Every consequential determination
should withstand independent review.
A determination built to survive review.
A synthetic case, running end to end: the clock start reconciled across channels, the model assembling coverage criteria and documentation, the boundary it cannot cross, a licensed clinician’s signature, and the seal that makes the whole thing re-checkable.
The order is the argument. The model work scrolls past as input; the screen settles on what a plan has to be able to produce when it says no.
What independent review requires, captured at decision time.
The determination carries the policy, evidence, authority, timing, and provenance needed for appeals, regulatory review, clinical quality, and accountable operations.
- When the clock started
- Reconciled across every intake channel, not asserted. A fax lands before the portal receipt and the X12 timestamp disagrees with both — the record names which one governed, under which approved timing rule, and replays how the deadline was computed. CMS-0057-F attaches its penalty to the deadline, so the deadline has to be as defensible as the decision.
- Who decided
- The reviewing clinician, their specialty, and a verified license — bound into the record, not attached to it.
- Under which policy
- The exact policy version in force on the date of service. Not today's policy. The one that governed the decision.
- On what evidence
- The chart excerpts, criteria results, and documents that were in front of the reviewer at signature time.
- What the model did
- Assembly and recommendation, logged as decision support. The agent cannot issue a determination — that path does not exist in the code.
- Proof it is unaltered
- Ed25519 over canonical JSON, folded into a hash chain. Re-checkable offline, with no call back to us.
The signature is the easy part. The hard part — and the reason this is a platform rather than a feature — is reconstructing the state of knowledge at the moment of the decision: what was true, and what was known to be true, on that date. HealthNext keeps two time axes over the whole operations graph so that question has an answer.
Don’t take the green check on faith.
Every determination seals to an Ed25519-signed record. Press Verify this record and the same cryptographic check our public verifier runs executes in your browser — no network, no call back to us, no trust required.
Then press Tamper with it. One field changes and the signature fails, naming the field that broke. A check that cannot fail is decoration.
The receipt is proof, not data. Its body carries the shape of the decision — never the member behind it. The proof leaves your boundary; the record never does.
or re-check the identical record at the neutral public verifier →- Decision
- MN criteria met · held for clinician sign-off
- Human gate
- held · no auto-approval
- PHI egress
- 0 bytes · model reasoned in-boundary
- Policy
- HNX-UM-MSK-014
- Boundary
- in-tenant
- Member
- DEMO-MBR-0000 (synthetic)
press verify to run the check in your browser
California SB-1120
In forceA medical-necessity determination must be made by a licensed physician or licensed health care professional competent to evaluate the specific clinical issues; an AI tool may not deny, delay, or modify care based on medical necessity.
CMS-0057-F — PA metrics
Reporting begins 2026Impacted payers publish de-identified aggregate prior-authorization metrics, including denial rates and reasons.
CMS-0057-F — FHIR PAS API
Generally beginning January 1, 2027Impacted payers must implement a standards-based FHIR Prior Authorization API for non-drug items and services; denial responses must include a specific reason.
Independent-review readiness
Operating requirementA review-ready system can establish who reviewed what, when, against which policy, and whether the record has remained intact since signature.
Reference implementation and deployment architecture
The interactive reference illustrates a Da Vinci-aware queue, decision timers, CRD/DTR/PAS orchestration, clinician signature gates, an evidence spine, and X12 278 output using synthetic cases.
Payer connectivity and workload boundaries are scoped per engagement. The production architecture establishes identity, data, model, integration, and evidence controls with the client, then validates them against the agreed release gate.