Abstract
CMS-0057-F requires impacted health plans to implement FHIR prior-authorization APIs by 1 January 2027. Market consensus treats that mandate as the end of portal work. The rule's text does not. Self-funded employer plans under ERISA, specialty drug prior authorization, clinical-review handoffs, denials and appeals remain outside the API.
In this paper, the non-API residual means exactly that leftover work: the payer-portal forms and appeals a coordinator still types by hand after the APIs go live. The paper defines how to measure it on one desk: one named coordinator, one named payer portal family, the desk's own written before-count, and a 30-day window scored as completed cases per coordinator-day.
The tool under test is DeskGate Operator (v2.6.8), a Chrome/Edge browser extension that types quoted chart facts into the payer form the coordinator already has open. The coordinator clicks Submit. No live-desk results exist yet. The free months of the first 10 desks will produce the first ledgers.
1. The regulatory landscape: CMS-0057-F
Utilization management and prior authorization take up a large share of U.S. revenue-cycle administrative time. CMS-0057-F requires Medicare Advantage organizations, Medicaid and CHIP agencies, and QHP issuers on Federally Facilitated Exchanges to expose HL7 FHIR prior-authorization APIs by 1 January 2027.
Five segments leave high-friction work on the desk after that date:
| Workflow or segment | CMS-0057-F scope | Desk impact |
|---|---|---|
| ERISA self-funded employer plans | Exempt. Regulated by the Department of Labor under ERISA (29 U.S.C. § 1002), not by CMS. | A large share of commercially insured workers. Portals and fax remain the operating channels. |
| Specialty drug prior authorization | Drugs are excluded from the rule's prior-authorization API provisions. | GLP-1s, oncology infusions and biologics stay manual. |
| Clinical review handoffs | The API can carry a structured request. It does not assemble the chart packet. | Notes, labs and attachments remain human-collated when review is not instant. |
| Denials, rebuttals, status chase | Decision-reason obligations do not automate the appeal desk or the phone tree. | Packet assembly and phone trees persist. |
| The 2026–2028 mixed book | Payers roll out on staggered timelines. | Staff switch between API lanes and portal lanes. A mixed book costs more than a uniformly manual one. |
DeskGate does not compete with the API. It works on the residue the rule leaves behind: it types quoted chart facts into the payer form the coordinator has open, and the coordinator submits.
2. Governance and data path
Clinical AI stalls when the vendor cannot say who the filing actor is. DeskGate's scope is limited as follows.
Scope: the spear of medicine
- ExcludedTip. Diagnosis, prescribing, patient-facing care. DeskGate never touches it.
- ExcludedNear-tip. Medical-necessity determination. The EHR and the physician have already decided.
- DeskGateMid-shaft. Typing quoted chart facts into the open payer form, and writing [MISS] where the chart has nothing to quote. Done in the side panel.
- DeskGateShaft. Working inside the coordinator's own session, reading every box back, hashing the payer reference. Done by the extension.
Human Submit
DeskGate types quoted chart facts into the form, reads every box back, then stops. It never clicks Submit and never attaches files; an unattended submit is refused. The licensed coordinator inspects the form and clicks Submit. Legal filing authority does not transfer.
Data path (HIPAA, 45 CFR § 164.312)
READ CHART reads what is on screen into the side panel's memory. NEW CASE clears it, and so does reading a different patient. On a licensed desk, every screen read goes to Gemini on Vertex AI in DeskGate's own Google Cloud project, under DeskGate's Google Cloud BAA, executed 28 September 2026.
Before the first live chart is read, Google's default in-memory caching (up to 24 hours) is disabled on that project, and DeskGate has requested Google's exception from abuse-monitoring prompt logging. The box-matching step sees box labels and fact names, never patient values. No chart notes or member identifiers are written to DeskGate server databases. After the coordinator submits, the payer reference is hashed in the browser; the ledger keeps the hash, never the reference. The desk brings no model keys and pays no model spend.
Why in the session, not in a cloud bot
Payer portals sit behind the coordinator's SSO, Duo or Okta two-factor login, and VPN. A cloud bot opens a new session, which is exactly what those controls are built to stop. DeskGate does not replay the login. It works inside the Chrome or Edge session the coordinator has already authenticated.
DeskGate Operator is one runtime: a browser extension with a side panel. It never logs into the EHR or the payer portal, and there is no remote, headless or cloud browser. It reads only the tab in focus, only after READ CHART, and refuses hosts outside the licensed portal family. Availity has a built-in field list. Other portals are matched by Gemini reading the box labels; that has been shown on our synthetic showcase pages, not yet on a live desk.
3. Occupational mapping and price-plus-burden
Tasks are mapped to the U.S. Department of Labor's O*NET occupation codes, so the boundary is stated in occupational terms rather than our own marketing language. The full task-by-task view is on /task-map.
| O*NET role | Staged by DeskGate | Kept human |
|---|---|---|
| Medical secretaries & admin assistants43-6013.00 | Payer-form completion from quoted chart facts | Phone triage, scheduling, greeting |
| Medical records specialists29-2072.00 | Diagnosis and CPT transcription from the chart on screen | Release authority, training, governance |
| Insurance claims & policy processing43-9041.00 | Portal box entry; read-back of every box | Attachments, Submit, communication with the insured, complex exceptions |
| Billing & posting clerks43-3021.00 | Appeal drafting from quoted chart facts (STAGE APPEAL) | Ledger reconciliation, counseling |
| New task: review gateCreated by the product | Inspecting the staged boxes before Submit. This is drag the product creates. It is measured on each desk; no figure exists yet. | |
Price-plus-burden
Gross "minutes saved" that ignore review time are not a ledger. That is why the measure is completed cases per coordinator-day: review at the gate is part of the coordinator's day, so it is already inside the number.
- Before-count
- Before day 1, the desk writes down its appeals completed per coordinator-day. That is the only baseline.
- Staging time
- No figure is published. We have not measured a live desk.
- Review at the gate
- Counted inside the coordinator-day, not deducted separately.
- Savings
- None claimed until the day-30 ledger exists.
4. Schedule M and the day-30 ledger
Schedule M is a 30-day measurement with one named coordinator on one named payer portal family, against the desk's own written before-count of appeals completed per coordinator-day. A completed case is one the coordinator submitted; at that point the payer reference is hashed in the browser and the hash goes to the ledger.
No results yet. No live desk has completed a free month, so this section contains no measured numbers. The free months of the first 10 desks produce the first ledgers. The tables below define what each ledger will contain.
Rate uplift is not labor reduction
An illustration of the arithmetic, not a result: moving from 4 to 5 completed cases per coordinator-day is a 25% rate uplift. For the same volume, coordinator-days fall by 1 − (4 ÷ 5) = 20%. Quote labor as coordinator-days avoided per 1,000 completed cases, and do not invent dollar savings.
Inputs and their sources
| Value | Metric | Source |
|---|---|---|
| 39 requests | Prior authorizations per physician per week | AMA prior authorization physician survey, fielded late 2024 and published 2025. A published benchmark, not a DeskGate measurement. |
| 13 hours | Physician and staff time per physician per week on prior authorization | Same AMA survey. A published benchmark, not a DeskGate measurement. |
| The desk's own number | Before-count: appeals completed per coordinator-day before day 1 | Written down by the desk before day 1 |
| Measured at day 30 | Completed cases per coordinator-day in the 30-day window | The day-30 ledger |
The day-30 ledger: four numbers
| Layer | Number | Before day 1 | Day 30 |
|---|---|---|---|
| A · Outcome | Completed cases per coordinator-day, compared with the desk's own before-count | The desk's written before-count | No result yet |
| B · Contribution | How often the coordinator submitted what DeskGate staged. Says whether the draft was usable. | n/a | No result yet |
| B · Contribution | How often a staged box was changed by the coordinator before Submit | n/a | No result yet |
| C · Integrity | Autonomous submits. Must stay at zero; an unattended submit is refused. | 0 | 0 (required) |
5. The free month: first 10 desks
The first 10 desks get 30 days free. Their day-30 ledgers will be the first measured results this methodology has.
- Fee
- None for 30 days. The price after day 30 is agreed before day 1.
- Scope
- One named coordinator, on one named payer portal family the desk already works.
- Before day 1
- A twenty-minute install call. The desk key is issued from our license list with that desk's sites on it, and the desk writes down its appeals completed per coordinator-day.
- Patient data
- The desk signs our one-page BAA before any live chart is read.
- Output
- At day 30 the desk sees four numbers: completed cases, how often the coordinator submitted what DeskGate staged, how often a staged box was changed, and autonomous submits, which stay at zero. No savings claim until that sheet exists.
6. References
- CMS-0057-F, Interoperability and Prior Authorization Final Rule, 89 FR 8758 (42 CFR Parts 422, 431, 435, 438, 440, 457).
- Employee Retirement Income Security Act of 1974, Pub. L. 93-406, 29 U.S.C. § 1002 et seq.
- HIPAA Security Rule, 45 CFR § 164.312.
- American Medical Association, prior authorization physician survey, fielded late 2024, published April 2025. Used as a published benchmark, not as DeskGate field measurement.
- U.S. Department of Labor / ETA, O*NET OnLine, SOC 43-6013.00, 29-2072.00, 43-9041.00, 43-3021.00 (CC BY 4.0).
Appendix: synthetic specimens
The showcase pages and the proof film use two synthetic patients. Neither is a real person, and no live patient data appears anywhere on this site.
- Medical path
- Elena Vargas. Meloxicam failure, CPT 97110, denial UM-PA-14.
- Dental path
- Daniel Okafor. Stage III periodontitis, CDT D4341 ×2, 5–7 mm probing depths, 30–40% bone loss. The X-ray upload box is named and left for the coordinator.
Client runtime: deskgate-operator-2.6.8-public (MIT). Terms: Master Terms.