EveryFront

An agentic system that finds every legal front to reduce or erase a medical bill and files the paperwork itself.

Comment

Inspiration

76% of patients who qualify for free hospital charity care never apply - not because they're refused, but because nobody tells them it exists. Under 1% of medical billing denials are ever appealed, and roughly a third of the people who do appeal win. An estimated $14B a year in charity care that hospitals are legally required to provide goes unclaimed.

Those figures come from patient-advocacy and health-policy reporting (Dollar For, KFF, Commonwealth Fund) - we cite them, we didn't derive them.

What we verified ourselves, against primary sources, is the part that made this buildable: a hospital's own charity-care policy is sitting in its public IRS Form 990 Schedule H filing, and its actual cash price for a procedure is sitting in a CMS-mandated machine-readable price file. Nobody has to guess what a patient is owed. The hospital's own regulatory filings already say.

The problem was never a missing database. It's that nobody reads hundreds of thousands of tax filings and cross-checks them against a bill on someone's kitchen table. An agent can.

What it does

A medical bill arrives. Every Front identifies the hospital, determines every legal front on which the bill can be reduced or erased, computes every statutory deadline, fills the real forms, and delivers them - autonomously, across a caseload.

There are four fronts, each a separate legal regime with its own eligibility test, form, and clock:

Front Authority Clock
Charity care 26 CFR 1.501(r)-4, -6 240+ days from the first post-discharge statement, not the service date
Bill vs. estimate (PPDR) 45 CFR 149.620 120 days; delta >= $400 vs the Good Faith Estimate
Debt validation 12 CFR 1006.34 / 15 USC 1692g 30 days from the validation notice
Billing audit 42 USC 1395b-7(b) itemized bill due 30 days after request

The ordering matters and is not obvious: debt validation goes first when a case is in collections, because filing it freezes everything else. Get the sequence wrong and you lose a right.

On a live run: a bill for $2,625.00 resolved to Sutter Bay Hospitals from its own Schedule H filing, screened at 117.1303% of the federal poverty level - under California's 400% statutory floor (Cal. Health & Safety Code 127405(a)(1)(A)) - and the entire balance became erasable. On another case, the billing audit found six findings totalling $1,217.50, including a lab test billed at $140.00 against the hospital's own published cash price of $70.00.

How we built it

The architectural bet: deterministic core, LLM shell. All deadline math, eligibility screening, NCCI unbundling checks and front-selection logic live in packages/rules as pure Python - 575 statements, 222 branches, 100% branch coverage, zero LLM calls anywhere in the package. Every rule cites its regulation and effective date in its docstring, and every result carries an .explain() showing the arithmetic. The models classify, extract and draft. They never compute a deadline.

  • Seven agents in a Google ADK hierarchy on Cloud Run: Reader, Lookup, Clock, Auditor, Strategist, Verifier, Filer.
  • Gemma 4 does first-pass document classification; Gemini 3.7 Flash (Vertex AI) does structured extraction and every agent's narration at temperature 0.
  • Cloud Run (4 services), Pub/Sub event backbone, Firestore for case state and the audit trail, GCS for filled forms.
  • 204 real hospitals seeded to Firestore from IRS Schedule H bulk XML, 201 with a live financial-assistance policy URL. NCCI PTP/MUE tables bundled offline.
  • Human-in-the-loop by construction: POST /cases/{id}/approve_filing gates every filing. Nothing is ever sent without a person clicking approve.
  • 1,008 tests across the repo, run as four separate pytest invocations in CI.

Challenges we ran into

Every serious defect in this project reported success while doing nothing. None crashed. Tests stayed green throughout. Each was found only by deploying and reading the actual bytes.

  • The Reader fabricated data. On an unreadable bill it invented EIN 00-0000000 and epoch dates 1970-01-01, from which the Clock computed deadlines carrying real regulatory citations, and the Filer addressed a letter to "unknown hospital". It now returns hospital_ein: None, marks all four fronts inapplicable with plain reasons, and files nothing.
  • A try/except ImportError hid a real integration for weeks. The Filer rendered placeholder text because its bridge guessed the wrong import path and swallowed the error. The real form-filling code was built and tested the whole time; nothing called it.
  • A lost-update race on fronts[] had three independent causes, not one: non-atomic read-modify-write, re-analysis reopening already-filed fronts, and .set(merge=True) resurrecting purged cases as zombies. Each now has a regression test verified to fail against the pre-fix code.
  • Our acceptance test ran half of itself and exited 0. demo-cycle: demo-reset demo-run demo-reset demo-run - make deduplicates a target's prerequisites, so each phony target ran once. The criterion "the happy path twice in a row" had never actually been verified.
  • And the test guarding it could not fail. It asserted the literal text of the Makefile prerequisite list, so it passed happily while make ran half the phases. A test that cannot fail when the behaviour regresses is not a test. It now expands the recipe with make -n and asserts the phase sequence make will really execute.
  • Vertex serves Gemini 3.x only from location=global. A regional endpoint silently falls back to a model below the hackathon's "3.5 or newer" bar - disqualifying while appearing to work.

What we learned

Trust nothing that hasn't been observed. Not a green test suite, not an agent's report, not a diagram. Two agents once reported contradictory audit results on the same day - both honest, both measuring different deployments.

Honest failure beats silent success. Our rule became: a blocked agent writes BLOCKED: rather than inventing a workaround. That principle is now visible in the product - the Verifier refuses to file when a cat photo is submitted as proof of income, fronts that don't apply say why instead of quietly vanishing, and every simulated send is labelled simulated rather than claiming a delivery it never made.

The gap between "the repo says" and "the deployment does" is where the bugs live. We checked both, every time.

What's next

Mint production fax and mail credentials so filings genuinely leave the building; add authentication before any real patient data touches it; and scale the MRF cash-price cache beyond the 2 of 204 hospitals currently pre-fetched.

Honestly: this is a strong demonstration with a real, verifiable core - not a system to route a real patient's bill through yet. The README says so too.

Built With

Share this project:

Updates

Submission history