Week 1 Field Guide

Part A · Week 1

Operations, RCM & ROI

Diagnose where money leaks, read the data flows, and build a business case a CFO will sign.

1 · Strategic context Metrics Prior auth Coding CMS-0057-F 2 · Architecture 3 · ROI 4 · Drills

Strategic Context: diagnose the workflow

Revenue cycle, end to end

RCM turns a patient encounter into collected cash. Split it into three segments. Each has different owners, systems and failure modes, and the split is the first thing you draw for any client. Your job is to find where an error originates, not just the department that eventually works it.

Origin ≠ where it's worked. Errors are created on the front end and paid for on the back end. Prevention needs cross-department change, which is why clients default to fixing the back end.

Claims lifecycle: rejection vs denial

Know this distinction cold. Clients blur it, and their denial metrics become meaningless.

Concept	Definition	Consultant question
Rejection	Claim not accepted for adjudication; usually a front-end or clearinghouse edit.	What failed validation, and can it be corrected and resubmitted?
Denial	Claim adjudicated, but payment refused in whole or in part.	What is the reason, appeal path, recovery probability and cost to work it?
Prevention vs recovery	Prevention stops the error upstream; recovery works it after denial.	Where did it originate, and who owns the process change?
Common causes	Eligibility, authorization, medical necessity, coding, missing information, timely filing, duplicates, coordination of benefits.	Can volume and dollars be quantified by payer, reason, site and workflow?

Denials management: the funnel

Directional benchmarks (verify against HFMA, MGMA, Kodiak or Premier before a client deck): initial denial rates around 10–15% and rising; more than half of denials often never reworked; rework at roughly $25 per physician claim and far more for complex hospital claims; most denials preventable at the source.

Denial management is a cost center; denial prevention is a margin lever. Most AI vendors sell appeal automation, which sits at the expensive end of this funnel.

RCM metrics: define them before you quote them

Every metric needs a numerator, a denominator, a time window, and a statement of whether it is measured by claim count or by dollars. Two executives quoting different denial rates are usually using different definitions. HFMA's MAP Keys standardize many of these; use them when the client has no house definitions.

Metric	Typical definition	What to challenge
Initial denial rate	Claims (or $) denied on first adjudication ÷ claims (or $) adjudicated	Count or dollars? Rejections mixed in? Partial denials included?
Final denial rate	$ written off to denials after all appeals ÷ total $ (or net revenue)	This is the money actually lost; initial rate is the workload
Clean claim rate	Claims passing all edits on first submission without manual touch ÷ claims submitted	Measured before or after the scrubber's auto-fixes?
Net collection rate	Payments ÷ (charges − contractual adjustments)	Are denial write-offs hidden inside "contractuals"?
Days in A/R	Total A/R ÷ average daily net revenue	Gross or net? Credit balances netted out?
Cost-to-collect	Total RCM cost (staff, vendors, tech) ÷ cash collected	Which costs are in the numerator? Outsourcing often left out
Appeal overturn rate	Appeals won ÷ appeals adjudicated	High rates can mean only easy cases get appealed
DNFB	$ (or days) of discharged accounts not yet final billed	Coding backlog vs documentation holds vs edits
Avoidable write-offs	Write-offs from preventable causes (eligibility, auth, timely filing)	Who classifies "avoidable," and with what rules?
Cash acceleration	Change in days-to-cash × average daily revenue	One-time working capital, never recurring savings
Cost per claim / chart	Fully loaded cost of a workflow ÷ units processed	Needed to price rework and to test labor ROI
Override / rework rate	AI outputs changed or rejected by humans ÷ AI outputs	The adoption and quality signal for any AI tool

Prior authorization workflow

Four cost buckets: provider staff time; delayed or abandoned care; payer clinical-review cost; and auth-related denials (missing, expired, or mismatched to the billed code).

Medical coding touchpoints

Coding touches revenue at concurrent CDI queries (patient still in house), final coding (DRG for inpatient, APC/CPT for outpatient and professional), pre-bill edits, denial root causes (coding and medical-necessity mismatches), audits (RAC, internal, payer) and HCC risk adjustment for Medicare Advantage and value-based contracts. Under-coding leaks revenue quietly; over-coding creates False Claims Act exposure. AI in coding comes in three risk tiers:

Low risk

Coder assist

AI suggests, human decides. Easiest to approve, smallest labor ROI.

High ROI · high risk

Autonomous coding

For simple encounter types: radiology, ED E/M, labs. Needs a compliance audit before scale; exposure if it upcodes systematically.

Often the fastest yes

Coding integrity & audit

AI checks human work. Compliance teams like it because humans still own the code.

CMS-0057-F: what's live, what's next

The Interoperability and Prior Authorization Final Rule, released January 17, 2024. Impacted payers are Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and QHP issuers on the federal exchanges. Employer plans are not covered, traditional Medicare fee-for-service is not an impacted payer, and drugs were explicitly excluded.

Nuance that separates you from a vendor deck: the 72-hour/7-day decision timeframes apply to MA, Medicaid and CHIP; QHP issuers on the federal exchanges are not held to those timeframes, though they carry other requirements. Exact dates also vary by payer type. Verify applicability against official CMS material before client use, and treat 0062-P as proposed until it is finalized.

Obligated party

The rule regulates payers

Providers have no compliance obligation under 0057-F, but they capture much of the value through faster decisions, clearer denial reasons and electronic submission.

Dependency

Value depends on payer readiness

A provider gains nothing from e-PA with a payer whose PAS endpoint isn't live or works poorly. Always ask: which of this client's payers are ready, and what's the fallback?

Hidden lever

Public reporting is pressure

Payers must publish approval and denial rates. That's reputational pressure, and evidence for managed care contract negotiations.

Architecture & Integration: data literacy

You don't need to implement every interface. You do need to know what data is needed, where it originates, which dependency can block value, and where AI plugs in. Draw this for a CIO.

Workflow	Standards / transactions	Possible AI insertion	Data question to ask
Registration / eligibility	HL7 v2 ADT; X12 270/271	Insurance discovery; coverage-error detection	Can eligibility, registration and claim be linked?
Prior authorization	X12 278; FHIR Da Vinci CRD/DTR/PAS; CDS Hooks	Auth-required prediction; clinical packet prep (GenAI/RAG); status agents	Which payers expose working APIs? What's the fallback?
Documentation / coding	HL7 v2 ORU/MDM; FHIR DocumentReference; ICD-10-CM, CPT/HCPCS	CDI suggestions; coder assist; coding integrity audit; autonomous coding	Are note, order, charge and code linked, with provenance?
Charge capture	HL7 v2 DFT; chargemaster	Missed-charge detection	What is the source of truth, and who audits it?
Claim submission	X12 837P/837I; 999; 277CA	Pre-submit denial-risk scoring and edits	Can rejections be separated from adjudicated denials?
Status / remit	X12 276/277; 835 CARC/RARC	Status agents; remit variance (underpayment) detection	Can 835 outcomes be joined to the original 837 and access data?
Denials / appeals	835, payer letters, medical records, payer policy documents	Root-cause classification; worklist prioritization; appeal drafting with retrieval	Are sources current, traceable and permitted for this use?

You'll go deep on each in Weeks 2 onward. For now: HL7 v2 runs inside the hospital, X12 runs between provider and payer, and FHIR is the modern API layer that CMS-0057-F mandates.

Principle 1

The 835 is the diagnostic gold mine

Join 835 denial codes to the original 837, registration and authorization records to prove where money is lost. If the client can't link these reliably, data readiness is the first project, before any model selection.

Principle 2

AI outside the workflow dies

A denial score on a separate dashboard gets ignored. Value appears when output lands in the EHR or PM work queue at the moment of decision, which is why SMART on FHIR and CDS Hooks matter.

Principle 3

Sequence by payer readiness

Build the e-PA roadmap payer by payer, starting where the client's volume meets a payer with a working endpoint.

Executive Perspective: build a defensible business case

The five value levers

Lever	How to quantify	Caution	CFO reaction
1 · Net revenue recovery / avoided write-offs	Prevented or recovered dollars × recovery probability, at expected reimbursement	Gross charges are not collectible allowed amounts. Avoid double counting.	Biggest number, hardest to attribute
2 · Cost-to-collect / labor capacity	Hours avoided × loaded labor cost	Capacity created is not cash saved unless cost is removed or growth absorbs it	Believable; triggers workforce talks
3 · Cash acceleration	Change in days-to-cash × average daily revenue	One-time working capital. Never show it as recurring savings.	Classic junior-consultant error
4 · Risk avoidance	Expected exposure reduction where defensible (audit recoupments, 0057-F penalties, Stars)	Don't invent precise value for uncertain risk	Hard to quantify, often decisive
5 · Clinical & experience	Time saved, care delays avoided, validated burden or safety outcomes	Don't monetize without evidence and an agreed method	Strong board story, rarely funds alone

The formula

Annual net value = addressable annual volume × realistic improvement × value per outcome + validated operating savings − annual run costs

Payback = (one-time implementation + change costs) ÷ monthly net benefit once benefits are stable

Add the ramp-up period to payback. A tool that pays back in 3 months of steady state but takes 6 months to reach steady state pays back around month 9.

Worked example, base case

$1.5B NPR system, 1.2M claims a year, 11% initial denial rate = 132,000 denials. Auth-related = 25% = 33,000. An "auth required + auth/claim match" check prevents 30% in year one (realistic, not a vendor's 70%) = 9,900 prevented denials.

Correction from the first version of this guide

The earlier example valued each prevented denial at a $2,800 "average claim value." That fails a sanity check: $1.5B NPR ÷ 1.2M claims is about $1,250 of net revenue per claim. Auth-required services (imaging, procedures, infusions) do pay above average, so the example now uses $1,800 expected net reimbursement, which is the allowed amount you'd actually collect, not the charge. The old figure overstated value by more than half. Always reconcile per-unit value back to NPR.

Read the shape: over 90% of gross value is write-off avoidance, not labor. The 65% of prevented denials that would have been recovered anyway produce cash acceleration, which is one-time and deliberately left out of the annual figure. Payback: $1.2M one-time ÷ $0.46M a month at steady state ≈ 2.6 months, plus ramp-up.

The full cost stack

Vendors quote the license. You quote everything. Illustrative figures for the base case:

One-time	$M
Implementation & integration	0.50
Data remediation (837/835/auth linking)	0.30
Security, privacy & legal review	0.10
Training & change management	0.30
Total one-time	1.20

Annual run	$M
License & model inference	0.80
Evaluation & monitoring	0.15
Human review of exceptions (2 FTE)	0.15
Support, vendor & model changes	0.10
Total annual run	1.20

Always run scenarios

Show conservative, base and optimistic cases, then state what must be true for the case to work.

Driver	Conservative	Base	Optimistic
Auth-related share of denials (addressable)	20%	25%	30%
Share prevented in year one	20%	30%	40%
Prevented denials	5,280	9,900	15,840
Share that would never have been recovered	25%	35%	40%
Expected net reimbursement per claim	$1,500	$1,800	$2,000
Write-off avoided ($M)	1.98	6.24	12.67
Rework saved at $45 ($M)	0.24	0.45	0.71
Annual run cost ($M)	−1.40	−1.20	−1.10
Net annual value ($M)	0.82	5.48	12.28

What must be true: the case rests on prevention rate and the unrecoverable share. Run cost barely matters. So your first validation work is measuring how many auth denials Lakeshore-type clients actually lose today, not negotiating the license.

Vendor ROI red flags

No agreed baseline, or a baseline the vendor measured.
Unclear numerator and denominator ("40% fewer denials" of what?).
No comparison group, so seasonality and payer policy changes get credited to AI.
40–70% gains claimed without evidence on this client's data and payer mix.
Benefits counted twice, e.g. prevented denials and also appeal wins on the same claims.
One-time cash release shown as recurring savings.
Gross charges used as the value of a recovered claim.

Executive tradeoffs to surface

Tradeoff	Side A	Side B
Prevention vs recovery	Appeals show results within a quarter	Prevention is worth more but needs front-end change across owners
Augment vs automate	Safer, faster approval, humans stay accountable	Bigger ROI, bigger compliance and clinical exposure
Buy vs build vs EHR-native	EHR-native: integrated, generic, "free-ish"	Point solution: sharper, adds integration debt and a BAA
Redeploy vs reduce labor	Capacity for growth, easier adoption	FTE cuts trigger HR, union and offshore per-FTE contract issues
Payer–provider asymmetry	Payer calls automated review "efficiency"	Providers and regulators call it "AI-driven denials"

Assumptions to challenge in every meeting

"Our denial rate is X%." By claim count or dollars? Initial or final? Rejections included?
"The vendor showed 40% improvement." Against what baseline, on whose data, with what payer mix?
"AI will fix prior auth." Payers require the auths. AI makes the process cheaper; only payer policy removes the work.

Consulting Challenge: practice drills

Short, ungraded drills that build toward the graded Lakeshore capstone in Part D.

Drill 1 · 20 min

Draw encounter-to-cash from memory. For each of the eight denial categories, mark the segment where it originates and name the upstream owner.

Drill 2 · 20 min

For each workflow row in the architecture table, write the one transaction you'd ask the client to export first, and why.

Drill 3 · 30 min

Rebuild the base-case ROI from scratch for a $900M NPR system with 700,000 claims and a 12% denial rate. Reconcile your value per claim to NPR first. Then say which two drivers you'd validate before showing it to a CFO.

Part B · Week 1B

AI Opportunity Assessment

Technique selection, prioritization matrix and risk gate, build vs buy vs EHR-native, vendor diligence and contracts, stakeholder mapping, and discovery.

1 · Strategic context 2 · AI ladder Sourcing Vendors Diligence 3 · Prioritization Stakeholders Discovery 4 · Drills

Strategic Context

Week 1 showed where money is lost. Week 1B is how you decide what to do about it, in a way that survives a CFO, a Chief Compliance Officer and a skeptical VP of Revenue Cycle in the same room. Most healthcare AI programs fail before any technology is deployed, in one of four ways:

Failure 1

Wrong problem

A vendor demo chosen over a P&L leak.

Fix: prioritization matrix

Failure 2

Wrong technique

GenAI for something a rules engine solves.

Fix: the AI ladder

Failure 3

Wrong sourcing

A custom build where the EHR already has the feature.

Fix: build / buy / EHR-native / hybrid

Failure 4

Wrong room

The signer engaged, the adopters ignored.

Fix: stakeholder map

Architecture & Integration

Select the lowest-complexity approach that solves the problem

Rules, predictive ML, GenAI and agents are rungs of a ladder. Each step up adds capability, cost and governance burden. Climb only when the lower rung fails.

Agentic isn't a fifth technology. It's GenAI plus tools, permissions and autonomy, and the risk comes from the autonomy, not the model. An agent submitting 2,000 corrected claims a night at a 3% error rate sends 60 bad claims a night, and payers notice before you do.

Decision table: the four approaches side by side

Dimension	Rules / workflow	Predictive ML	GenAI / LLM + RAG	Agentic AI
Best suited to	Known, explicit, stable logic	Estimating a probability from labeled historical outcomes	Reading, summarizing, classifying or drafting language	Multi-step goals across tools, within bounded permissions
RCM example	Hold the claim when the auth number is missing for payer X; NCCI and payer edits	Pre-submission denial-risk score; auth-required prediction; missed-charge detection	Summarize a payer policy; draft an appeal grounded in chart evidence; classify denial letters	Check portal status, gather evidence, update the work queue, escalate exceptions
Data needed	Payer rules, edit libraries, fee schedules	Labeled history: 837 joined to 835 outcomes and auth records	Notes, letters, policy documents, a maintained retrieval index	Everything GenAI needs, plus system access and credentials
Explainability	Full	Moderate (feature drivers)	Low to moderate; needs citations	Low unless every action is logged
Failure modes	Rules go stale when payers change policy	Drift, bias, poor calibration by payer or population	Hallucinated facts, codes or citations; stale sources; PHI exposure	Compounding errors; unauthorized actions at scale
Controls	Version rules; monitor exceptions; an owner per payer rule set	Validate by payer and population; recalibrate; drift alerts	Provenance and citations; source freshness checks; human sign-off on external content	Least privilege; action limits; approvals; full logs; kill switch
Cost profile	Lowest; maintenance labor	Build or buy, plus monitoring	Per-use inference plus retrieval upkeep	Inference × steps, plus integration and oversight
Governance burden (Part C tiers)	Low · Tier 1	Medium · Tier 1–2	High · Tier 2	Highest · Tier 3

Selection test: walk the questions in order

Ask yourself	If yes	If no
Is the logic known and deterministic?	Start with rules or workflow automation. Many RCM "AI opportunities" are really payer-rule maintenance problems.	Continue.
Must we estimate an outcome from historical examples?	Assess predictive ML, and check data and label readiness (is the 837 joined to the 835?).	Continue.
Is the core task understanding or generating language?	Assess an LLM; add retrieval (RAG) when the source knowledge changes, like payer policies.	Don't force GenAI.
Must the system take multiple actions across tools?	Consider an agent only after permissions, limits and failure controls are defined.	Prefer a simpler workflow.

Consultant rule

Eligibility transactions and deterministic edits are often better solved by standard integration and rules than by an LLM. Use GenAI when language understanding or generation adds value. Use autonomy only when multi-step action is necessary and bounded.

Build vs Buy vs EHR-native vs Hybrid

Providers rarely build models; they build data foundations. Payers build more often, because UM, risk adjustment and fraud logic are core to how they compete.

Criterion	EHR-native	Buy	Build / partner	Hybrid
Best fit	Adequate capability already fits workflow and controls	Specialized need with credible evidence and faster time to value	Unique workflow or data asset justifies ownership	Buy model/platform; own data, workflow, governance, evaluation
Workflow fit	Best, in the work queue	Depends on APIs and EHR cooperation	You own all integration	Depends on integration layer
Time to value	Fast if feature exists	Medium	Slowest	Medium
Differentiation	None: every client gets it	Moderate	Highest if data is unique	Moderate to high
BAA / governance	Lowest, existing contracts	New vendor, BAA, security review	Full model risk on you	Shared; needs clear boundaries
Viability risk	Low	Real in a consolidating market	Key-person and talent risk	Lower if layers are swappable
Key questions	What exists now, what's licensed, what's on the roadmap?	Comparable outcomes? BAA and data terms? SLAs, exit, portability?	Who maintains it? Lifecycle cost, talent, evaluation burden?	Can layers be replaced without rebuilding?

Check the EHR roadmap before buying

If the EHR vendor will ship a "good enough" version within 12–18 months, negotiate a short point-solution contract or wait. This is live in 2026: PitchBook warns that EHR giants like Epic, ambient-scribe vendors and analytics players are bolting RCM onto platforms they already own.

Healthcare AI vendor landscape

Know the categories; names and owners change fast. Verify every name before it goes into a client deliverable, and don't try to memorize the whole market.

Ambient documentation sits mid-cycle because its notes feed coding and CDI downstream.

Signal

Consolidation is fast

Innovaccer's CaduceusHealth deal (May 2026) was the 19th RCM acquisition of the year, after 55 in 2025. Experity bought Exdion in July 2026, and a $12B Ensemble acquisition was announced.

Signal

Investors doubt the outsourcing model

PitchBook projects US RCM industry profits could fall about 22% by 2030 as cost-to-collect compresses from 4–5% toward under 1%.

So what

For your client

Make vendor viability a selection criterion, plan for a mid-contract acquisition, and use mispriced outsourcing contracts as negotiation leverage.

Vendor due diligence

Area	Questions to ask	Red flag
Evidence	What baseline, comparison group, timeframe, payer mix and outcome definition support the claim? Can results be independently validated on our data?	Case studies only; no client-data pilot offered
Data & model changes	Can our PHI be used for training? Who are the subprocessors? How are model changes tested, announced and rolled back?	"We continuously improve the model" with no change notice
Security & audit	Access controls, encryption, retention and deletion, audit logs, incident response times. SOC 2 / HITRUST status?	No per-output audit trail
Commercial terms	Total cost, minimum commitment, SLA measured on our data, renewal terms, exit rights, data portability, outcome-based pricing against our baseline	Savings share calculated on the vendor's baseline
Vendor viability	Who owns the product? Runway? What happens if it's acquired or discontinued? Can workflows and data migrate?	No escrow or transition assistance

Contract considerations

Diligence tells you whether to buy. The contract decides whether the value survives the first renewal. Bring this list to Procurement and Legal before the term sheet.

Term	What to require	Why it matters
Data-use rights	No training on client PHI without explicit written consent; deletion on exit, with certification	PHI used outside its purpose is a HIPAA and reputational risk
Model-change notification	Advance notice of material model changes and the right to revalidate before they reach production	The model you validated in April may not be the one running in October
Performance SLA on your data	Accuracy and turnaround measured on a client sample, with service credits or exit if missed	Vendor benchmarks don't transfer to your payer mix
Outcome-based pricing	Fees tied to a baseline the client controls, a written attribution method, and caps	Stops you paying for seasonality or payer policy changes
Audit & logging	Per-output audit trail; access for Compliance and external auditors	Your False Claims Act defense depends on showing what the tool did
BAA & security	BAA, subprocessor list with change notice, breach notification timelines, SOC 2 / HITRUST evidence	Required for PHI; subprocessors are where leaks happen
Liability & indemnity	Allocation for coding errors or overpayments caused by the tool	Otherwise the hospital carries 100% of the overbilling risk
Term vs EHR roadmap	Short initial term, or an opt-out if the EHR ships an equivalent feature	Avoids paying twice for the same capability
Change of control	Termination right and price protection if the vendor is acquired	Likely in a market with 19+ RCM deals by May 2026
Exit & portability	Export of data, configurations and prompts in usable formats; transition assistance; escrow where relevant	Prevents lock-in and stranded workflows
Outsourcing contracts	Move from per-FTE to per-outcome or per-unit pricing, with a benchmarking clause at renewal	A per-FTE vendor loses revenue when automation works, so it has no reason to automate

Executive Perspective

AI use case prioritization matrix

Agree criteria and weights with the executive sponsor, in writing, before scoring. Scores are decision aids, not objective truth.

Dimension	Weight	A high score means
Value: financial impact	40%	Material, attributable impact on net revenue, cost-to-collect or capacity
Value: strategic / regulatory urgency	30%	Time-sensitive obligation (0057-F, audits, staffing) or key strategic dependency
Value: speed to measurable benefit	30%	Baseline and outcome can be measured in a realistic timeframe
Feasibility: data readiness	35%	Data exists, is accessible, linkable and usable
Feasibility: integration complexity	25%	Lower complexity, manageable dependencies (scored inverted)
Feasibility: workflow fit	25%	Output lands where users make the decision
Feasibility: solution maturity	15%	Credible evidence and ability to evaluate in context

Risk is a gate, not a score

Could an error affect care, coverage or payment? Could it enable upcoding? Is a named human accountable for each output? Are PHI use, auditability, rollback and incident response defined? If not, redesign, constrain or defer. A high-value use case with an unmitigated risk doesn't get averaged into the middle.

The weights are political. Whoever sets them decides the outcome. Without written agreement up front, every stakeholder relitigates when their project lands in "fill-in."

Stakeholder mapping

The person who signs the contract is rarely the person who decides whether value gets realized.

Bottom-right is where projects die quietly. Patient Access owns most prevention levers and is usually left out. Placement is illustrative; redraw it for each client.

Stakeholder	Cares about	Fears	Discovery focus
CFO	Net revenue, payback, cost-to-collect	AI spend with no P&L result	Which metric must move, by how much, by when?
VP Revenue Cycle	Denials, throughput, A/R days	Losing control; blamed for vendor failure	Show the denial workflow from receipt to closure; where is time spent?
Patient Access Director	Registration accuracy, staffing	Front end blamed for back-end denials	Where are errors created, and what tools do registrars use?
HIM / Coding Director	Accuracy, DNFB, audit results	Autonomous coding as staff replacement	Who validates AI output? What audit sample?
CIO / CMIO / EHR team	Integration, architecture, roadmap	Tool sprawl, shadow AI	Can records be linked? What native capability exists or is planned?
Compliance / Legal	False Claims Act, audit trail	AI upcoding; unreviewed AI content to payers	Who approves use? What must a human review?
CISO / Privacy	PHI, BAAs, data flows	Vendor breach; PHI used for training	What data may leave the boundary?
Managed Care / Contracting	Contract terms, payer relationships	Losing leverage	Which payers drive denials? Denial data is negotiating evidence.
CHRO / Labor relations	Workforce stability, unions	Layoff headlines	How will freed capacity be redeployed?
Frontline staff	Workload, usability, job security	Being measured against a machine	What changes in daily work?
AI Governance Committee	Policy, risk tiering	An unreviewed AI incident	Which risk tier, and what approval path?

Consulting move

For each initiative, name the sponsor, owner, adopters, gatekeepers and likely blocker. Meet the blocker first. Payer-side maps differ: CMO and UM leadership, Medical Policy, Stars and quality, Member Experience, Compliance (owns 0057-F), Provider Relations.

Executive discovery questions

Ask questions that reveal what the client hasn't quantified. The full bank:

Strategy · CEO, CFO

If this succeeds, which number on your monthly operating report moves, and by how much in 12 months?
Margin, growth capacity, or burnout relief? Rank them.
What AI have you tried, and why did it stall?

Financial baseline

Denials for 12 months by CARC, payer and dollars, initial and final.
How much denial write-off was never worked at all?
Cost-to-collect, and what's in the numerator?

Data · CIO, CMIO

Can you join a claim's 837, 835, registration, auth and clinical record today? How long would it take?
How many AI tools are live, and who approved each?
What's on the EHR's 18-month AI roadmap that overlaps?

Workflow · Ops

Walk me through the moment a claim is denied: who, which system, how long?
Where do staff work outside the EHR: portals, spreadsheets, fax? Who owns exceptions?

Risk · Compliance

What's the policy on AI content sent to a payer or patient without human review?
Who is accountable if an AI-suggested code causes an overpayment?

Sourcing · Procurement

How are outsourcing contracts priced, and when do they renew? What approvals apply to new vendors?

Listen for gaps between answers. If the CFO says the denial rate is 8% and the VP Revenue Cycle says 13%, your first deliverable is a single agreed denial definition and baseline.

Consulting Challenge: practice drills

Drill 4 · 30 min

Take three AI pitches from vendor websites. For each, name the rung it really sits on, the rung it should sit on, and the control you'd require.

Drill 5 · 30 min

Score three use cases with the matrix. Then change one weight by 10 points and see whether the top pick changes. If it does, that's the conversation to have with the sponsor.

Drill 6 · 20 min

Run the due diligence table against one real vendor's public materials. List what you could answer and what you'd have to ask for.

Part C

Governance & Evaluation

The regulatory map, NIST AI RMF, ISO 42001, CHAI, the governance lifecycle, risk tiers and go/no-go evaluation.

1 · Strategic context Regulatory map 2 · Frameworks Lifecycle Risk tiers 3 · Evaluation 4 · Drills

Strategic Context: why governance is a value lever

Governance is not paperwork that slows AI down. In healthcare it decides whether a project gets approved at all, and an AI incident (a PHI leak, systematic upcoding, a biased coverage decision) can erase years of ROI in one news cycle. A consultant who arrives with a governance plan gets through Compliance in weeks instead of quarters.

Treat this tab at awareness level for Week 1. NIST AI RMF and ISO 42001 get full modules later. Regulations change: verify current status against primary sources, and bring in counsel for interpretation.

The regulatory map for RCM and operations AI

Rule	What it governs	Why it matters for AI	Consultant question
HIPAA Privacy Rule	Use and disclosure of PHI. Payment and health care operations are permitted uses; the minimum-necessary standard applies.	Most RCM AI fits "payment/operations," but only with the minimum PHI needed for the task	Does this tool need full notes, or only the fields required?
HIPAA Security Rule	Safeguards for electronic PHI; risk analysis	Every AI vendor and data flow belongs in the risk analysis	Is this tool in the latest security risk assessment?
Business Associate Agreements	Vendors that handle PHI on the covered entity's behalf	BAA plus data-use terms decide whether PHI can train vendor models	Does the BAA forbid training on our PHI? Which subprocessors?
De-identification	Safe Harbor or Expert Determination methods	Model training and evaluation sets often need de-identified data	Which method, and who certified it?
42 CFR Part 2	Substance use disorder treatment records	Stricter than HIPAA; the 2024 rule moved closer to HIPAA, but records still need segmentation and consent handling	Can the AI see Part 2 data, and is it tagged?
State privacy laws	Health data protections beyond HIPAA (e.g., Washington's My Health My Data Act)	Can apply to data and entities HIPAA doesn't cover	Which states do we operate in, and what do they add?
21st Century Cures Act: information blocking	Prohibits unreasonable interference with access to electronic health information	Affects vendor contracts and data-sharing restrictions	Do any terms restrict EHI access in ways that could count as blocking?
ONC HTI-1: decision support interventions	Transparency requirements for predictive decision support in certified health IT	EHR-native AI must expose source attributes; useful evidence when evaluating it	What source attributes does the EHR publish for this model?
FDA: SaMD and clinical decision support	Software with a medical purpose can be a regulated device	Pure RCM tools are typically not devices; clinical-purpose functions may be	Does any function diagnose, treat, or drive clinical decisions?
ACA Section 1557 (45 CFR 92.210)	Nondiscrimination in patient care decision support tools	Covered entities must identify and mitigate discrimination risk in such tools	Have we tested performance across patient groups?
CMS MA rule on algorithms (CMS-4201-F)	Medicare Advantage coverage decisions	Algorithms can assist, but medical necessity decisions must reflect the individual patient's circumstances	Payer side: where does a human make the coverage call?
State AI-in-UM laws (e.g., California SB 1120)	Use of AI in utilization review	Licensed clinicians must make medical-necessity denial decisions	Which states restrict automated UM decisions?
False Claims Act & OIG guidance	Billing integrity; overpayments must be reported and returned (60-day rule)	AI coding errors at scale become systematic overbilling	What audit sample catches systematic AI coding drift?

Architecture & Integration: frameworks and operating model

NIST AI RMF, ISO/IEC 42001 and CHAI

NIST also publishes a Generative AI Profile (NIST AI 600-1) that maps GenAI-specific risks such as confabulation and data privacy onto these functions.

Risk framework

NIST AI RMF

Voluntary US framework. Use it as the shared vocabulary for risk conversations with Compliance and the board.

Management system

ISO/IEC 42001:2023

A certifiable AI management system standard (plan-do-check-act). Ask vendors whether they're certified or pursuing it; it's becoming a diligence signal.

Healthcare-specific

CHAI

The Coalition for Health AI publishes assurance guidance and an applied model card format. Useful when you need healthcare-specific evaluation language.

The AI governance lifecycle

Risk tiering: match governance effort to impact

Tier names are illustrative; each client defines its own. The point is that the same committee shouldn't spend equal time on a worklist sorter and an autonomous coder.

Executive Perspective: evaluation and go/no-go

Executives will ask one question: "How do we know it works, and how will we know if it stops working?" Answer with an evaluation plan before contract signature.

What to measure	Why	Example threshold to agree
Representative test data	Vendor demos use clean cases. Test on your payer mix, sites and hard cases.	Stratified sample of 1,000+ recent claims or charts
Task accuracy / success	The core quality measure: correct code, correct auth call, appeal accepted	Coding agreement with auditors ≥ the human coder baseline
Hallucination & citation checks	GenAI must cite real chart evidence and current payer policy	Zero fabricated citations in the audit sample
Subgroup performance	Bias by payer, site, language or patient group (Section 1557)	No subgroup more than X points below the overall rate
Human override & escalation rate	The adoption signal: rising overrides mean distrust or drift	Alert if overrides rise above baseline for 2 weeks
Latency	Output must arrive before the decision is made	Auth check returns before scheduling confirms
Cost per output	Inference costs scale with volume and can surprise the business case	Within the run-cost line of the ROI model
Incidents & ongoing monitoring	Drift after payer policy changes or vendor model updates	Monthly review; revalidate on any model change

Define who owns go/no-go

A named executive, not a committee, signs off on each tier 2–4 deployment against the agreed thresholds. "Who is accountable" is the question Compliance will ask first, and the one most AI proposals can't answer.

Consulting Challenge: practice drill

Drill 7 · 30 min

Pick GenAI appeal drafting. Assign it a risk tier. Then write five rows of a risk checklist: risk, NIST function, control, owner, and evidence you'd show Compliance.

Part D

Study Plan & Graded Capstone

The 10-hour plan, what to master and defer, the graded Lakeshore capstone, pass criteria and the exit test.

Study plan Master vs defer Capstone Pass criteria Exit test

A practical 10-hour Week 1 study plan

Session	Learn	Practice / build	Time
1	RCM lifecycle, rejections vs denials, root causes, metrics	Drill 1: draw encounter-to-cash; list root causes and upstream owners	1.5 h
2	Prior auth, coding, CMS-0057-F, X12, HL7 v2 and FHIR overview	Drill 2: map transactions to workflow, data owner and AI insertion point	1.5 h
3	Rules vs ML vs GenAI/RAG vs agents	Drill 4: classify vendor pitches; defend the simplest viable approach	1.5 h
4	Value/feasibility scoring, risk gate, sourcing, vendor landscape	Drill 5 and 6: score use cases, draft a sourcing matrix, run diligence	1.5 h
5	ROI mechanics, cost stack, scenarios, RCM KPIs	Drill 3: rebuild the ROI with scenarios, assumptions and time to value	1.5 h
6	Stakeholders, discovery, governance, evaluation	Drill 7: draft discovery questions, data request list and risk checklist	1.0 h
7	Synthesis	Complete the Lakeshore capstone; rehearse a 90-second pitch	1.5 h
Total			10.0 h

Master this week, defer the rest

Master

Business workflow and root-cause thinking
Clear RCM metric definitions and the ability to challenge baselines
Rules / ML / GenAI / agentic selection logic
ROI assumptions, scenarios, full costs, sourcing tradeoffs
Discovery questions and stakeholder mapping
Sketching a data flow and naming risk owners
Governance vocabulary: risk tiers, NIST functions, evaluation basics

Defer

Deep-learning math, PyTorch, training models
Building production MCP servers or agent frameworks
Full FHIR implementation, SMART authorization code, detailed X12 parsing
Kubernetes administration
Memorizing the whole vendor market
Legal interpretation beyond awareness; verify primary sources and involve specialists

Graded capstone

This replaces the separate Week 1 and Week 1B challenges with one deliverable that tests everything above. Submit it in chat for a PASS or REVISE REQUIRED before Week 2.

Lakeshore Health · Client brief

The CFO wants a recommendation on a "$30M a year" GenAI appeals proposal within 90 days

Profile

4 hospitals · $2.1B NPR

Initial denial rate

13% by claim count

Cost-to-collect

3.9% (above peers)

Payer mix

Medicare 22 · MA 24 · Medicaid MC 14 · Comm 34 · Self 6

Denials by $

Auth 30 · Med nec 20 · Elig 18 · Coding 14 · Missing 12 · Other 6

Watch out

Offshore AR vendor on per-FTE contract; EHR vendor has an AI roadmap

Tomorrow you have a 45-minute discovery meeting with the CFO and VP Revenue Cycle. Your readout is in three weeks.

Deliverable: a two-page executive recommendation plus a one-page appendix with your numbers.

Challenge the premise. Is GenAI appeals the right first move? What would you ask about the $30M? List your week-one data requests and the evidence that would change your view.
Classify. Assign the lowest workable rung to: eligibility correction, auth-required prediction, GenAI appeals, autonomous ED coding, payer status-check agent, missed-charge detection. One line each. Identify the one that isn't really an AI problem.
Prioritize. Score all six with the matrix and show your weights. For your top three give value lever, KPI, data needed, approach, feasibility and risk-gate result. Name one placement a stakeholder will dispute, and your defense.
Model ROI. For #1: conservative, base and optimistic scenarios; every assumption; full cost stack; timing and ramp; attribution method; what must be true. Reconcile value per claim to NPR.
CMS-0057-F. Which of Lakeshore's payer categories are in scope, who the rule obligates, and why actual payer API readiness matters for your roadmap.
Source. EHR-native vs buy vs build/partner vs hybrid for your top two. Address the EHR roadmap, the per-FTE contract, vendor viability and exit risk.
Govern. Risk tier for #1, the human accountable, and the three evaluation thresholds that decide go/no-go.
Stakeholders and defense. The three most likely blockers of #1, what each fears, and your move. Name the biggest CFO tradeoff, your recommendation, and one measurable 90-day milestone.
Discovery. Adapt the default five-question sequence for tomorrow's meeting given the appeals pitch. What would you change, in what order, and which answer would flip your recommendation?
Pitch. Write the 90-second version you'd say to the CFO in the elevator.

Pass criteria

Diagnosis

Consistent metric definitions (count vs dollars, initial vs final)
Prevention separated from recovery
Rejections separated from denials

Selection

Lowest workable rung chosen
EHR-native treated as a real competitor
Per-FTE contract implication spotted

Value

Conservative, explicit, internally consistent assumptions
One-time cash acceleration not counted as recurring
Full costs and scenarios shown

Governance

Risk treated as a gate
A named human accountable
Correct payer/provider split under 0057-F

Advice

Adopters in the stakeholder analysis, not only signers
Discovery questions only an RCM insider would ask
Clear evidence that would change the recommendation
A skeptical CFO would sign it

Exit test

Can you explain the problem, identify the data required, select a proportionate solution, quantify plausible value, name the risks and their owners, and state what must be validated before committing money? If yes, and your capstone passes, proceed to interoperability in Week 2.