AI in cashless pre-authorisation: the audit trail insurers and hospitals should keep

The short answer

Picture a family at the billing desk, told their cashless request was declined, asking why. If an AI tool helped make that call in minutes, someone must be able to show what it read, which rule applied and who said no. Keep that trail for every pre-authorisation, not just the disputed ones.

When AI helps with a cashless pre-authorisation in India, on the hospital side, at a TPA or at the insurer, each request should leave a record of: what was submitted and from which documents; what the AI extracted or suggested; which rule or policy clause applied; which person approved, queried or denied it, and when; and every hand-off through NHCX or the insurer’s portal with its timestamp. IRDAI’s master circular asks insurers to decide cashless requests “immediately but not more than one hour” after the request, and to give final discharge authorisation within three hours.¹ A fast decision with no trail is hard to defend when a patient, hospital or regulator asks why.

This is about records, not about which treatments should be covered.

The clock and the scale

The one-hour clock drives automation. At least one large TPA reports doing this at scale: Medi Assist’s August 2026 investor presentation says its platforms “enabled more than 186k pre-authorizations (admissions) in under 5 minutes”, as of 30 June 2026.² That’s a company’s own figure for its own platforms; we haven’t checked it.

Volume also moves to a shared rail. The government built the National Health Claims Exchange under ABDM as a gateway for claim information among insurers, TPAs, providers and others; by 21 July 2024, 34 insurers and TPAs were live on it and about 300 hospitals were ramping up to send claims.³ The PIB’s 2026 backgrounder describes NHCX as a digital highway for claims-related information among payers, providers, beneficiaries, regulators and observers.⁵

Where AI sits in a cashless request

Each row is a place where an automated step can be wrong in a way that looks right: a misread sum insured, an extracted procedure that doesn’t match the notes, a suggested denial approved in seconds.

The records, step by step

The decide row matters most. If the AI suggests and a person decides, keep both. If the AI’s suggestion and the human decision always match and the approval takes two seconds, that pattern is worth knowing about.

Under the DPDP Rules, data fiduciaries must keep the logs the Rules list for one year⁶; insurers will also have their own regulatory retention periods. Set retention with your legal team, not from a single rule.

NHCX adds structure, not a full trail

NHCX helps. The ABDM FHIR guide’s NHCX profiles cover the cashless flow, including eligibility checks, pre-auth requests, claims, payment notification and status checks, with Claim, ClaimResponse, CoverageEligibility, InsurancePlan and Task bundles.⁴ Structured bundles mean the request and response are machine-readable on both sides.

But the exchange carries messages; it doesn’t record the reasoning inside each organisation. Who at the TPA approved, which rule applied, what the AI suggested: those stay inside the hospital, the TPA and the insurer. Each party needs its own records.

The same limit applies to tools like ours. Deedglass sits inside the hospital and doesn’t talk to the NHCX gateway, so the exchange’s acknowledgement and the payer’s callback are outside it; it records what the hospital’s agents did with them and timestamps each step that passes through it, without measuring end-to-end turnaround.⁷

Five questions the records must answer

If a pre-authorisation is disputed, the records should answer, without anyone’s memory:

1. What was asked for? The exact request, as sent.
2. What did the AI do? Fields extracted, suggestion made, model and version.
3. Who decided? A named person, the time, and whether they changed the AI’s suggestion.
4. On what basis? The policy version and clause behind the outcome.
5. When did each step happen? Enough timestamps to show the one-hour and three-hour clocks.¹

A useful test: give the records for ten random requests to someone who wasn’t involved and ask them to answer all five. Where they can’t, there’s a gap.

Our open draft spec’s examples include a synthetic NHCX pre-authorisation under an ABDM consent artefact with two approvers and a matching read-back.⁸ The spec page shows the record.

Questions people ask

Does IRDAI require AI decisions to be recorded?

The circular we cite sets decision timelines.¹ It doesn’t address AI specifically. Records are how you show the timelines were met and who decided.

Does using NHCX give us an audit trail?

It gives structured messages and references.⁴ Each organisation still needs its own record of how it reached its decision.

Should AI ever deny a pre-authorisation alone?

We’d keep a named person on every denial, with the reason tied to a policy clause. That’s a design choice each insurer makes; the records should show whichever choice you made.

For more on India’s rails, see our white paper and the insurer page. To try approvals and read-backs on a real database in your browser, open the playground; to grade what an agent can reach on your own machine, run npx deedglass scan (the grade, explained).

Written with AI assistance and checked against our claims register.