Payer Services: Interoperability, Prior Authorization, and AI

In U.S. healthcare, payer services are the operational, technological, and compliance functions that health insurance companies and government programs use to manage coverage, process claims, run provider networks, coordinate care, and meet federal and state rules. The term covers work done inside insurers and work outsourced to specialized vendors, and it applies across Medicare, Medicaid, commercial insurance, and self-insured employer plans. If you are trying to understand how health coverage actually runs behind the scenes, payer services is the layer where billing rules, prior authorization, data sharing, and dispute processes live.

What makes this a moving topic in 2026 is the pace of regulation. Interoperability mandates, prior authorization reform, price transparency rules, new guardrails on artificial intelligence, and record-level fraud enforcement are all changing how payers operate at the same time. The sections below walk through what payer services includes, who performs it, and what rules currently shape it.

What Payer Services Includes

A healthcare payer is any entity responsible for paying healthcare providers. That includes Medicare and Medicaid, private commercial insurers, and self-insured employers that fund their own employee health plans. Payers set the billing rules, payment methodologies, performance measures, quality reporting standards, and clinical documentation requirements that providers must follow to get paid.¹

The services that carry out that role span the full lifecycle of a health insurance transaction:

Claims management and processing: receiving, reviewing, adjudicating, and paying provider claims.
Utilization management: evaluating whether services are medically necessary and cost-effective, often through prior authorization.
Provider network management: contracting with physicians, hospitals, and other providers, including credentialing and network adequacy monitoring.
Member enrollment and engagement: onboarding members, explaining benefits, and coordinating care.
Fraud, waste, and abuse prevention: detecting fraudulent claims and unnecessary spending.
Regulatory compliance: meeting requirements under the Affordable Care Act, HIPAA, and expanding interoperability and transparency mandates.
Risk adjustment and analytics: using data to predict costs, manage high-risk populations, and support value-based arrangements such as capitation and bundled payments.

Many payers do not perform all of these functions themselves. Self-insured employers in particular frequently contract with third-party administrators to manage benefits, pay claims, design networks, and handle member services.² To a covered worker, a self-insured plan run by a TPA often looks the same as traditional insurance.

The Outsourcing Market Behind The Scenes

Providing outsourced services to insurers is itself a large industry. The global healthcare payer services market was estimated at roughly $91.5 billion in 2026 and is projected to reach about $176 billion by 2033, growing at a compound annual rate near 10%.³ Business process outsourcing is the largest segment, at roughly 42%.

Payers outsource non-core operations such as claims processing, customer service, enrollment, and benefit management to vendors that run standardized platforms and automation at a scale individual insurers struggle to match with legacy systems. The vendor side is concentrated. The ten largest companies, including Optum, Cognizant, Conduent, R1 RCM, Genpact, and Accenture, control roughly half the U.S. healthcare BPO market. Nine of the ten largest U.S. health plans use Conduent for claims and member operations, and Cognizant’s TriZetto platform processes billions of transactions for 650 health plans.⁴

Consolidation continues. UnitedHealth Group acquired Change Healthcare in 2022 to integrate technology into payment processes, and Elevance Health expanded its partnership with Innovaccer in early 2025 for data interoperability and analytics.³ Regional payers with 100,000 to 500,000 members are moving from staffing contracts to “Business Process as a Service” models that bundle automation with variable labor.

Cybersecurity has become a central procurement issue. After the February 2024 Change Healthcare data breach, payers now commonly require vendors to provide SOC 2 Type II audit reports, annual penetration tests, and $50 to $100 million in cyber-insurance coverage.⁴

Interoperability And The Required APIs

One of the biggest regulatory shifts for payer services is the federal push to make health data electronically portable. Two CMS rules set the framework.

The 2020 Interoperability Rule

The CMS Interoperability and Patient Access final rule, published in May 2020, required Medicare Advantage organizations, Medicaid and CHIP programs, and qualified health plan issuers on the federal exchange to implement a Patient Access API. Enforcement began on July 1, 2021. The rule required plans to make claims and encounter data, clinical data in the United States Core Data for Interoperability, and plan coverage and formulary information available to members through apps built on the HL7 FHIR standard.⁵

The 2024 Interoperability And Prior Authorization Rule

CMS-0057-F, released on January 17, 2024, expanded those obligations significantly. It applies to Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and qualified health plan issuers on the federally facilitated exchanges.⁶

Impacted payers must build and maintain four FHIR-based APIs:

Patient Access API: gives patients claims, encounter data, clinical information, and prior authorization details through health apps.
Provider Access API: gives in-network providers that same information, with patients retaining the right to opt out.
Payer-to-Payer API: moves up to five years of patient data when a member switches plans or has concurrent coverage.⁷
Prior Authorization API: lets providers check whether prior authorization is needed, see documentation requirements, and submit requests from their own systems.

The compliance timeline is staggered. Operational provisions, including shorter prior authorization decision timelines and the duty to give specific denial reasons, took effect January 1, 2026. The first publicly reported prior authorization metrics were due by March 31, 2026. Full API development and enhancement must be in place by January 1, 2027.⁸

For the Payer-to-Payer API, the new payer must request data from a member’s previous insurer within one week of obtaining sufficient identifying information and patient consent. Where a previous payer is also a concurrent payer, updated data must be requested quarterly.⁷ HHS has granted enforcement discretion that lets payers using the FHIR-based prior authorization API skip the older X12 278 transaction standard without a HIPAA enforcement risk.

Prior Authorization Reform

Prior authorization, the requirement that a provider get payer approval before delivering certain services, has become the most contested piece of payer operations. Reform is happening in three places at once.

Federal Rules

Under CMS-0057-F, impacted payers (other than qualified health plan issuers) must now issue prior authorization decisions within 72 hours for urgent requests and seven calendar days for standard requests. Denials must include a specific reason regardless of how the request was submitted.⁹

The Improving Seniors’ Timely Access to Care Act of 2025 (H.R. 3514/S. 1816) would go further for Medicare Advantage, requiring electronic prior authorization that integrates with physicians’ records, public reporting of approval and denial rates, evidence-based criteria, and annual review of those criteria. As of January 2026 the bill had 248 House co-sponsors and 64 Senate co-sponsors.¹⁰

Industry Pledge

In June 2025, roughly 50 health plans, including Elevance Health, Centene, Cigna, CVS Health (Aetna), Humana, and UnitedHealthcare, signed a voluntary pledge to reduce prior authorization burdens.¹¹ By April 2026, AHIP and the Blue Cross Blue Shield Association reported an 11% reduction in prior authorization requirements, roughly 6.5 million fewer requests, with reductions above 15% in Medicare Advantage. Participating plans also agreed to honor existing prior authorizations for a 90-day transition when members switch insurance.¹²

State Action

At least ten states have adopted “gold card” programs that exempt providers who meet specified approval-rate thresholds from prior authorization altogether.¹³ Several more targeted reforms took effect in 2026:

Virginia set minimum authorization durations of six months for initial requests and twelve months for continued requests.
Washington limited AI algorithms to approving prior authorization requests; denials must be reviewed by a health professional.¹⁴
North Dakota required seven-day decisions for non-urgent requests and 72 hours for urgent ones, with automatic approval if the deadline is missed.
Alaska required decisions within 72 hours for routine cases and 24 hours for expedited ones.

Oklahoma now requires physician review of denials and bars reviewers from having a financial interest in the outcome. Minnesota prohibited prior authorization for certain outpatient mental health and substance use services. Mississippi requires chronic-condition authorizations to last at least twelve months.¹³

AI In Payer Decisions

Artificial intelligence in claims processing, prior authorization, and coverage decisions is one of the fastest-moving pieces of payer regulation. An NAIC survey found that 84% of responding insurers across product lines use AI or machine learning for utilization management, disease management, and prior authorization.¹⁵

Federal Posture

Federal oversight remains fragmented. CMS guidance effective in 2024 lets Medicare Advantage plans use AI for coverage determinations, but requires medical necessity decisions to rest on the individual’s circumstances and be reviewed by a qualified health care professional.¹⁶ The CMS 2026 Medicare Advantage final rule, issued in April 2025, did not include proposed guardrails for automated systems, though CMS said it may revisit the issue.

For Medicaid, no federal rule addresses AI in prior authorization specifically; CMS requires managed care organizations to ensure denial decisions are made by someone with appropriate expertise, without mentioning AI. For ERISA plans, the Department of Labor requires “full and fair” review of claims, but how that standard applies to AI decisions is largely untested.¹⁵

The Trump administration’s March 2026 National Policy Framework for Artificial Intelligence recommended legislation establishing a federal AI policy that would preempt state AI laws. No such legislation had been enacted as of mid-2026.

State Rules

States have moved faster. The NAIC adopted a Model Bulletin on the Use of Artificial Intelligence by Insurers in December 2023, and by April 2026 twenty-five states and the District of Columbia had adopted guidance based on it.¹⁷ The bulletin requires insurers to ensure AI-supported decisions comply with existing insurance laws, including anti-discrimination and unfair trade practice standards.

Several states went further by statute. California’s Physicians Make Decisions Act (2025) bars insurers from using AI as the sole means to deny, delay, or modify care and requires that final medical necessity determinations be made by a licensed physician. Texas prohibits AI from making adverse medical necessity determinations, restricting AI to administrative support or fraud detection. Arizona, Maryland, and Nebraska enacted similar human-review requirements before AI-informed denials.¹⁶

The WISeR Pilot

Against that restrictive trend, CMS launched the Wasteful and Inappropriate Service Reduction Model in January 2026. It is a six-year pilot using AI and machine learning to support prior authorization in traditional (Original) Medicare for the first time. The program runs in Arizona, New Jersey, Ohio, Oklahoma, Texas, and Washington, with private technology companies (Cohere Health, Genzeon, Humata Health, Innovaccer, Virtix Health, and Zyter) assigned to specific regions. It initially targets three procedure categories prone to overuse: skin and tissue substitutes, nerve stimulator implantation, and knee arthroscopy for knee osteoarthritis. All non-payment recommendations must be made by licensed clinicians, and emergency, inpatient, and high-risk services are excluded.¹⁸

Litigation

AI in coverage decisions is being tested in court. In Estate of Gene B. Lokken et al. v. UnitedHealth Group, Inc., plaintiffs allege that UnitedHealth and its subsidiary NaviHealth used an AI tool with a claimed 90% error rate to wrongfully deny post-acute care claims for Medicare Advantage patients. A federal judge in Minnesota allowed the case to proceed in February 2025 on breach of contract and breach of good faith claims. As of early 2026 the case is in discovery, with active disputes over document production.¹⁹

Price Transparency, Surprise Billing, And Parity

Three other regulatory regimes shape day-to-day payer operations.

Price transparency. Since July 1, 2022, most group health plans and issuers in the individual and group markets must publish machine-readable files disclosing negotiated in-network rates and historical allowed amounts for out-of-network providers. Beginning January 1, 2023, plans had to offer patient-facing cost-sharing estimates for 500 defined items and services, expanding to all covered services on January 1, 2024.²⁰ Technical compliance appears high, but the published files have been described as largely inaccessible without advanced computing capability. Penalties run about $100 per violation, per day, per affected enrollee. A proposed rule published in December 2025 would require cost-sharing information to be available by phone, improve the machine-readable files, and make the disclosures easier to find on insurer websites.²¹

No Surprises Act. Effective January 1, 2022, the law created balance billing protections for patients with private health insurance who receive emergency care from out-of-network providers, non-emergency services from out-of-network providers at in-network facilities, or out-of-network air ambulance services. Cost-sharing must be calculated as if the care were in-network. When providers and payers cannot agree on payment after a 30-day open negotiation, either side may initiate the federal Independent Dispute Resolution process, in which a certified IDR entity selects one party’s proposed amount.²² The IDR process has been heavily litigated, and the Departments continue to issue updated guidance in response. The No Surprises Act does not cover ground ambulance services.

Mental health parity. The Mental Health Parity and Addiction Equity Act requires that non-quantitative treatment limitations such as prior authorization, step therapy, and network restrictions not be more restrictive for mental health and substance use benefits than for medical and surgical benefits. The Consolidated Appropriations Act of 2021 added a requirement that plans conduct and document comparative analyses. Final rules released in September 2024 would have tightened those requirements, but in May 2025 the Departments of Labor, HHS, and Treasury announced they would not enforce the 2024 rule while industry litigation proceeds, plus an additional 18 months after a final court decision.²³ The underlying statute and the 2013 regulations remain in force, the Departments must still conduct at least 20 MHPAEA investigations per year, and the federal non-enforcement policy does not bind state regulators.

Fraud Enforcement Is At A Record Level

Federal enforcement against healthcare fraud hit record levels in 2025. The DOJ’s Health Care Fraud Unit indicted 194 defendants alleging more than $15 billion in fraud losses. The annual “Health Care Fraud Takedown” charged 324 defendants in connection with over $1.46 billion in alleged fraud and seized more than $245 million in assets.²⁴ The HHS Office of Inspector General reported nearly 500 False Claims Act cases between April and September 2025 alone.²⁵ In June 2025, the DOJ established a Health Care Fraud Data Fusion Center combining personnel from the DOJ, HHS, and the HHS Office of Inspector General, using cloud computing, AI, and analytics to detect suspicious billing patterns in near-real time.

Appeal Rights When A Payer Says No

When a payer denies a claim, federal law gives consumers a structured appeal process. Under the Affordable Care Act, you have up to 180 days after receiving a denial notice to file an internal appeal. Insurers must decide internal appeals within 30 days for prior authorization requests, 60 days for services already received, and 72 hours for urgent care.²⁶

If the internal appeal fails, you have the right to an independent external review. The external reviewer must be impartial, and insurers are legally required to accept and implement the decision. Standard external reviews must be decided within 45 days; expedited reviews in urgent situations must be resolved within 72 hours. If a state’s external review process does not meet federal standards, HHS administers the process at no charge to the consumer.²⁷

Who Regulates Which Payer

The regulatory map depends on the type of plan. State insurance departments are the primary regulators of fully insured health plans, where an employer buys coverage from an insurer that bears the financial risk. States license insurers, review rates, conduct market examinations of claims handling, and run consumer complaint processes. The NAIC reports that state departments collectively handled over two million consumer inquiries and over 300,000 formal complaints in a recent reference year.²⁸

Self-insured employer plans are largely exempt from state insurance law under ERISA’s federal preemption. The U.S. Department of Labor is the primary federal regulator for these plans, enforcing fiduciary standards and requiring grievance and appeals processes.²⁹ ERISA lets participants sue for benefits and for breaches of fiduciary duty, but gives employers wide latitude on plan terms and benefit design. Because self-insured plans are often administered by the same companies that sell fully insured coverage, the member experience may feel the same even though the protections differ substantially.²

Medicaid managed care, which enrolled approximately 85% of Medicaid’s more than 76 million beneficiaries as of late 2025, is governed by 42 CFR Part 438. That framework covers actuarial soundness, network adequacy, quality rating systems, enrollee grievance and appeal procedures, and mental health parity.³⁰

Knowing which bucket your coverage sits in matters, because it determines which agency you can turn to, which rules the plan must follow, and which of the reforms above actually reach you.

1
CMS.gov. Multi-Payer Alignment
2
KFF. The Regulation of Private Health Insurance
3
Coherent Market Insights. Healthcare Payer Services Market
4
Mordor Intelligence. United States Healthcare BPO Market
5
HHS.gov. CMS Interoperability and Patient Access Final Rule
6
CMS.gov. CMS-0057-F Final Rule
7
CMS.gov. Payer-to-Payer API Workflow
8
CMS.gov. CMS Interoperability and Prior Authorization Final Rule Fact Sheet
9
AHIMA. CMS EPA Final Rule FAQ
10
American Medical Association. Reform Prior Authorization in Medicare Advantage
11
Fierce Healthcare. Insurers Have Eliminated 11% of Prior Authorizations Under Reform Pledge
12
AHIP. Health Plans Reduce Prior Authorization
13
NCSL. How States Are Reforming the Prior Authorization Process
14
Becker’s Payer Issues. 5 States Reforming Prior Authorization in 2026
15
KFF. Regulation of AI in Prior Authorization and Claims Review
16
Kansas Legislative Research Department. Artificial Intelligence Use in Health Insurance
17
NAIC. AI Model Bulletin State Adoption Map
18
CMS.gov. WISeR Model
19
Georgetown University Law Center. Estate of Gene B. Lokken v. UnitedHealth Group
20
Georgetown University CHIR. Hospital and Insurer Price Transparency Rules in Effect
21
Federal Register. Transparency in Coverage Proposed Rule
22
CMS.gov. Overview of Rules and Fact Sheets
23
Workforce Bulletin. What Non-Enforcement of the 2024 Parity Rule Means for Employer Plans
24
DOJ. Health Care Fraud Unit
25
HHS OIG. Fraud Enforcement
26
CMS.gov. Appeals Process Fact Sheet
27
Healthcare.gov. External Review
28
NAIC. History of Insurance Regulation
29
DOL. ERISA
30
CMS.gov. Medicaid Managed Care State Directed Payments Fact Sheet