Epic’s prior authorization rollout exposes the gap between standards and day-to-day care
The new prior authorization APIs are moving from policy language into clinical operations, and the transition is already revealing where digital standards hold up — and where they still crack under real-world use. Epic says many large national payers are either ready or already testing, while smaller regional plans are still working through digitizing policies that once sat in binders on a website. The Jan. 1 deadline for CMS-regulated payers now turns that uneven progress into an operational test for Medicare Advantage, Medicaid and marketplace insurers.
The shift is aimed at one of healthcare’s most stubborn bottlenecks: a manual, paper-heavy process that often delays care and consumes staff time before a patient ever reaches an exam room. Under the federal interoperability rule finalized in 2024, payers must implement three prior authorization application programming interfaces that let systems communicate directly. Those APIs are designed to answer a basic but consequential question: whether a service needs prior authorization, what documentation is required, and how the request and response can move electronically instead of through faxes, portals and phone calls.
Ryan Bohochik, Epic’s vice president of value-based care, framed the effort as a practical modernization of a process that has long depended on outdated workflows. The goal is not abstract efficiency. It is to remove friction from scheduling, documentation and approval so patients do not lose time while staff chase information across disconnected systems.
A spectrum of readiness among payers
Epic’s view of industry readiness is uneven by design. Large national payers are farther along, and some are already live with health systems or in testing with Epic and other EHR vendors. UnitedHealthcare is live with health systems, while smaller health plans using Epic technology, including Network Health in Wisconsin, are supporting all three APIs. Smaller regional plans, by contrast, are still in the implementation stage, in part because they must convert policy logic that was never built for machine-to-machine exchange.
That gap matters because prior authorization is only as fast as the slowest participant in the chain. Even when the EHR can generate a digital request, the payer still has to translate longstanding policies into a format the system can read, interpret and return. For many plans, the work is not just technical but administrative: digitizing coverage rules, clarifying requirements and aligning internal teams around a new workflow.
Epic tried to reduce some of the pressure by building the API-based prior authorization process into its software in a February release, giving users runway before the compliance date arrived. That timing reflects a broader lesson from health IT rollouts: implementation is rarely the same thing as activation, and systems often need months of live testing before they settle into routine use.
Point-of-care logic runs into scheduling reality
One of the three APIs, Coverage Requirements Discovery, captures the tension between a clean design and a messy clinic day. In theory, the system can ask an insurer at the point of care whether a service requires prior authorization. A physician orders an X-ray, the software checks coverage, and the answer appears immediately.
In practice, the information needed to make that decision may not be fully available during the visit. Some insurers require details that emerge later in the workflow, such as information surfaced during scheduling or follow-up documentation. That means the first check may need to be repeated once the rest of the context is known.
No physician should have to become the intake clerk for an insurance plan. Even so, the payer still needs the relevant data to make a coverage decision, and the system has to reconcile those competing demands without shifting more work onto the clinical team. The practical problem is not the existence of an API. It is how much reliable information can be assembled at the right moment without forcing physicians and front-desk staff to duplicate labor.
Early gains are showing up in scheduling and staff workload
Among early adopters, Epic has seen fewer canceled appointments because patients are not arriving only to discover that approval never came through. That is a deceptively simple change, but it can alter the entire flow of outpatient care. A missed approval often means a missed slot, a rescheduled visit and another round of administrative back-and-forth that affects both patient access and clinic throughput.
The early operational signal is also showing up in staff workload. Epic has seen fewer touches needed to move an authorization request through the system, which points to lower administrative overhead for the teams who support physicians. In a process built on repeated follow-up, even a small reduction in manual steps can free up time for other tasks and reduce the chance of delay caused by missing paperwork or inconsistent transmission.
AI is moving from theory into prior authorization workflows
Artificial intelligence now sits inside the same conversation because prior authorization generates exactly the sort of repetitive, document-heavy work that AI can compress. Bohochik said Epic’s standards were designed in 2018, before commercial-grade AI chatbots changed expectations about what software could do. If the system were being built now, some pieces would likely look different.
One example already in motion comes from a state Blue Cross Blue Shield organization using AI to summarize authorizations. The claimed payoff was 15 minutes less per case. In a process where staff may handle a large volume of repetitive reviews, that kind of time reduction can move requests through more quickly and shorten the lag between submission and response. For patients and physicians, the effect is less about novelty than about getting a decision back sooner.
The AI discussion is not entirely celebratory. Some stakeholders remain wary of using AI in a process that already draws criticism for limiting access to care. There is concern that automation could be used in ways that make authorization harder, not easier, especially if oversight is weak or incentives point toward denial rather than acceleration. Even so, Bohochik argued that thoughtful use of AI can improve outcomes by reducing the effort required to summarize, route and process requests.
The policy deadline is approaching, but the harder work is happening in the live environment, where payer rules, EHR infrastructure and clinical workflows have to meet without creating new delays. The APIs are designed to replace a fragmented system. Whether they do so cleanly will depend on how well payers finish digitizing policy logic and how consistently providers and health systems can use the new tools once the deadline lands.