Healthcare has become one of the most active testbeds for AI agents. In a single week of January 2026, OpenAI launched ChatGPT Health and Anthropic launched Claude for Healthcare. Ambient scribes such as Microsoft’s Dragon Copilot are generating clinical notes in production. The 2025 CAQH Index found that more than half of health plans and a quarter of provider organizations now use AI somewhere in their workflows.
But these agents are descending on infrastructure that wasn’t made for autonomous, real-time decision-making. Data is distributed across EMRs, payers, and regional systems; policies exist in aging documents and legacy rules engines; and context about prior interactions is often trapped in a siloed format like HL7, CCDA or a proprietary interface.
With all of this in mind, it has become clear that AI agents can act faster than the underlying systems can coordinate, govern or fully understand their actions.
Why Healthcare Is an Early Example of Agent-Driven Workflows
It’s well-documented that healthcare is slow-moving and complex to modernize, for a variety of factors. That’s also why it’s such a compelling early example of agent-driven workflows in the enterprise.
On the clinical and front-office side, we already see specialized agents emerging:
- Multiple services help triage patient information and route people toward the right diagnosis or care pathway.
- ChatGPT and OpenAI’s health-specialized models are being used in medical settings to process clinical information and support diagnosis and decision-making, using models trained on medical data and tuned for compliance.
- Microsoft’s healthcare-focused Copilots and ambient scribes can listen to the clinician–patient conversation (with proper consent) and automatically generate notes for the medical record.
Each of these agents dramatically shorten tasks that previously took days or weeks into something near-instant.
But those impressive front-end gains come with a harsh reality on the back end: healthcare data flows are still often driven by faxes, paper files, legacy HL7 interfaces, and organization-specific standards. It’s not surprising that is where the tension shows up most clearly.
Prior Authorization: A Case Study in Structural Limits
The 2025 AMA Prior Authorization Physician Survey found physicians complete an average of 40 prior authorizations per week, that practices spend 13 hours a week on them, and that 95% of physicians report the process delays patient care. More than one in four – 26% – say it has led to a serious adverse event for a patient in their care.
The flow behind those numbers is largely unchanged: a provider sends a request, often by fax; a payer matches it against policy, formulary and clinical criteria; a decision returns after several rounds of exchange. Weeks can pass.
Regulators have moved. Under the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), impacted payers – Medicare Advantage organizations, Medicaid and CHIP plans, and QHP issuers on federally facilitated exchanges – must return expedited decisions within 72 hours and standard decisions within seven calendar days as of January 1, 2026, and must stand up Prior Authorization, Provider Access and Payer-to-Payer APIs by January 1, 2027. The required standard is HL7 FHIR R4.0.1 with US Core STU 3.1.1; the Da Vinci implementation guides are recommended.
Agent-based prior authorization is the obvious response: agents that read payer policy repositories, assemble FHIR payloads and return structured decisions, compressing weeks into minutes. Put an agent on the provider side too and the two can negotiate directly – a policy-aware dialogue rather than an exchange of static forms. It is a better design. It is also where the foundations start to show.
Why Interoperability Standards Aren’t Enough
Interoperability regulations and standards are critical enablers, not complete solutions.
On the regulatory side, we see:
- Rules in the U.S. pushing for standardized APIs and FHIR-based exchanges.
- European efforts like the EU AI Act and European Health Data Space (EHDS) to govern AI and data sharing across borders.
- National initiatives such as Australia’s My Health Record, which focus on patient-controlled health records and sharing.
On the technical standards side, we have:
- FHIR conversations across organizations.
- Legacy HL7, ADT flows and CCDA documents within and between systems.
- Enterprise agent interoperability mechanisms like MCP and healthcare-specific variants such as FHIR MCP servers.
- Integration layers that must translate between HL7, CCDA, X12 and FHIR to create canonical models.
You have to remember that agents don’t just move data; they make decisions based on data, policy and history. When those elements are fragmented, standards alone can’t guarantee that two agents truly share the same understanding of the patient, the policy or the context.
HHS OIG reviewed a week of Medicare Advantage prior authorization denials and found just 13% met Medicare coverage rules. The causes were not transport failures. Plans applied internal clinical criteria not contained in Medicare rules, requiring an X-ray before advanced imaging, for instance – and denied requests as inadequately documented when reviewers found the records sufficient. A June 2026 OIG report found plans overturned 95% of appealed skilled nursing facility denials, while only 18% of denials were ever appealed.
That is the failure mode agents inherit. A conformant API can deliver a perfectly valid FHIR bundle into a decision process governed by criteria that were never published, never encoded and never visible to the requesting side. Automating that exchange does not resolve the disagreement. It scales it.
Governance Now Depends on Identity, Audit and Context
As agents take on more responsibility, governance must be embedded into the way they authenticate, access and act on data. We think in terms of the four A’s of identity for agents:
- Administration: Who creates, configures, and manages these agents? What are their roles and capabilities?
- Authentication: How do we prove an agent is who it claims to be—whether it’s acting on behalf of a doctor, a patient, or a payer system?
- Authorization: What data and operations is each agent allowed to access? How do we enforce that an agent only sees the records its principal is permitted to see?
- Audit: Can we reconstruct what an agent did, what data it touched, and why it made specific decisions?
In healthcare, this goes hand-in-hand with consent management. If a doctor interacts with an agent that queries downstream systems, that agent must only pull data that the doctor is authorized to see. If a patient uses an agent to explore their own record, the agent must be constrained to that patient’s data alone.
Without robust identity and audit across systems, you have powerful agents operating with limited oversight; exactly the kind of risk regulators are trying to avoid.
Missing Context Undermines Decisions
Even when you have identity and APIs in place, missing context can undermine clinical and operational decisions.
Consider prior authorization again. An isolated request might say: “Approve medication X for a patient with asthma.” A traditional system will look at current coverage and recent prescriptions and decide.
But if you maintain a living context graph that accumulates the full history of prior authorization requests, decisions, substitutions and clinical notes, you can reason differently:
- Two months ago, a similar request was denied with a specific rationale.
- One month ago, an alternative drug was approved due to a comorbidity.
- The patient has a pattern of prior reactions or adherence issues that should influence today’s choice.
Agents that operate with access to this graph can make more consistent and explainable decisions because they’re reasoning over an evolving map of interactions as opposed to querying a snapshot of records.
Researchers examined 275,860 Medicare admission–readmission pairs and found 14.3% of beneficiaries underwent repeat imaging during a readmission. Readmissions to a different hospital carried higher odds than same-hospital readmissions, and participation in a shared health information exchange did not help: pairs connected through the same HIE showed roughly 6% higher odds, pairs across different HIEs about 8% higher. The pipe existed. The context did not arrive in a form anyone used.
It’s great that we’ve built agents that can respond in real time, but many healthcare organizations still lack the unified, graph-like context needed to support those decisions safely and fairly.
Closing the Gap: From APIs to Agentic Fabric
This new paradigm requires more than individual tools. It calls for a full agentic fabric:
- API, AI, and LLM gateways to connect agents to systems of record.
- Integration platforms that can translate HL7, CCDA, X12, and other formats into FHIR and other canonical models.
- Identity platforms that extend user identity concepts to agent identity and consent.
- Agent management to govern lifecycle, behavior, and policies across many agents.
- Healthcare-specific accelerators that embed standards and best practices so teams start 60–70% of the way to a solution instead of building from scratch.
Healthcare is showing us that AI agents stress-test the foundations of interoperability and governance. Organizations that invest time and resources into fully understanding context, identity and agentic fabric put themselves in the best position for real system-wide transformation.
About Mifan Careem
Mifan Careem is the SVP and General Manager at WSO2. Based in New York, he heads the customer technical interactions and technical selling at WSO2, leading the global Solutions Architecture team and working closely with customers and internal teams in mapping WSO2 technology to customer domains.
Reference:
