LICENSE` — Apache-2.0 (code, configuration, and schema)
- `LICENSE-CONTENT` — CC BY 4.0 (specification text and documentation)
- `NOTICE` — attribution and trademark notice
- `run.py` — **runnable demo**: real agent loop with mock tools (`pip install anthropic`, set `ANTHROPIC_API_KEY`, `python run.py`)
- `agentaz.json` / `agentaz.schema.json` — AgentAz™ governance spec + schema

## Implementation notes

- Lock 'administrative only' in configuration and reinforce it in the prompt: the agent must never approve, deny, or determine medical necessity. Those boundaries should be enforced, not trusted to the model.
- Make the clinical-judgment gate aggressive — if it's unclear whether something is clinical, treat it as clinical and escalate. Over-escalating is safe; a wrong clinical call is not.
- Enforce minimum-necessary PHI access and log exactly what was used; this is both a HIPAA requirement and an auditability win.
- Drive completeness from per-payer, per-code documentation checklists. Keeping these current is what reduces denials-for-missing-information.
- Never fabricate a document or value; a missing item is MISSING, and an ambiguous value is flagged for human confirmation.
- Keep submission human-approved; the agent assembles and staff submit, so a person always stands between the agent and the payer.
- Spend the strong model on ambiguous-completeness reasoning and escalation framing — a cheaper model can inventory documents and match the checklist.

## Variations

- **Basic — Completeness checker:** Checks a request against the payer's documentation checklist and returns a precise present/missing breakdown for staff. No assembly, no submission, administrative only.
- **Advanced — Packet assembler:** Adds review-ready packet assembly for complete requests, a clinical-judgment escalation gate, and minimum-necessary PHI handling — staff still approve and submit.
- **Enterprise — Governed prior-auth operation:** Adds multi-payer rule libraries, EHR integration under least access, full HIPAA audit trails, denials-for-missing-info analytics, and checklist tuning from outcomes — humans retain all clinical and submission decisions.

## FAQ

**Does it decide whether to approve prior authorizations?**

No. It never approves, denies, or determines medical necessity. It performs an administrative completeness check against the payer's documentation checklist and assembles a packet for a human to review and submit.

**How does it stay within administrative scope?**

It's locked to administrative-only by configuration, and anything requiring clinical judgment or medical-necessity interpretation is escalated to a clinician. If it's unclear whether something is clinical, it treats it as clinical and escalates.

**How is PHI protected?**

It uses minimum-necessary access — pulling only the data a specific requirement needs — keeps PHI within the packet and workflow, logs what was used, and is intended to run inside your HIPAA-aligned environment.

**What does it do when a document is missing?**

It returns a precise list of exactly what's missing and the likely source, then holds — instead of submitting an incomplete packet (a common denial cause) or fabricating the document.

**Will it submit to the payer automatically?**

Submission is human-approved by default. The agent assembles the review-ready packet; your staff review and submit, so a person always stands between the agent and the payer.

**How does it reduce denials?**

Most avoidable prior-auth denials are for missing or incomplete documentation. By checking every request against the payer's exact checklist and flagging gaps before submission, it helps ensure complete packets the first time.


---

© 2026 AgentKits · www.agent-kits.com

**Open source.** Code, configuration, and the AgentAz™ schema are licensed under
**Apache-2.0**; specification text and documentation under **CC BY 4.0** (with
attribution to AgentKits, link to https://www.agent-kits.com). See LICENSE, LICENSE-CONTENT,
and NOTICE in this bundle. "AgentAz" and "AgentKits" are trademarks of AgentKits.

**Flagship reference blueprint.** View the source, AgentAz™ spec, and frozen v1.0 schema
in the public registry: https://github.com/agent-kits/agentaz
Original: https://agent-kits.com/kit/prior-auth-packet-assembler
