Humata Health

Two assets carry the product, and only one of them is a model. Deciding whether an order needs authorization, then finding and assembling the clinical evidence a specific payer's policy requires, is a reasoning task over an unstructured chart.

The other asset is connectivity: Humata describes the hardest problem as linking systems at every payer to systems at every hospital, and its platform includes digitized payer policies, status checks, monitoring after authorization and a payer side review tool built on the same policy engine. A competitor with an equal model and no connections could not deliver the same outcome, so the model is the engine of a core module rather than the whole of what is sold.

A correctness promise sits beside touchless automation, and the promise is the bigger problem. Humata's payer page says its AI-driven engine aligns documentation with each payer's policies and clinical guidelines, 'ensuring that every submission meets unique regulatory and contractual requirements'. Staff who believe every submission is compliant will not audit the ones that are not.

The automation behind it is real: at Allegheny Health Network prior authorization runs from order to approval without human intervention, the company's stated vision is 90 percent touchless authorizations with two-minute human reviews, and on the payer side routine cases are handled automatically with only outliers flagged for clinical review.

The company does not publish the share of requests that complete touchless across customers, the confidence at which a case goes to a person, or what happens when the assembled documentation falls short.

The workflow and its building blocks are described, and the models are not. Humata says it digitizes medical and pharmacy policies into code and uses AI to interpret and apply them. Named components cover authorization requirements (PolicyLink), policy matching (PolicyMatch), clinical bundling and smart attestation answering. Others run automated status checks, monitoring after authorization and CPT mismatch detection, and payer reviewers get AI generated clinical summaries.

Integration uses proprietary APIs and HL7 and FHIR. No model, provider, version or accuracy figure for the evidence it assembles is published, and the claim to the industry's largest integration ecosystem carries no count. The core act is a judgment about which parts of a chart meet a payer's criteria, and nothing shows how often that judgment is right beyond an 'up to 96 percent' first-pass approval rate.

Partners in the chain are outlined, and no model provider or subprocessor list is published. Humata's privacy policy says third-party partners provide cloud hosting and support tools under contract, and its announcements describe an integration with EviCore by Evernorth's intelliPath for payer reach and distribution within Microsoft Dragon Copilot. It names no model provider or hosting company and publishes no subprocessor list or retention terms for them. Clinical documentation moves from providers through Humata to payers, and R1's pending acquisition will add another party.

Named customers and headline percentages, with no method behind them. Humata cites a first-pass approval rate of up to 96 percent, 30 percent fewer write-offs, 83 percent fewer rescheduled appointments, 45 percent fewer authorization touches and an 80 percent improvement in clinical bundling efficiency, none with a customer, period or denominator.

Named customers include Allegheny Health Network, reported as the first US health system to run medical prior authorization touchless from order to approval; Texas Health Resources, whose case study reports full authorization coverage across high-volume service lines with Epic and an end to routine overtime; and UHealth. External signals include selection as a technology partner in CMS's WISeR model and R1's August 2026 agreement to acquire the company. No study compares approval rates or turnaround with the manual process.

General assurances are published, and the questions an authorization product raises are not answered. Humata's privacy policy says it processes and stores protected health information on behalf of provider and payer customers under business associate agreements, does not sell personal information, and conducts de-identified analytics to enhance its offerings.

No retention period is published for the charts and packets it handles, nothing says whether customer data trains its models, and the de-identification method is not described. The product's function is to move clinical documentation from a provider to a payer, and a system optimized for approval has reason to send more of the chart than the criteria need. Safety engineering, meaning guardrails, hallucination mitigation and how a safety event is handled, is not described.

Business associate status is stated in a privacy document that reaches the service, and the agreement is not published. Humata's privacy policy, which applies to its customers and affiliated platforms and services, says it acts as a business associate processing protected health information on behalf of covered entities and enters business associate agreements defining its responsibilities; its security page says it is a HIPAA-compliant organization.

The agreement text and subcontractor terms are not published. The relationships are layered: Humata serves providers, serves payers with a clinical review product, works within CMS's WISeR model, and is being acquired by R1.

Named attestations with type and version, and reports on request. Humata's security page says its services, products and infrastructure are HITRUST CSF v11.5.1 r2 certified, that it undergoes annual SOC 2 Type II audits with the report and attestation available on request, and that its controls are assessed through internal reviews and third-party audits. No trust portal or publicly retrievable report is offered, and the certification date and scope are not stated.

No device pathway applies and none is claimed; assembling and submitting an authorization request is administrative. The rules that matter are coverage rules, and Humata now works on both sides of them. On the provider side, federal interoperability and prior authorization requirements (CMS-0057) push payers toward electronic submission and faster decisions.

On the payer side, Humata sells AI-generated clinical summaries and automated handling of routine cases to health plans, and is a technology partner in CMS's WISeR model, which applies AI-assisted clinical review to selected Medicare services; CMS has said Medicare Advantage coverage decisions must rest on the individual patient's circumstances, and several states restrict AI-driven denials. A company building both the request and the review is an interested party in how that line is drawn.

Bias is addressed in policy language, and no evaluation is published. Humata's payer page says its structured, auditable processes reduce bias and decision variability, that automation handles routine cases and escalates outliers for clinical attention, and that the platform supports CMS-0057 compliance. It sells approval acceleration to providers and automated clinical review to payers, and works in CMS's WISeR model, so the same policy engine serves both the request and the decision.

Nothing published describes how the model is evaluated, monitored or separated between those uses, what share of payer-side cases are decided without a clinician, or how outcomes differ by patient group, service line or plan.

Mechanisms let staff trace and catch errors, and nothing stands behind a wrong submission. Humata describes an analytics and audit trail, monitoring after authorization, detection of CPT mismatches between the authorization and the service, and, on the payer side, escalation of outlier cases to clinical reviewers. No warranty, remedy, service credit or error rate with a method is published; the 96 percent first-pass figure is an 'up to' with no denominator.

The costly errors run in two directions: a packet that omits what the payer needed produces a denial that looks like a clinical disagreement, and one that asserts criteria are met on thin evidence invites a later audit. The patient waiting on the authorization rarely learns which it was.

Interoperability is the product, and one record system is named in a customer story. The workflow starts with an order in the record system and ends with a payer decision returning, and Humata says it connects through proprietary APIs and HL7 and FHIR to record and utilization management systems.

Its Texas Health Resources case study describes full authorization coverage across high-volume service lines working with Epic, its technology is available within Microsoft Dragon Copilot, and its EviCore intelliPath integration extends payer reach. No marketplace listing, certification or count of payer connections is published.

Nothing is published about where the platform runs or where clinical documentation rests. Humata's privacy policy says it shares information with third-party partners that provide cloud hosting and support tools under contract, and its security page describes HITRUST and SOC 2 controls, but no hosting provider, region, residency commitment or tenancy model is named.

The product moves charts from providers to payers and sits inside a federal Medicare model, so where packets rest between those parties, and for how long, is the central question; R1's acquisition may also change the hosting estate.

No price, mechanism or unit of sale appears anywhere on the site.

The missing unit matters because the company now sells to two very different buyers. A large health system replacing an authorization department has a different economics from an independent practice where one person handles prior authorization between other duties, and the new provider portal is aimed squarely at the latter. Per request, per provider and per site would each land very differently across that range.

Broad within one process, sold to both sides of it. Humata covers services and procedures and specialty drugs and infusions, for health systems, provider groups, pharmacies and, through its provider portal launched in June 2026, independent practices, regional centers and specialty clinics. It also sells clinical review automation to health plans across Medicare Advantage, Medicaid and commercial lines, and runs a WISeR portal for Oklahoma providers in CMS's model.

Named validation comes from Allegheny Health Network, Texas Health Resources and UHealth. United States only. The requesting side of prior authorization is the center of the product: determining whether authorization is needed, bundling the clinical evidence, answering attestation questions, submitting and checking status. The payer side clinical review sits alongside it.