priorauth.indocs

The release gate

The single most important control in the platform, and the one every other control exists to protect.

#What is always gated

  • Any transmission to a payer - submit, update, void.
  • Attaching an authorization to an appointment as a referral.
  • Any clinical assertion written into a chart.
  • Any adverse determination, communicated or acted on.

#What a release is

Not a permission. A single-use token bound to a content hash.

javascript
const g = gw.invoke(principal, 'submit_service_review', { serviceReview });
// g.pending === 'human_release'
// g.gateId  === the token

gw.release(g.gateId, 'dr-smith');    // a named, licensed human

gw.invoke(principal, 'submit_service_review', { serviceReview }, { releaseToken: g.gateId });
// ok — the payload hash matches what was approved

gw.invoke(principal, 'submit_service_review', { serviceReview: somethingElse }, { releaseToken: g.gateId });
// refused: payload_changed

#Four properties

Single-use
A token is consumed on use. It cannot authorise a second transmission.
Payload-bound
Bound to a canonical hash of exactly what was shown to the human. Approving one request does not authorise a similar one, even one differing by a single field.
Expiring
A release that sits unused goes stale. An approval from yesterday is not an approval today, because the clinical picture it was based on has moved.
Attributed
The releasing human is named in the audit record, along with what they released and when. "The system approved it" is never an available answer.

#Who may release

Releasing a clinical determination requires a role with canReleaseClinical. That is a property of the person's licensure, not of their seniority or their permissions - a manager with every atom in the catalog still cannot release one.

#The cost

This is genuinely slower than full automation, and it is the reason the product cannot promise zero-touch prior authorization. What it buys is that no patient is ever affected by an action nobody chose to take, and that every consequential act has a name attached to it when somebody asks later.