AI in Medical Billing: Uses, Limits and Compliance

AI in medical billing mostly means software that reads data and flags or drafts work for people to check: it scrubs claims for errors before they go out, suggests codes from clinical notes, predicts which claims are likely to be denied, and helps with prior authorization, payment posting and patient statements. It can make routine work faster. It doesn't change who is responsible: the practice still answers for every claim it submits, so a person has to review what the tool produces.

What these tools can do varies widely by vendor, and many are new. Before relying on one, a practice needs to know what it was checked against, how its errors are caught, and how it handles patient information under HIPAA.

Where is AI used in medical billing?

• Claim scrubbing. Checking claims against payer rules, NCCI edits, required fields and past denials before submission. Many scrubbers apply fixed rules. Newer tools also look for patterns in the practice's own denial history.
• Coding assistance. Suggesting CPT, HCPCS and ICD-10-CM codes from the clinical note, for a coder or clinician to accept or change.
• Denial prediction and prevention. Flagging claims that look like ones the payer denied before, so someone can fix them before they go out.
• Prior authorization. Finding whether a service needs authorization and assembling the request. Payers use these tools too. In Original Medicare, CMS's WISeR model (January 2026 to December 2031, in six states) uses AI and machine learning, with clinical review, to assess prior authorization requests for a select list of services. CMS says every recommendation not to pay is made by a licensed clinician.
• Payment posting and A/R follow-up. Reading remittances, matching payments to claims and sorting unpaid claims by what needs doing next.
• Patient billing. Drafting statements, reminders and answers to common billing questions.

What are the limits?

• Suggested codes can be wrong in either direction. A tool can miss a service that was documented, or suggest a code, level or modifier the note doesn't support. Coding has to match the documentation, and only a person reading the note can confirm that it does.
• Errors repeat at scale. A person who makes a mistake makes it once. A tool can make the same mistake on every claim of that type until someone notices.
• Tools learn from the past. A model trained on last year's claims doesn't know about this quarter's edit changes or a payer's new policy unless someone updates it.
• The output is only as good as the input. Incomplete registration, eligibility or documentation still produces bad claims, just faster.
• A payer's AI decision is still a payer decision. If a payer's tool contributed to a denial, the payer's usual correction and appeal routes still apply.

Money paid on a wrong claim still has to be returned. Medicare requires a provider that has identified an overpayment to report and return it, generally within 60 days. That applies whether a person or a tool produced the claim.

What does HIPAA require of an AI vendor?

A billing tool that handles patient information for your practice is almost always a business associate under HIPAA. The HIPAA definition names billing, claims processing and data analysis among the functions that make a vendor a business associate, and it includes subcontractors that handle the information for that vendor.

Before any patient information goes into the tool:

• Sign a business associate agreement (BAA). HIPAA requires a written agreement. It must limit how the vendor may use and disclose the information, require safeguards under the Security Rule, require the vendor to report breaches and other improper uses, and bind its subcontractors to the same terms.
• Ask how your data is used. Find out whether the vendor uses your patients' information to train or improve its models, and whether the BAA allows that.
• Send the minimum necessary. HIPAA requires reasonable efforts to limit the information used or disclosed to what the purpose needs.
• Don't paste patient information into a general-purpose AI chatbot that isn't covered by a BAA with your practice.

How do you keep a person in the loop?

• Decide what the tool may do on its own. Flagging a claim or drafting an appeal is low risk. Changing codes or submitting claims without review is not.
• Review the tool's work. Have coders confirm suggested codes against the note, and audit a sample of the tool's output on a schedule, just as you would a new coder's.
• Track its results. Compare denial rates, coding audit findings and rework before and after the tool, using the same definitions. The medical billing KPIs guide defines the common measures.
• Keep your own rules current. Someone still has to follow payer policy changes, quarterly NCCI updates and new codes, and make sure the tool reflects them.

Questions to ask an AI billing vendor

1. Will you sign a BAA, and who are your subcontractors?
2. Do you use our data to train models used for other customers?
3. What does the tool do automatically, and what does it only suggest?
4. How are its suggestions checked against current code sets, NCCI edits and payer policies, and how often is that updated?
5. Can we see why it made each suggestion?
6. How do we audit its output, and what reports do we get?

Is AI worth it for a small practice?

It depends on where your revenue is held up. If most denials come from eligibility and registration errors, fixing the front-desk process may do more than any tool. Find out where claims stall first, then decide whether a tool fixes that step. The medical billing trends guide puts AI alongside the other changes practices are dealing with, and what a clean claim is covers what every claim needs, with or without automation.

If you want to see where your own revenue cycle is losing time before choosing a tool, Highview's revenue cycle management team can start with a free call.

Sources

• eCFR, 45 CFR 160.103: definition of a business associate, including subcontractors.
• eCFR, 45 CFR 164.502: minimum necessary standard; disclosures to business associates and the written agreement.
• eCFR, 45 CFR 164.504(e): what a business associate contract must contain.
• eCFR, 42 CFR 401.305: reporting and returning Medicare overpayments.
• CMS, WISeR (Wasteful and Inappropriate Service Reduction) Model: dates, states, use of AI with clinical review.