LLM prior-auth review,
cut from days to minutes.
How we built LLM prior authorization automation for a Series B HealthTech in 14 weeks: 87% of cases now route without manual review, and clinicians keep the final say on the rest.
- Industry
- HealthTech, US-regulated
- Service
- LLM application development
- Engagement
- Production build, 14 weeks
- Team
- 3 engineers, 1 tech lead
- Stack
- Python · FastAPI · Anthropic · pgvector · AWS
The challenge: a manual prior-auth backlog.
Prior authorization is one of the slowest, most manual workflows in US healthcare. Our client, a Series B platform serving specialty clinics, had a queue of mixed-format insurance documents that clinical operations staff read by hand. The backlog kept growing, and hiring more reviewers wasn't going to fix it.
We see the same pattern across our healthcare AI solutions work: high volume, strict rules, expensive human attention.
We started with one hypothesis: most cases follow predictable patterns and can be auto-routed, and the rest need human judgment. Our job was to find that boundary, measure it and automate everything on the safe side of it.
The approach: LLM evals before models.
We opened with a discovery sprint: we read 200 anonymized cases and wrote the eval criteria by hand before any code existed. Those criteria became the test set. Next came a thin prototype (a small classifier plus an LLM extractor) run against the client's real document corpus.
No model selection until we had an evaluation harness. No scaling until the eval passed, reproducibly.
From there our LLM application development team built the production pipeline: structured output, confidence-banded routing, and a human-in-the-loop interface for cases the model isn't sure about. Every decision is logged for audit and retraining.
The system: a HIPAA-compliant LLM pipeline.
Documents arrive from clinics through three channels: fax, secure email and portal upload. Each one is parsed into a canonical format, classified, then either auto-routed or sent to a clinical reviewer with the model's reasoning attached. Reviewers can correct the model, and every correction feeds a continuous-evaluation loop we re-run weekly.
Compliance is part of the architecture, not a layer on top:
- End-to-end encryption and role-based access control
- BAA-eligible infrastructure in a HIPAA-compliant AWS account
- A complete audit log, indexed by case ID
- Isolated test and production environments, defined in reviewable infrastructure-as-code
LLM prior-auth automation results at GA.
We measured against the eval set agreed in discovery. Routine cases now clear in minutes instead of days, and reviewers spend their time on the cases that need clinical judgment.
What we'd do again.
Building the eval harness in week one paid for itself five times over. Every time we tried a new model or prompt strategy, we knew within 10 minutes whether it was better. There was no debate. There was a number. It's now standard in our LLM evaluation and QA practice.
We also kept the human-in-the-loop interface deliberately generous. Reviewers see the full document, the model's reasoning and prior decisions on similar cases, and can override anything in two clicks.
What's next.
The system is in steady-state operation. We co-own it with the client's internal team, and one of our engineers still spends a day a week on tuning, eval review and incident response. The eval set now holds over 1,400 cases and is growing.
14 weeks, four phases.
From first call to general availability. The phases were locked in week one, as in all our AI delivery playbooks: no scope creep, no surprise invoices.
Eval-first discovery
Read 200 anonymized cases and wrote the eval harness by hand. Locked the scoring rubric with clinical operations before writing any code.
Prototype & routing
A thin classifier plus an LLM extractor, tested against the real corpus. Confidence-banded routing and the first human-in-the-loop UI for gray-zone cases.
Production hardening
HIPAA-grade infrastructure, a BAA-eligible AWS account, audit logging and role-based access. Soft launch to 5% of intake.
GA & handoff
Ramp to 100% of intake, an on-call playbook and a weekly eval review with the client's clinical lead. One of our engineers stays on one day a week.
Why this LLM stack, and not the other one.
Every architecture decision had its trade-off written down at the time. These are the ones that mattered most.
Anthropic Claude over OpenAI
The HIPAA BAA was the deciding factor. Claude's reasoning on long-form clinical documents also scored higher in our internal evals at the start of the engagement.
pgvector over Pinecone
One database to back up, monitor and reason about. Pinecone's strengths weren't needed at this scale. That saved $1,400/month and one operational dependency.
FastAPI & Pydantic
Structured model output passes through Pydantic before it touches routing logic. Schema violations are logged and sent to human review automatically.
Postgres as the eval store
Every model prediction, ground-truth label and reviewer correction lives in one database. Re-running the eval is a SQL query and a notebook, not a separate ML platform.
“They built the eval harness in the first week and refused to ship anything that didn't pass it. That discipline is why the system landed at 96% accuracy on day one of GA, not month six. We've never had a vendor hold themselves to a higher bar than we did.”
More AI work in regulated workflows.
Selected engagements from the same neighborhood: different industries, the same eval-first engineering. Each card opens the industry page with the AI use cases we build there.
FinTech · Lending decisioning
Manual underwriting compressed from 4 days to 11 minutes. SOC 2 Type II in 7 months.
FinTech AI solutionsHealthTech · Clinical trial intake
Patient enrollment cut from 18 days to 4. HIPAA audit passed without findings.
Healthcare AI solutionsFinTech · Real-time fraud scoring
96 ms p99 latency, 4.2× catch rate at $0.0008 per check.
Fraud detection for FinTechHave a regulated
workflow?
We've shipped AI and software under HIPAA, SOC 2 and PCI. Tell us which workflow you want to automate.