AI in Revenue Cycle Management: Uses, Risks, and Controls

AI in revenue cycle management (RCM) is software that predicts, drafts, or decides the steps between scheduling and payment: eligibility checks, prior authorization requests, coding, charge capture, claim edits, denial prediction, appeals, payment posting, and patient statements. It speeds up high-volume, rules-heavy work, and liability for each claim stays with the organization that submits it. A coding model that overstates acuity creates False Claims Act exposure under 31 U.S.C. 3729, a vendor that touches PHI is a business associate under HIPAA, and payers run their own algorithms on the same claims under rules such as 42 CFR 422.101(c), California SB 1120, and Texas S.B. 815 that limit how far an algorithm may decide coverage. Organizations that get value from RCM AI measure it with standard metrics, audit a sample of its coding, and keep a named person accountable for every claim.

Where does AI show up in the revenue cycle?

AI now appears at every stage from registration to the final patient statement. The table lists the common uses, the main risk each creates, and the control that addresses it.

How is autonomous coding different from computer-assisted coding?

Computer-assisted coding proposes codes from the documentation, and a credentialed coder accepts, changes, or rejects each one before the claim goes out. Autonomous coding finalizes codes for defined encounter types with no coder touching them and routes the exceptions to people. The difference matters because the False Claims Act's knowledge standard includes "deliberate ignorance" and "reckless disregard," with no proof of specific intent to defraud required, so an organization that lets software finalize codes without checking its accuracy is exposed for every claim the software touched.

Four design decisions keep autonomous coding defensible. Limit it to encounter types where the documentation is structured and the code set is narrow, and keep complex visits and diagnosis-heavy risk adjustment work with coders. Set a confidence threshold below which the claim routes to a coder. Store the AI's suggestion, the final code, the model version, and the identity of anyone who accepted or changed it for each claim. And sample AI-finalized claims separately from coder-reviewed ones, because a blended error rate hides the population that carries the most risk.

How are payers using AI in prior authorization and claims review?

Payers run algorithms on the other side of the same claims, and courts are testing how far that can go. In Estate of Gene B. Lokken v. UnitedHealth Group (D. Minn., No. 0:23-cv-03514), filed November 14, 2023, plaintiffs allege that UnitedHealth used naviHealth's nH Predict model to predict how long Medicare Advantage members would need post-acute care, such as skilled nursing stays, and to cut off coverage against treating physicians' recommendations. On February 13, 2025, the court dismissed five claims, including unjust enrichment, insurance bad faith, and state unfair practices claims, as preempted by the Medicare Act, and let the breach of contract and implied covenant of good faith claims proceed. The O'Neill Institute's litigation tracker showed the case still pending, with scheduling orders entered through September 2026, at its October 1, 2026 update, and the allegations remain unproven.

In Kisting-Leung v. Cigna (E.D. Cal., No. 2:23-cv-01477), plaintiffs allege that Cigna's PxDx algorithm let its doctors deny payment in batches, spending an average of 1.2 seconds per request. In a March 2025 order, the court let ERISA fiduciary duty claims proceed for plaintiffs whose claims went through PxDx, finding that letting an algorithm make medical necessity decisions, as alleged, conflicts with the plain language of the plan, and let California Unfair Competition Law claims proceed for two plaintiffs. The case remained active in October 2026.

Regulators draw the same line in rules. CMS requires Medicare Advantage organizations under 42 CFR 422.101(c)(1)(i) to base medical necessity determinations on the enrollee's medical history, physician recommendations, and clinical notes, so the plan has to apply the individual record even when an algorithm screens a request first. California's SB 1120, at Health and Safety Code 1367.01(k) since January 1, 2025, requires a health plan's AI tool to base decisions on the individual enrollee's clinical circumstances and not solely on a group dataset, and it reserves medical necessity denials, delays, and modifications for licensed physicians or health care professionals. Texas's S.B. 815 bars utilization review agents from using an automated decision system to make an adverse determination for plans issued or renewed on or after January 1, 2026, while allowing such systems for administrative support and fraud detection.

What is CMS's WISeR model?

The WISeR model, short for Wasteful and Inappropriate Service Reduction, brings technology-assisted prior authorization into traditional Medicare. It runs for six performance years, from January 1, 2026 to December 31, 2031, in Arizona, New Jersey, Ohio, Oklahoma, Texas, and Washington, with one technology participant in each state. Participants use enhanced technology, including AI and machine learning, to review selected items and services such as skin and tissue substitutes, electrical nerve stimulator implants, and knee arthroscopy for knee osteoarthritis. Providers in those states can submit a prior authorization request or go through post-service, pre-payment review. CMS states that all recommendations for non-payment are determined by appropriately licensed clinicians, that participants receive a share of the spending tied to averted care adjusted for performance measures, and that the model excludes inpatient-only services, emergency services, services where delay would pose a substantial risk, and Medicare Advantage enrollees.

For a provider in those six states, a technology-assisted reviewer now reads the documentation behind every affected order. The documentation controls that protect coding accuracy also decide whether those services get paid, and CMS has said providers with demonstrated compliance records may be exempted from WISeR review in the future.

What does CMS-0057-F require for prior authorization in 2026 and 2027?

The CMS Interoperability and Prior Authorization final rule, CMS-0057-F, released January 17, 2024, applies to Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and qualified health plan issuers on the federally facilitated exchanges. Since January 1, 2026, impacted payers other than those exchange issuers must send prior authorization decisions within 72 hours for expedited requests and seven calendar days for standard requests. Payers must give a specific reason for each denial, and they had to post their first prior authorization metrics by March 31, 2026.

Beginning January 1, 2027, with dates that vary by payer type, payers must run a Prior Authorization API that lists covered items and services, identifies documentation requirements, and returns decisions, along with a Provider Access API, a Payer-to-Payer API, and prior authorization information in the Patient Access API. Clinicians and hospitals then attest to an Electronic Prior Authorization measure starting with the CY 2027 performance and EHR reporting periods. Those APIs give provider-side AI tools a standard interface to payer documentation rules and decisions, and the 72-hour and seven-day clocks give every denial model a measurable payer response time to test against.

Where does AI create False Claims Act exposure?

The False Claims Act makes anyone who knowingly submits a false claim liable for three times the government's damages plus a civil penalty for each claim. A coding tool that systematically suggests higher-level codes or unsupported diagnoses creates that exposure across every claim it touched, and the overpayment rule turns a discovered pattern into a deadline. Under 42 CFR 401.305, an identified Medicare overpayment must be reported and returned within 60 days, a deadline that a timely, good-faith investigation can suspend for up to 180 days, with a six-year lookback, and an overpayment kept past the deadline becomes an obligation under the False Claims Act.

The public enforcement record shows where the risk sits, and none of the three DOJ actions below involved a generative AI coding tool. On January 14, 2026, DOJ announced that Kaiser Permanente affiliates agreed to pay $556 million to resolve allegations that they developed mechanisms to mine patients' past medical histories for diagnoses never submitted to CMS and pressed physicians to add them through addenda, often months and sometimes more than a year after the visit, to raise Medicare Advantage risk adjustment payments; the claims are allegations only. A model that suggests diagnoses from chart history performs a similar search, so each diagnosis it suggests needs support in the documentation of the encounter it is coded from. In January 2020, the EHR vendor Practice Fusion agreed to pay $145 million and admitted taking kickbacks from an opioid company in exchange for clinical decision support alerts designed to influence prescribing. On July 2, 2025, DOJ and HHS named Medicare Advantage and the manipulation of electronic health record systems to drive inappropriate utilization among the priorities of their joint False Claims Act working group.

Which revenue cycle stages carry the most compliance risk?

Risk concentrates where AI output becomes a code, a clinical statement, or a coverage argument. The figure rates each stage against four exposures.

Coding, charge capture, and prior authorization carry the highest ratings because errors there become claims or clinical representations to a payer. Eligibility, claim scrubbing, and payment posting carry less regulatory exposure and more operational risk, so their controls are reconciliation and exception review.

What HIPAA and vendor controls does RCM AI need?

An RCM AI vendor that touches PHI is a business associate, and so is each subcontractor that handles the PHI, from the cloud host to an offshore coding team. The BAA should state whether the vendor may use your PHI to train or improve its models, how long it keeps prompts, documents, and outputs, and which subcontractors and locations handle the data. HHS's cloud computing guidance permits storing ePHI outside the United States under a BAA and expects the risk analysis to account for the location. Our article on HIPAA and AI covers the BAA terms that matter for AI vendors, and billing staff who use general AI assistants fall under the same rules, as our article on whether ChatGPT is HIPAA compliant explains plan by plan.

Inside your environment, three controls matter most. Each bot or agent should run under its own service identity with access to only the payer portals, work queues, and record sections its task needs, which applies the information access management standard at 164.308(a)(4) to software. Audit trails should record, for every claim, what the AI suggested, which model version produced it, who accepted or changed it, and when, because 164.312(b) requires the means to record and examine activity and a payer audit will ask for exactly that sequence. Vendor oversight should cover the vendor's security evidence, testing of the integration, and a fresh review whenever the vendor changes models or adds subcontractors; our third-party risk management practice runs that review. Buyers evaluating an RCM company in a transaction should ask the same questions, as our healthcare M&A due diligence guide describes.

How do you measure whether RCM AI works?

Measure it with standard definitions, before and after go-live, and with an audit sample that tests accuracy as well as speed. HFMA's MAP Keys supply industry-standard definitions, including Clean Claim Rate (CL-1), Remittance Denial Rate (AR-5), Denial Write-Offs as a Percentage of Net Patient Service Revenue (AR-6), Net Days in Accounts Receivable (FM-1), Cost to Collect (FM-6), and Point-of-Service Cash Collections (PA-7). Baseline each one before go-live and keep the definitions fixed, so a vendor's reported improvement can be checked against your own numbers.

Denial rates need context. KFF's analysis of 2024 CMS data, published in March 2026, found that insurers selling on HealthCare.gov denied 19% of in-network claims, with rates ranging from 3% to 36% across insurers, and that fewer than 1% of denied claims were appealed; the most common reasons cited were "other" at 36% and administrative reasons at 25%. Those figures cover marketplace plans only, and they show how rarely denials are appealed and why a falling denial rate needs a payer-by-payer breakdown before anyone credits the AI. Coding accuracy needs its own proof: pull a random monthly sample of AI-suggested and AI-finalized claims, have certified coders outside the workflow re-code them from the documentation, and track both the error rate and the direction of errors, because errors that consistently raise payment form the pattern an investigator looks for.

How BD Emerson helps

BD Emerson governs and secures AI in the revenue cycle; we do not implement EHRs or code claims. Our healthcare AI governance team inventories the AI in your revenue cycle, including tools embedded in vendor platforms, then runs vendor due diligence on the BAA, subcontractor and offshore access, data retention, and the security of each integration. We design the controls in the table above with your revenue cycle and coding compliance leaders, set up the logging and audit sample that show the AI's accuracy over time, and assemble the evidence a payer audit, an OCR inquiry, or a buyer's diligence team will request. The same evidence serves a health system answering a regulator and an RCM vendor answering a customer's security and AI questionnaire. Our healthcare industry page covers the rest of our work for health systems and health tech companies.

Frequently asked questions

How is AI used in revenue cycle management? AI checks eligibility and estimates costs, assembles and drafts prior authorization requests, suggests or finalizes codes from clinical documentation, finds missed charges, predicts payer edits and denials, drafts appeal letters, matches remittances to claims, and manages patient payment outreach. Each use speeds up rules-heavy work, and each needs a control, such as coder review, clinical sign-off, or reconciliation, before its output becomes a claim or reaches a patient.

What is autonomous coding? Autonomous coding is software that assigns and finalizes medical codes for defined encounter types with no human coder reviewing each claim, routing low-confidence cases to coders. Computer-assisted coding, by contrast, suggests codes that a coder accepts or changes. Autonomous coding needs narrow scope, confidence thresholds, a record of each suggestion and model version, and a separate audit sample of the claims it finalized.

Is AI prior authorization legal? Yes, within limits that depend on who uses it. Providers may use AI to assemble and submit requests. Payers may use AI to support decisions, but Medicare Advantage plans must base medical necessity decisions on the enrollee's own record, California reserves medical necessity denials for licensed physicians or health care professionals, and Texas bars utilization review agents from using automated decision systems to make adverse determinations for plans issued or renewed from January 1, 2026.

Can AI coding create False Claims Act liability? Yes. The False Claims Act reaches claims submitted with actual knowledge, deliberate ignorance, or reckless disregard of their falsity, so relying on a coding tool without checking its accuracy does not protect the organization that bills. Once an overpayment is identified, 42 CFR 401.305 requires reporting and returning it within 60 days, with a suspension of up to 180 days for a timely, good-faith investigation.

Do RCM AI vendors need a BAA? Yes, if they create, receive, maintain, or transmit PHI on your behalf, which nearly every RCM tool does. The BAA should address whether the vendor may train models on your PHI, how long it keeps prompts and documents, which subcontractors and offshore teams handle the data, and how quickly it reports incidents. HHS permits offshore storage under a BAA, and your risk analysis has to account for it.

How do you measure ROI from AI in the revenue cycle? Baseline standard metrics before go-live and track the same definitions after it. HFMA's MAP Keys define clean claim rate, remittance denial rate, denial write-offs, net days in accounts receivable, and cost to collect. Break denial rates out by payer, and pair speed metrics with a monthly coding audit sample, because faster claims that fail an audit cost more than they save.

If you are deploying AI in your revenue cycle or selling RCM AI to health systems, our healthcare AI governance team can review the vendors, design the controls and audit sample, and assemble the evidence payers, regulators, and customers will ask for.