In-House AI Prior Auth vs Outsourced Vendor: The 3-Curve Test for RCM Leaders

TLDR: The in-house AI prior auth vs outsourced vendor decision used to be a labor arbitrage question, and AI has broken that arithmetic. The repetitive, high-volume tasks that justified outsourcing prior authorization and denial follow-up are the same tasks AI handles first, which means the vendor's historic margin and the AI's first wins now sit on identical work. The 3-Curve Test (labor, variance, control) tells you which pieces to bring back, which to leave with a vendor, and what AI cannot do for either side without clean data and clinical documentation.

Best For: VP or SVP Revenue Cycle and Directors of RCM or Payer Operations at US provider, laboratory, and diagnostics enterprises with 1,000 to 15,000 employees who have a prior authorization or denials vendor contract coming up for renewal.

In-house AI prior auth vs outsourced vendor is a sourcing decision about who should run the authorization and denial work that payers force on a provider, and the decision rests on where the labor cost of that work now sits. For twenty years the answer was obvious: outsource it, because the work was people on phones and portals, and a vendor could do that cheaper. AI changes the shape of the work rather than just the price of it. The tasks a vendor priced on headcount are the first tasks AI absorbs, while the tasks AI still cannot do depend on documentation and payer history that only the provider holds. The math did not shift at the margins. The variable that drove it moved to the other side of the table.

Why the Old Outsourcing Math Worked

The old RCM outsourcing math worked because prior authorization and denial follow-up were almost pure labor, and labor was the one input a vendor could reliably deliver cheaper. A provider traded margin for predictability: a per-transaction or per-FTE price, offshore or near-shore staffing, and relief from recruiting into roles that turned over constantly. The vendor's margin came from doing repetitive work at scale.

The labor volume behind that trade is well documented. The AMA's 2025 prior authorization physician survey found that physicians and their staff handle about 40 prior authorizations per physician per week and spend roughly 13 hours a week on them, and that 40% of physicians employ staff dedicated exclusively to the task. Multiply that across a 5,000-employee health system or a national laboratory and you have a department, not a side activity.

The Three Reasons Providers Outsourced

The first reason was recruiting. A 2022 HFMA Pulse survey of 411 CFOs and revenue cycle leaders found 57% of health systems carrying more than 100 open positions, and one in four finance leaders said they needed to hire more than 20 people just to staff the revenue cycle. The second was variability: authorization volume spikes with payer policy changes, and a vendor can flex staff that a provider cannot. The third was that nobody wanted to own it. Prior authorization is a cost center that exists because payers require it, and leadership was happy to push it outside the building.

What the Vendor Was Actually Selling

Underneath the service description, the vendor sold three things: hands to do the data entry and portal work, a process that was documented because someone had to train offshore staff on it, and the ability to be blamed. Only the first of those is labor. The second is a workflow asset. The third is political. Keep that split in mind, because AI changes the price of the first, does nothing to the second, and makes the third more expensive.

In-House AI Prior Auth vs Outsourced Vendor: What Actually Changed in the Math

In-house AI prior auth vs outsourced vendor changed because AI collapses the labor curve on exactly the tasks the vendor priced on headcount: eligibility checks, payer rule lookup, form population, status polling, and first-draft appeal assembly. Priced out line by line, those tasks are usually 70 to 80% of a vendor's billable effort. When the per-transaction labor on them approaches zero, the price has to be justified by something other than hands, and most contracts were never written that way.

The adoption data says the shift has started, unevenly. The 2025 CAQH Index, drawn from 600 provider organizations and health plans covering 63% of insured lives, reports that fully electronic prior authorization rose from 31% to 40% of medical transactions in two years, while total medical transaction volume climbed 10%. Volume is rising faster than staffing ever could, which is why the labor model was always going to break.

The Tasks AI Absorbs First Are the Tasks You Outsourced

Look at any prior authorization workflow and sort the steps by how repetitive they are. Checking whether a CPT code needs authorization for a given payer and plan is a lookup. Pulling demographics, ordering provider, and diagnosis codes into a payer portal is form population. Polling a portal every morning to see whether a pended request moved is status checking. Those are the steps a vendor staffed with twenty people. They are also the steps where early deployments show the clearest results. Cleveland Clinic's automated prior authorization retrieval program, launched in April 2024, reported that 27% of prescriptions submitted through it were auto-approved and that staff time per authorization fell from a 15 to 20 minute baseline to a fraction of that.

Why Vendors Are Rebundling Instead of Repricing

Vendors can see this too, and the response has been to bundle AI into the same contract rather than reprice the labor out of it. Black Book's Q2 2025 survey of 320 hospitals and health systems found 87% of revenue cycle leaders now expect AI-driven automation inside standard service agreements, and 85% are reassessing or restructuring their outsourcing agreements. The telling number is the 68% exploring hybrid models where the vendor's people work inside the provider's own AI platform. That is the market admitting the labor and the software can be split, and that the software might belong to the provider.

What Did Not Change

The parts of the work that AI does not touch are the parts that were never about labor. Clinical judgment on whether a service meets a payer's medical necessity policy did not get cheaper. Escalating a wrongly pended case to a payer medical director did not get cheaper. Reading a payer's new policy bulletin and deciding what it means for your order patterns did not get cheaper. Those were always a small fraction of the hours and a large fraction of the value, and they still are.

The 3-Curve Test: A Scoring Model for Build vs Vendor by Task

The 3-Curve Test is a scoring model that evaluates each prior authorization or denial task on three independent curves before deciding whether it belongs in-house with AI, with a vendor, or with a vendor working inside your systems. The labor curve asks how much of the task's cost is repetitive human effort. The variance curve asks how much payer-specific exception handling it carries. The control curve asks whether the data the task depends on sits inside your walls.

Why score tasks instead of the whole function? Because "prior authorization" is not one thing. A single payer's workflow contains a dozen steps with different shapes, and the outsourcing decision that is right for one step is wrong for the next. Scoring each on three curves produces a map instead of a verdict.

Curve 1: The Labor Curve

Score each task 1 to 5 on how much of its cost is repetitive human effort that follows a rule. Eligibility verification, authorization requirement lookup, form population, portal status polling, and documentation attachment all score 4 or 5. Peer-to-peer scheduling and clinical escalation score 1 or 2. High labor scores are where AI collapses cost first, and therefore where a vendor's labor-based price is most exposed. These are also the tasks where you should expect the fastest measurable result if you bring them in, because the baseline is easy to count: minutes per transaction, transactions per FTE per day.

Curve 2: The Variance Curve

Score each task 1 to 5 on how much payer-by-payer exception handling it requires. Submitting a standard imaging authorization to a payer with a published rule set scores low. Handling a request for additional information from a payer whose documentation requirements change quarterly scores high. Variance is where vendors still earn an honest margin, because they see the same payer's behavior across many clients and can staff around its quirks. Kodiak Solutions' 2024 denial data from more than 2,100 hospitals shows the pattern moving: authorization-related denials fell 7.7% while medical necessity denials rose 5% and requests for information rose 5.4%. The simple denials are getting solved. The messy ones are growing.

Curve 3: The Control Curve

Score each task 1 to 5 on how much it depends on data that only you hold: the clinical note in your EHR, the ordering physician's history with this payer, your own denial and appeal outcomes by payer and code, your contract terms. High control scores mean a vendor's AI is working with a copy of your data at best, and with whatever their staff keyed in at worst. Experian Health's 2025 State of Claims survey found that missing or inaccurate data is the leading cause of denials at 50%, followed by authorizations at 35% and registration errors at 32%. Every one of those causes originates inside the provider, before any vendor sees the claim. A vendor cannot fix data it does not control.

Reading the Score

The sequencing rule that falls out of the table: bring in-house first the tasks that score 4 or 5 on labor, 3 or lower on variance, and 4 or 5 on control. That is where AI's advantage, your data advantage, and the vendor's exposure all point the same way. Leave with a vendor the tasks that score high on variance and low on control, because that is where their cross-client view beats your single-payer sample. Anything scoring 5 on control stays inside your walls regardless of who runs the software.

Where AI Cannot Help Either Side Without Clean Data

AI cannot help in-house teams or vendors with prior authorization when the clinical documentation is missing, the order data is wrong, or the payer policy is unpublished, because every one of its useful functions depends on reading a correct input and matching it against a known rule. AI drafting an appeal from a thin chart produces a thin appeal faster. AI checking an authorization requirement against last quarter's payer rules produces a confident wrong answer.

The honest limits are the same on both sides of the build-vs-vendor decision. Vendors rarely say so. The 3-column map of what AI can and cannot fix in claim denials covers the general case. For sourcing specifically, three limits decide the question.

Missing Clinical Documentation

An authorization is a clinical argument. If the ordering physician's note does not establish medical necessity in the payer's terms, nothing downstream saves it. A vendor's AI sees the note only if you send it, and vendors routinely work from the order and demographics alone. The Premier analysis of 2022 claims found roughly 15% of claims to private payers initially denied and 54.3% of those eventually overturned, often after multiple appeal rounds. A denial that is overturned on appeal is a denial that should never have happened, and most of those trace to documentation that existed but was never attached.

Fragmented Order and Registration Data

Experian's data above puts registration and data errors ahead of authorization as a denial cause. Those errors occur at scheduling and intake, in systems a vendor never touches. If your order data is fragmented across an EHR, a laboratory information system, and three payer portals, AI applied at the vendor's end is cleaning up after a process that is broken at your end. The 4-handoff test for fragmented RCM workflows explains why automation on a fragmented flow multiplies the fragmentation. The sourcing version of that argument: do not move AI into a vendor's hands when the data problem is in yours.

Unpublished or Shifting Payer Policy

Payer policy is the one input neither side controls. Here the vendor's cross-client view is a real asset, and the CMS Interoperability and Prior Authorization final rule will change its value. The CMS rule requires Medicare Advantage, Medicaid, CHIP, and exchange plans to decide expedited requests within 72 hours and standard requests within seven days starting in 2026, and to expose a prior authorization API that lists covered services, documentation requirements, and specific denial reasons by January 1, 2027. Once documentation requirements are machine-readable from the payer, the vendor's hard-won knowledge of each payer's quirks becomes a lookup anyone's AI can perform. The variance curve flattens for the covered payers, and the case for keeping those payers' work outsourced weakens with it.

How to Compare In-House AI Prior Auth vs Outsourced Vendor on Your Own Numbers

Comparing in-house AI prior auth vs outsourced vendor fairly requires one baseline that both options are measured against, built from your own data rather than the vendor's reporting, because vendor-entered outcome data cannot be used to evaluate the vendor. The baseline has five fields per payer and task: transactions per month, minutes of human effort per transaction, first-pass approval rate, days from order to authorization decision, and write-off attributable to authorization failure.

The reason to insist on this is that most RCM leaders cannot currently answer "what did the vendor save us" with a number they built. The HFMA and XIFIN analysis of outpatient RCM outsourcing found that organizations outsourcing outpatient revenue cycle were generally satisfied, yet about a quarter reported outcomes below their objectives for process optimization, operational efficiency, and technology alignment, and the functions respondents said remained unaddressed were denials and appeals management, prior authorization, and payer relations. Satisfied and unmeasured turn out to be compatible.

Build the Baseline Before You Talk to Anyone

Pull the five fields from your own systems for the last twelve months, one payer at a time, starting with the two or three payers that account for most of your authorization volume. Do not accept the vendor's dashboard as the source. If the data does not exist for a field, that absence is itself a finding: it tells you the task has been running without a measure, which is the condition under which outsourcing decisions get made on anecdote. The general build-versus-buy framework for AI agents applies here, with one adjustment: in RCM the "buy" option usually comes bundled with people, so you are pricing labor and software together whether you want to or not.

Run One Payer Through Both Paths

Pick one high-volume payer with a published rule set and run its authorization work two ways for a quarter: the vendor as today, and an in-house flow with AI handling the lookup, population, and polling steps and your own staff reviewing documentation before submission. Measure the same five fields on both. A one-payer pilot is small enough that the vendor contract does not have to change yet and large enough to produce a number the CFO will believe. The New York appeals study published in JAMA Internal Medicine in 2026, which found overturn rates on appealed denials rising from about 38% in 2019 to nearly 53% in 2025 across 51,000 cases, is the kind of external benchmark to set your own appeal outcomes against. If your overturn rate is far below that, the problem is documentation and prioritization, and the sourcing model is secondary.

For a diagnostics or laboratory enterprise whose cash position depends on authorizations clearing before the specimen is run, and whose vendor contract has made it dependent on someone else's queue for its own revenue, a generic approach is not enough. The answer is a dedicated build that does three things: it checks authorization requirements and documentation sufficiency at the point of order rather than after service, it holds the payer-by-payer outcome data in the provider's own systems so every denial improves the next submission, and it routes only the variance-heavy exceptions to human reviewers or a vendor, with the handoff logged. Anything short of that reproduces the dependency with a different logo on it.

What the Transition Actually Costs You

Bringing work in-house is not free of risk, and the honest accounting includes it. You take on recruiting for the reviewer roles, you own the payer portal credentials and their maintenance, and you lose the ability to blame someone else for a bad quarter. Experian's survey found 43% of providers understaffed, which is the constraint that pushed work out in the first place. The answer is not to pretend that constraint vanished. It is to notice that the roles you need in-house after AI are fewer and different: clinical documentation reviewers and payer escalation specialists, not twenty portal clerks. The in-house versus external AI capability framework covers the general staffing trade; the RCM-specific version is that the headcount you repatriate should be the judgment roles, not the labor roles.

Common Objections From Revenue Cycle Leaders

Revenue cycle leaders raise three objections to repatriating prior authorization work with AI, and each one is partly right. The first is that the vendor already has AI, so there is nothing to gain. The second is that the organization cannot staff an in-house team. The third is that the board will hear "AI" and assume the current process is fixed. The responses below take each on its own terms.

"Our Vendor Already Uses AI, So We Get the Benefit Anyway"

You get the vendor's benefit. Their margin improves. Whether the price falls is a contract question, and 85% of health systems in the Black Book survey are renegotiating precisely because it did not fall automatically. More to the point, the vendor's AI runs on the data you send them. If that excludes the clinical note and your historical outcomes by payer, their AI is working with less than yours would. Ask the vendor two questions: what share of your authorizations now complete without a human touching them, and what the per-transaction price did when that share rose. If they can answer the first and not the second, the AI benefit stayed with them.

"We Cannot Hire for This; That Is Why We Outsourced"

True for the labor roles, and that is exactly the work AI removes. The in-house team after AI is a handful of clinical documentation reviewers and one or two payer escalation specialists per major payer, not a floor of clerks. Those are harder roles to fill than portal staff, but you need far fewer of them, and they are the roles that produce the overturns. The 4-layer modernization test for legacy RCM systems describes what the systems side of that smaller team needs in order to function.

"If We Say AI, the Board Will Think the Denials Problem Is Solved"

It will, unless you present the limits alongside the plan. The way to do that is to show the board the three curves, point to the tasks where AI changes the cost and the tasks where it does not, and attach the baseline you built. McKinsey's analysis of US healthcare administration put administrative activity at roughly a quarter of total healthcare spending and estimated 28% of that could be removed through simplification, most of it by fixing the processes between payers and providers rather than by automating them as they stand. A 2023 NBER working paper by Sahni, Stein, Zemmel, and Cutler estimated wider AI adoption could save 5 to 10% of US healthcare spending, and listed denials management as one use case among many, not the whole answer. Bring those ranges to the board, and the conversation shifts from "is it solved" to "which part did we just change."

What to Do Before the Contract Renews

Before a prior authorization or denials vendor contract renews, an RCM leader should score every task in scope on the 3-Curve Test, build a five-field baseline from internal data for the top three payers, and run a one-payer pilot that compares the vendor path to an in-house AI path on identical measures. Those three steps fit in a quarter, and they change the renewal from a price negotiation into a scope negotiation.

The scope negotiation is the real prize. KFF's analysis of marketplace plan data found insurers denied nearly one in five in-network claims in 2023, and the reasons were poorly reported in public data. The provider that holds its own authorization and denial outcomes by payer is the only party in the transaction that can see the full pattern, and that visibility is the asset AI needs. Keep it. Contract for the variance. Build for the labor and the control.

This analysis was developed using methodologies and operating experience from Assembly.

Frequently Asked Questions

What does in-house AI prior auth vs outsourced vendor actually mean for a revenue cycle team?

In-house AI prior auth vs outsourced vendor is the sourcing decision about who runs authorization and denial work once AI can perform the repetitive steps. In-house means the provider's own systems and staff handle lookups, form population, and documentation checks with AI support. Outsourced means a vendor supplies the people and software. The question is which tasks belong where.

Why did providers outsource prior authorization in the first place?

Providers outsourced prior authorization because it was labor-intensive, hard to staff, and politically unwanted. The AMA's 2025 survey found practices handle about 40 authorizations per physician weekly and spend roughly 13 hours on them. Vendors offered cheaper, flexible staffing for work nobody inside the organization wanted to own.

Which prior authorization tasks does AI handle first?

AI handles the rule-following, high-volume tasks first: authorization requirement lookup, eligibility checks, populating payer forms from the order, polling portals for status, and assembling first-draft appeals from existing documentation. These score highest on the labor curve of the 3-Curve Test and are exactly the tasks vendors priced on headcount, which is why vendor contracts are being renegotiated.

What is the 3-Curve Test for build vs vendor in RCM?

The 3-Curve Test scores each prior authorization task on three independent dimensions: the labor curve (how much cost is repetitive human effort), the variance curve (how much payer-specific exception handling it carries), and the control curve (whether the data it depends on sits inside the provider). Tasks high on labor and control and low on variance come in-house first.

What should stay with an outsourced RCM vendor after AI?

Tasks that score high on variance and low on control should stay with a vendor. Payer policy monitoring, responses to unusual information requests from payers you rarely bill, and escalations for low-volume payers benefit from a vendor's cross-client view. Kodiak's 2024 data shows medical necessity and information-request denials growing, which is where that view still earns its margin.

What can AI not do for prior authorization without clean data?

AI cannot establish medical necessity that the clinical note does not support, correct order data that was wrong at intake, or apply payer rules that are unpublished. Experian's 2025 State of Claims survey found 50% of denials trace to missing or inaccurate data created before any vendor or AI sees the claim. Fix the input or the output stays wrong.

How does the CMS prior authorization rule change the outsourcing decision?

The CMS rule flattens the variance curve for covered payers. From 2026, Medicare Advantage, Medicaid, CHIP, and exchange plans must decide urgent requests within 72 hours and standard ones within seven days, and by 2027 publish documentation requirements and denial reasons through an API, per the CMS fact sheet. Payer quirks become lookups, so outsourcing those payers matters less.

How do you compare a vendor's AI results to an in-house build fairly?

A fair comparison uses one baseline built from the provider's own data, never the vendor's dashboard. Record five fields per payer and task: monthly transactions, human minutes per transaction, first-pass approval rate, days from order to decision, and write-off from authorization failure. Run one payer through both paths for a quarter and measure identically.

Is a hybrid model where vendor staff use the provider's AI platform a good option?

A hybrid model is a reasonable middle step when the provider owns the platform and the data. Black Book's Q2 2025 survey found 68% of health systems exploring exactly this. It works when the outcome data lands in your systems and the vendor supplies variance handling. It fails when the vendor's platform holds your history.

What roles does an in-house prior authorization team need after AI?

An in-house team after AI needs clinical documentation reviewers and payer escalation specialists, not portal clerks. AI removes the lookup, population, and polling labor. What remains is judgment: deciding whether a note supports necessity, and arguing a pended case with a payer. These roles are harder to recruit but far fewer, which changes the staffing objection that drove outsourcing.

How long does a one-payer pilot comparing in-house AI to a vendor take?

A one-payer pilot takes one quarter to produce a defensible comparison. Choose a high-volume payer with published rules, run its authorization work through the vendor and through an in-house AI flow with reviewer sign-off, and measure the same five baseline fields on both. A quarter gives enough volume for the numbers to settle into something the CFO accepts.

What is the biggest mistake RCM leaders make in the build vs vendor decision?

The biggest mistake is deciding for the whole function instead of task by task. Prior authorization contains a dozen steps with different labor, variance, and control profiles, and a single verdict gets most of them wrong. Scoring each task on the 3-Curve Test produces a map: some steps come in-house immediately, some stay outsourced, and some run as a hybrid.

Why are vendors bundling AI into existing contracts rather than cutting prices?

Vendors bundle AI to protect margin as the labor they priced disappears. Black Book found 87% of revenue cycle leaders expect AI inside standard agreements and 85% are restructuring contracts. Ask what share of authorizations now complete without a human touch and what happened to the per-transaction price. If only the first number exists, the benefit stayed with the vendor.

Does bringing prior authorization in-house fix the denial rate?

Bringing prior authorization in-house does not by itself fix the denial rate, because most denials originate in documentation and intake data. The Premier analysis found about 15% of private-payer claims initially denied and 54.3% later overturned. Sourcing determines who does the work. Documentation and data quality determine whether it succeeds.

How does the in-house vs vendor decision differ for a laboratory or diagnostics company?

For a laboratory or diagnostics enterprise, the decision is sharper because service often precedes authorization and cash flow depends on it clearing. Vendor dependency means someone else's queue controls your revenue timing. The strongest case for an in-house build is checking requirements and documentation at the point of order, before the specimen runs, with payer outcomes kept in-house.

What should a VP of Revenue Cycle do before the vendor contract renews?

Before renewal, score every in-scope task on the 3-Curve Test, build a five-field baseline from internal data for the top three payers, and run a one-payer pilot comparing both paths. Those steps fit in one quarter and turn the renewal from a price negotiation into a scope negotiation, where labor and control tasks come in-house and variance tasks stay contracted.