AI for referral and prior-auth paperwork in Los Angeles community clinics, under HIPAA

Every community clinic we have walked into between downtown Los Angeles and San Bernardino has the same room. A fax machine, a stack of referral forms, and one coordinator who knows which specialist at which hospital will actually take a Medi-Cal patient this month. When that person is out, the queue stops.

This article is for the clinic administrator or medical director who has been told AI can fix that, and who has a compliance officer asking, reasonably, how.

What does an AI agent actually do on a referral?

It reads the incoming referral, pulls out the fields a coordinator would otherwise retype, checks them against the payer’s requirements, and drafts the next step for a person to approve.

In practice that means four things. It extracts patient, diagnosis, ordering provider, requested service and urgency from a faxed PDF or a scanned form. It checks whether the payer requires prior authorization for that service and what documentation the payer wants. It drafts the authorization request, or the message back to the referring provider asking for the missing note. It then places the whole package in the coordinator’s queue with a confidence score and a one-line reason.

The coordinator reads, corrects, and sends. Nothing reaches a payer or a patient without that step. The agent’s job is to remove the reading and the retyping, which is where the hours go.

Where does the PHI go, and who is responsible for it?

It stays inside the clinic’s own cloud tenant, under a business associate agreement, and never in a consumer AI product.

HIPAA does not prohibit AI. It requires that any vendor creating, receiving, maintaining or transmitting protected health information on the clinic’s behalf be a business associate under a written agreement that meets 45 CFR 164.504(e). The hyperscale cloud providers and the major model vendors all offer that agreement on their enterprise tiers. Consumer chat products do not, and several retain prompts for training. That is the whole line: enterprise tenant with a BAA, yes; consumer tool, no.

The design we deploy keeps the model, the documents and the logs in one tenant the clinic controls. Prompts and outputs are not used to train anything. Access is by role, so the front desk sees intake fields and the billing lead sees the authorization history. The Security Rule’s administrative, physical and technical safeguards apply to this system the same way they apply to the EHR, and the risk analysis should say so.

What changed in California law in 2025?

Two statutes, both effective January 1, 2025, shape how a clinic should design the human review step.

AB 3030 applies to health facilities, clinics and physician offices. If generative AI produces a written or verbal communication about a patient’s clinical information, the communication must carry a disclaimer that it was AI-generated and tell the patient how to reach a human. The exemption is the design we recommend anyway: if a licensed healthcare provider reads and reviews the message before it goes out, no disclaimer is required. Outbound patient messages should therefore always pass through a clinician, and the system should record who reviewed what.

SB 1120 is aimed at health plans and insurers rather than clinics. It requires that any utilization review decision made using AI be reviewed by a licensed physician before it becomes a denial. For a clinic the practical effect is on the other side of the fax: payer responses will still carry a physician’s name, and appeals still go to a person. A clinic’s agent can draft the appeal, but the evidence it assembles is what wins it.

How do payer timelines change the maths?

Federal prior-authorization deadlines tighten from 2026, which raises the cost of a slow submission.

Under the CMS Interoperability and Prior Authorization Final Rule, impacted payers, which include Medicaid managed care plans and Medicare Advantage plans, must respond to urgent prior-authorization requests within 72 hours and standard requests within seven calendar days from 2026, and must expose a prior-authorization API by 2027. That does not help a clinic whose submission sat in a queue for nine days before it went out. When the payer clock is short and predictable, the clinic’s own clock becomes the bottleneck, and that is a bottleneck an agent can shorten.

What should the clinic measure?

Coordinator hours per week on referral and authorization paperwork, before and after, and the median days from referral received to authorization submitted.

Those two numbers are enough. Model accuracy is a means, not an end, and a pilot that reports only accuracy has avoided the question. We agree the metric and the baseline in writing before the build starts, measure for two weeks before go-live, and report the result plainly at the end. Where a clinic has no baseline, the first two weeks of the pilot establish one.

A note on results: we do not publish client numbers in these articles, and any range you see from a vendor should be labelled illustrative until it is measured on your queue.

What has to be true before the pilot starts?

Five things, and they take the two-week Roadmap to confirm.

1. A named clinical owner who will review outbound messages and sign the runbook.
2. A BAA in place with the cloud and model vendors, and a risk analysis entry for the new system.
3. A way to get referrals in, which is usually the fax server’s output folder or the EHR’s document inbox.
4. A written list of the payers and services in scope for the first six weeks. Start with the three that generate the most volume.
5. A baseline for the two metrics above.

If any of those is missing, the Roadmap says so and what it will take. That is a better outcome than a pilot that stalls at week three because nobody can sign the BAA.

What does this look like on the ground?

A clinic in the San Gabriel Valley with two sites and one referral coordinator. Referrals arrive by fax to a shared inbox. The agent runs on each new document, files a draft in the coordinator’s queue within minutes, and flags the ones missing a progress note. The coordinator’s morning starts with a ranked list instead of a pile. The clinical owner reviews any message that goes to a patient. The audit log records every extraction, draft, edit and send, with the model version and the documents it read.

That is the whole system. It is not futuristic. It is the fax room with the reading done.