Appendix L: The National Prior Authorization Service and the end of paperwork

This appendix supports the section "What modern technology makes possible, and nobody has asked for" in the plan. It sets out the design in the detail a drafter would need.

The reframe

In American health care, the delay, the paperwork, and the opacity do not slow the system down. They are how the system makes money. Every one of them moves money or risk from a company to a patient. A prior-authorization request that takes 11 days is a process working exactly as designed: a real share of delayed requests are abandoned by patients who give up waiting, and the insurer never pays the claim. A bill that arrives four months later, from a company you have never heard of, in an envelope you cannot tell apart from three others, is a collection strategy. Nobody built any of this badly. They built it for a purpose that is not yours.

The fix is to make the friction expensive, and to build the tools that do so as consumer conveniences, years before the single payer exists.

What prior authorization is

Prior authorization is the requirement that a doctor obtain the insurer's approval before a service is delivered, on pain of the claim being denied. It began as a check on a small number of expensive or frequently misused services and has spread to routine imaging, common drugs, physical therapy, and, in some plans, most of what a specialist does. Physician practices employ staff whose only job is to submit and chase these requests. Surveys of physicians report that the average practice handles dozens a week, that delays routinely cause patients to abandon treatment, and that a meaningful share of denials are overturned on appeal, which is to say they were wrong. Medicare Advantage plans issued tens of millions of requests in a recent year and denied millions of them, and federal auditors have found that a substantial fraction of those denials were for care that met Medicare's own coverage rules.

1. The National Prior Authorization Service

One federal portal and one federal API, through which every prior-authorization request in the United States must flow. The doctor's office submits into it. The insurer answers into it. The patient can watch it happen, on their phone, in real time.

	Requirement
The clock	72 hours for expedited requests, 7 calendar days for standard ones. These are CMS's existing numbers, adopted verbatim. The plan does not invent a tighter clock, because arguing for a shorter one invites a technical fight about feasibility, and deemed approval makes the length nearly moot anyway. Adopting CMS's own numbers reduces the whole debate to one question: why shouldn't your employer's plan follow the rule Medicare Advantage already follows?
The teeth	Unanswered means approved, by operation of law. This is the provision that matters. A payer facing automatic approval answers well inside the deadline.
The scope	Every plan in America, including commercial plans and self-funded employer plans under ERISA. This is the actual ask, because federal rules today reach Medicare Advantage and Medicaid plans and stop at the employer market.
The signature	Every denial carries the name of a licensed, same-specialty clinician who personally reviewed it. Automation is permitted on approvals and prohibited on denials.
The one carve-out	A short, published list of genuinely novel or investigational treatments where clinical review is real, on the same clock, with a presumption of approval.

1a. Most requests should never become requests

The public debate stays fixed on a faster answer instead of asking why there is a question at all. For most requests the answer is already known: the plan's own rules engine could return it in milliseconds. The human reviewer is not inserted where the question is hard. The reviewer is inserted where the answer would otherwise be yes, and the delay is the point.

The plan requires every plan to publish its coverage criteria in machine-readable form, using the interoperability standards CMS already recommends, so that the ordering physician's record system checks them automatically before anything is submitted. At the moment of ordering, the doctor sees whether this patient meets the plan's own published rules and what documentation it would take. A request that would be approved never has to be made. A request that would fail is fixed before it is sent.

Most of this is already being built. A CMS rule finalized in January 2024 requires the plans it regulates to operate a prior-authorization API by 1 January 2027 and to answer within the 72-hour and 7-day clocks. The standards for checking criteria at the point of ordering, the so-called Da Vinci implementation guides for coverage requirements discovery, documentation templates, and prior authorization support, are recommended by CMS but not mandated, and none of it reaches employer plans. The plan mandates the standards and extends the rule to every plan in America. There is no technical excuse.

2. The consequences are statistical and automatic, never adjudicated

The instinct is to have the government judge each denial and fine the company. That structure is wrong for two reasons.

The first is constitutional. In 2024, in SEC v. Jarkesy, the Supreme Court held that when a federal agency seeks civil penalties for conduct resembling common-law fraud, the defendant has a right to a jury trial, which means the agency cannot impose those penalties through its own in-house adjudication. A federal health agency fining insurers for wrongful denials through administrative proceedings would face the same challenge.

The second is political. "A government algorithm decided your insurer owes two million dollars" is a magnificent attack ad, and the plan would be handing it over free.

So the design separates the individual case from the systemic consequence. Individual appeals are decided by independent clinical reviewers, using the independent-review-organization infrastructure that already exists under state external-review law and the Affordable Care Act, federalized and funded rather than reinvented. The systemic consequence is computed, not judged. Because every request in America runs through the portal, the portal records every insurer's overturn rate, by plan, by service line, by month. Above a published threshold, consequences follow by formula. There is no discretion to capture, no hearing to fight over, and nothing to lobby.

3. The penalty that bites

Fines get priced in as a cost of doing business. Two other currencies do not.

Approve pending appeal, where the clock itself does the harm. Appeals are decided by an independent clinical reviewer, not by the insurer, on the same 72-hour expedited clock. Where a treating physician certifies that even 72 hours carries a risk of harm, the care is provided immediately at the insurer's expense while the appeal runs. Today the patient bears 100 percent of the risk of delay, which is precisely why delay is profitable. Moving that risk off the patient destroys the economics of denial.

Losing the right to use the tool. An overturn rate above the threshold for a service line means the insurer loses prior-authorization authority for that service line for 24 months. It is self-executing, it costs the government nothing, and it is fatal to a utilization-management business model in a way no fine ever is. It works like gold-carding in reverse. Gold-carding, which Texas enacted in 2021 and several states have copied, automatically exempts physicians with high approval rates from prior-authorization review, rewarding them for rarely triggering denials. This provision flips the logic and applies it to the insurer: deny wrongly too often, and lose the tool.

4. The equilibrium is that prior authorization ends

Instant answers, plus a penalty for wrong denials, plus no penalty for approvals, plus approve-pending-appeal, means the cheapest strategy is to approve nearly everything. Review costs more than it saves once you cannot profit from delay.

This is better politics than a ban. The insurers abandon the tool; the plan does not confiscate it. Nobody can run an ad saying the government took away a patient-safety mechanism, because the insurers will have switched it off themselves, for commercial reasons, in public, on a dataset the government publishes.

5. The payer's plumbing, built as consumer relief three years early

Once every prior-authorization request in America flows through one federal API, the government owns the transaction log of the entire utilization-management industry. Today nobody can compute a real denial rate; the data is proprietary, patchy, and self-reported, which is why every argument about denials is an argument about anecdotes. Build the pipe and the government can publish, per insurer and per plan, in something close to real time, how many requests, how many denied, how long, and how many overturned. The surveillance is a byproduct of a consumer convenience.

The same is true of every tool in this section. Each is a popular consumer relief measure under a name nobody can oppose, and each is a component of the single payer, running at national scale years before the payer exists.

Relief tool	What it quietly is
National Prior Authorization Service	The payer's authorization and eligibility engine
National appointment-availability API	The provider directory, and the waiting-time measurement system
Published-price API	The fee schedule's publication layer
First-dollar drug and primary-care payment	The claims pipeline and the enrollment roster. The drug half already runs today on the federal pharmacy rail that serves the VA and the Indian Health Service.
Patient record index and API	The national record

This answers the two standard operational objections to a single payer. The first is that CMS, an agency of six or seven thousand federal employees, cannot become the payer for $3.6 trillion of care in one big-bang procurement. The second is that a national health record will be England's National Programme for IT, a program launched in 2002 that spent more than £10 billion and was dismantled in 2011 without delivering a core record, rather than Estonia's, which has run since 2008. Both objections are aimed at a single enormous switch-on. Neither survives an architecture in which every part has been running at national scale for three years, debugged in public, with the private insurers as the test population. The plan's transition gives enrollment four years, and the binding constraint is administrative: standing up claims and eligibility operations for 340 million people. If the eligibility engine, the claims pipeline, and the roster have been live since year one, that constraint is weaker, and two years may be enough.

6. More in the same family

• The instant appointment. Every provider billing any payer must publish real-time appointment availability in a machine-readable feed, and one national search reads them all: orthopedist, 30 miles, this week. It arrives in the first year because it needs no payer, no enrollment, and no money; it is a publication mandate. Americans who wait four months often wait because finding an available slot costs more effort than enduring the wait. Two byproducts are each worth as much as the feature. It makes the queue visible, generating days-to-third-next-available by facility and service line automatically rather than by self-report, which is the measurement this kind of plan most needs and least often has (Appendix D). And it creates competition on speed in a system where the fee schedule fixes every price; speed and convenience become the one remaining market mechanism.
• Price preclusion. No provider may bill a patient any amount that was not published on the national price API before the service. You may charge only what you published. Because of that, no patient can be surprise-billed and no arbitration is needed. The No Surprises Act of 2020 instead relies on independent dispute resolution between providers and insurers after the fact, and that arbitration process, backlogged and gamed by both sides, is its documented failure.
• The auto-filling prescription. Chronic maintenance drugs auto-refill and ship at $0, with no renewal call and no annual reauthorization, until a clinician stops them. A large share of primary care appointments exist only to renew a prescription, and deleting the renewal deletes the visit without denying anyone anything. Patients not taking their chronic medication is one of the largest avoidable costs in the system, and the 30-day fill and the annual renewal are a large part of why.
• The standing referral. Diagnosed with a permanent condition, and all care and medication for it is pre-authorized permanently, with step therapy prohibited where a treating physician certifies prior failure or contraindication. It is one sentence of statute with no infrastructure behind it. The January phone call about a drug you have taken all year is a grievance almost every chronically ill family can tell you about from memory.
• Real-time claims. For most encounters the claim is fixed once the codes are entered. Pay at the point of service, like a card transaction, and audit a 2 percent sample afterward, the pattern tax administration already uses. The adjudication industry exists because payers do not trust providers; a public payer with global budgets has no fight to referee.
• The reverse-auction on the wait. Once the guarantee clock runs out, the system searches for a slot elsewhere, books it, and covers the travel. The patient does nothing. The guarantee becomes automatic, which is the only version that does not reliably favor patients who know how to work a system.

7. Ways this goes wrong, and what to write into the statute

1. Whoever wins the portal contract becomes the new UnitedHealth. The bidder pool at this scale is small, and several of the bidders are entities this bill dissolves, or their spin-outs. The statute should open-source the platform and the schema as a contract condition, award parallel contracts to several vendors so no single firm controls the system, bar divested entities from bidding on core payer infrastructure, and fund a permanent federal technical corps that can hold the contract rather than be briefed by it.
2. We build the pipe and they run AI on their end. A national API that funnels every request through one channel gives insurers a single, standard input for their denial algorithms. If the design is careless, that makes automated mass denial easier, because one uniform schema is simpler to screen at scale than dozens of proprietary formats. The statutory rule: no denial may be issued without a named, licensed, same-specialty clinician who personally reviewed it and whose name appears on the notice. The portal logs the name, the timestamp, and the seconds spent. Denials per reviewer per hour becomes a published statistic, and a reviewer signing hundreds of denials an hour is visibly not reviewing anything.
3. The channel problem. Not everyone has a smartphone, broadband, or English. Phone, mail, and in-person channels are mandated with identical clocks and identical legal effect, and the deemed-approval rule applies to all of them. A right that exists only in an app excludes the people who most need it.
4. One pipe is one point of failure. In February 2024 a ransomware attack on Change Healthcare, a single claims clearinghouse, took national claims and pharmacy transactions down for weeks. The portal must be designed as a regulated utility with mandated redundancy and a legally required offline fallback: the 180-day transition-fill rule from Appendix F, under which any presented prescription is dispensed and paid without edits when the system is down, made permanently available. Adversarial security testing is a statutory condition, not a procurement preference.