Availity Intelligent Utilization Management

The recommendation itself comes from codified rules, and the learned part sits in reading the clinical record. AuthAI applies each health plan's medical policy, written in Clinical Quality Language, to the patient's data, and Availity stresses that the engine uses no regression models, no historical determinations and no generative AI. What it calls analytical AI covers structured and unstructured data: its chief technology officer describes the AI as extracting the relevant facts from clinical records into a standard representation that the policy logic then matches.

Without that extraction step the product would still route, submit and answer authorizations through the FHIR APIs and the portal, so the AI is a feature on a workflow and connectivity product rather than the product itself. Availity's own responsible AI principles say it prefers rules based approaches over statistical methods wherever it can, to keep results explainable.

AuthAI recommends and the health plan decides. Availity states that the engine does not approve, deny or auto deny any request, that every recommendation traces to the policy logic it applied, and that any recommendation can be overridden. Routine cases receive a recommendation in near real time, while cases that need clinical judgment are pended for the plan's utilization management clinicians with the supporting evidence organized for them.

The rule between the two paths is the missing piece. No threshold explains when a case pends rather than receiving a recommendation. Availity's wording also pulls two ways: it calls AuthAI a recommendation engine, not a decisioning engine, yet also says it uses clinical data and plan policy to make real time determinations, and the chief executive has described 80 percent of responses as touchless, returned without manual processing by plan or provider staff. That presumably rests on how each plan configures acceptance of a recommendation, and the configuration and its limits are not described.

Plan medical policy is codified in Clinical Quality Language, the HL7 standard that both people and machines can read, and applied to the patient's data so each recommendation shows which criteria it met. Availity calls the approach analytical AI, says it handles structured and unstructured records, and rules out generative AI and regression models for the decision itself.

Several technical points stay unstated: which models extract facts from unstructured notes, how policy logic is versioned when a plan changes its criteria, and how the feedback loop that updates logic from outcomes is controlled and reviewed. An announced partnership with Abridge adds conversational capture at the point of care, and its model's role inside the product has not yet been described.

The decision logic is Availity's own codified policy engine, and the rest of the chain goes unnamed. AuthAI was developed with Blue Cross and Blue Shield of Minnesota, Itiliti Health and a Midwest provider, and no outside model provider is named for extracting facts from clinical records or for any other step.

The privacy policy names identity verification vendors for portal registration, LexisNexis, Clear and Thales among them, but no hosting provider, cloud region or subprocessor list for clinical data. The announced partnership with Abridge brings Abridge's Contextual Reasoning Engine into the authorization workflow, adding a party whose data terms inside Availity's product are not described.

Headline results come without a method, a denominator or a period. Availity reports that 75 percent of requests receive a near real time approval recommendation, 99 percent arrive with clinical data or answered questions, every provider is told when an authorization was not needed, and appeals and grievances fell 95 percent, beside an unnamed health plan executive saying 98 percent of requests now arrive electronically. Average time to a recommendation is under 90 seconds. In an interview with Healthcare IT Today, chief executive Russ Thomas put touchless responses at 80 percent.

Named work sits behind the product without outcome figures attached. A case study with Humana and athenahealth walks through an end to end FHIR prior authorization build across a payer, an EHR vendor and Availity, and Blue Cross and Blue Shield of Minnesota helped develop the engine in a project KLAS profiled in its Points of Light 2023 report.

Clinical data flows into AuthAI to be matched against policy, and how long it stays and what it is used for afterward is left to the contract. The clearest statement concerns training: Availity says the engine uses no historical data, regression models or other black box methods. Its own workflow description, though, includes a feedback loop that captures outcomes and updates the policy logic over time, without saying whether case data is pooled across plans to do it.

The responsible AI principles, last updated in December 2023, promise privacy safeguards and transparency over data use in general terms. No retention period or de identification practice is stated for the product, and nothing describes safety engineering, such as how a wrong recommendation is caught and handled as an event.

HIPAA compliance is asserted, and no business associate position or agreement is set out for the product. Availity's compliance program lists a HIPAA Privacy Program and says the company follows CMS, EHNAC and HITRUST requirements for privacy and security. Its responsible AI principles commit to the HIPAA Security and Privacy Rules and to honoring data use agreements.

The privacy policy reaches the portal and service tools, but it covers user and business registration data and defers to the underlying customer agreements for the services themselves. Nothing explains whether Availity acts as the health plan's business associate or as a clearinghouse when it handles clinical records for utilization review, which subcontractors those obligations bind, or at what contract level they apply.

HITRUST certification is named without its type, scope or date, and no trust center or report request route goes with it. Availity lists itself as HITRUST certified and as a CAQH CORE Phase III certified clearinghouse, the second being an operating rules certification for transactions rather than a security audit.

Availity describes annual and rolling privacy and security risk assessments, says it follows CMS, EHNAC and HITRUST requirements, and runs a vulnerability disclosure program for outside researchers. For a network carrying more than 13 billion transactions a year, the version and currency of the HITRUST assessment, and whether AuthAI falls inside its scope, remain open.

Coverage decisions are the product's territory, and it is sold as administrative software with no device claim. The regime it is built for is the CMS interoperability and prior authorization rule, CMS-0057-F, which requires affected payers to run coverage discovery, documentation and submission APIs by January 2027. Availity says the solution meets those requirements and is already live at major health plans.

AuthAI does assess medical necessity against a plan's criteria, and Availity frames its governance around CMS guidance that coverage decisions must weigh the individual patient's circumstances. Those are payer rules rather than device regulation, and the recommend only design keeps the determination with the plan's own reviewers.

Bias controls are described as policy, with no evaluation results behind them. Availity's responsible AI principles commit to representative data, to avoiding unfair bias including impacts on protected characteristics, to monitoring outputs and to recording model provenance and evaluation metrics. The product FAQ adds that governance follows CMS guidance on individual circumstances in coverage decisions and includes controls for nondiscrimination.

No recommendation rates, override rates or results broken out by member group, line of business or service type are offered. That gap matters in utilization management, where uneven documentation across provider types or member populations could change how often routine requests reach an automatic recommendation rather than a pended review.

Recommendations can be traced and overridden, and no public commitment stands behind them. Each AuthAI recommendation is tied to the policy criteria it applied, pended cases carry the evidence for the plan's clinician, and Availity pitches consistent, traceable recommendations as a way to reduce grievances and overturned appeals.

A member or provider affected by a wrong recommendation challenges the health plan's determination through the plan's own appeal process, not through Availity. No error rate, warranty on recommendation accuracy, indemnity or remediation commitment is stated for AuthAI, and the terms governing the service sit in customer agreements that are not open to read.

Integration runs on the Da Vinci FHIR guides that the federal rule names, with named partners behind them. Coverage Requirements Discovery tells the provider's EHR whether authorization is needed, Documentation Templates and Rules gathers the required data from the record, and Prior Authorization Support submits the request and returns the answer to the EHR or the Availity portal. On the plan side the product connects to existing utilization management systems and to delegated vendors.

A case study with Humana and athenahealth describes building that end to end flow across a payer, an EHR vendor and Availity. Beyond athenahealth, the product page claims compatibility with any EHR, and no list of live EHR connections or production volumes accompanies that claim.

A hosted service on the Availity network is the only model on offer, with no stated data location, hosting provider or tenancy model. Health plans connect through APIs configured to fit an insourced, delegated or hybrid review operation, and providers reach the service through their EHR or the portal.

The privacy policy says Availity staff outside the United States and third party vendors may handle registration and identity verification for portal users, and the company runs an operation in India. Where clinical data for utilization review is processed and stored, and whether any of it crosses a border, goes unstated for the product, which leaves residency questions to the contract.

No price, tier or unit of charge is offered for Intelligent Utilization Management, and buying starts with a request for information. The selling model is still readable before contact. The product is sold to health plans as modular, API driven pieces (the federal prior authorization APIs, AuthAI decision support, exception handling for clinical reviewers) that sit beside an existing utilization management system rather than replacing it, and it is configured at implementation for insourced, delegated or hybrid review.

Providers reach it through their own EHR or through the Availity portal that plans already offer for eligibility and claims, so the plan is the paying customer. Whether AuthAI is priced per request, per member or as a platform fee is left to the contract, and no implementation fee or term length is stated.

Health plan prior authorization and utilization management is the setting, with named plans behind part of it. Availity says the solution is in use at many major health plans, routes cases to or from delegated review vendors, and reaches providers through any EHR or the multi payer portal. Its FHIR APIs answer the federal rule that applies to Medicare Advantage, Medicaid and federal marketplace plans from January 2027.

Service lines are narrower than the pitch. Speaking to Healthcare IT Today, Russ Thomas said the engine started with common, usually simple requests: imaging, oncology, sleep, behavior modification and genetic testing. Humana and Blue Cross and Blue Shield of Minnesota are named in the development and interoperability projects, and no list of covered procedure categories or plan types is given.