# NEW FEATURE!!! manually keying in option where clinician is able to manually key in patients details!

PriorPilot

PriorPilot uses Epic FHIR and AI to analyse patient records and generate prior authorization summaries, reducing manual work while keeping clinicians in control.

Inspiration

Prior authorization is one of the most repetitive, time-consuming parts of getting patients care. Providers have to gather records, review clinical history, and fill out insurer-specific paperwork by hand before treatment can even be approved.

We wanted to explore how an AI agent could take on this preparation work end-to-end without compromising the parts that matter most in healthcare: patient consent, secure data access, clinical accuracy, and clinician oversight.

What it does

PriorPilot automates the preparation of prior authorization requests through a secure, AI-assisted workflow.

Clinicians can choose between two ways to provide clinical information:

Epic FHIR integration: Retrieve available patient records, including medications, conditions, and laboratory results, through a secure, authenticated workflow with patient consent.
Manual data entry: Enter patient and clinical details directly when connected EHR access is unavailable or when clinicians prefer to provide the information themselves.

For EHR-connected workflows, PriorPilot authenticates the user, initiates a CIBA step-up consent flow, and securely obtains short-lived Epic access tokens through Auth0 Token Vault.

Once the clinical information is available, an AI agent drafts a structured prior authorization form and a clinical justification narrative grounded in the supplied or retrieved data. The generated form is validated for required information before proceeding to a simulated insurer portal for submission.

PriorPilot is designed to assist with documentation and administrative preparation, not make clinical decisions. Clinicians remain responsible for reviewing the generated draft before submission.

How we built it

PriorPilot was built using React, TypeScript, and Vite for the frontend, with Node.js and Express powering the backend.

Auth0 handles authentication and brokers short-lived Epic access tokens through Token Vault, while CIBA provides the patient consent step-up flow for EHR-connected workflows.

To make the application more flexible, we also implemented a manual-entry option that allows clinicians to supply patient and clinical details directly instead of relying exclusively on EHR retrieval.

An AI agent built around OpenAI function calling processes the available clinical information and generates a structured prior authorization form alongside a clinical justification narrative. The agent uses a tool-calling loop to retrieve information, process tool results, and assemble the final output.

For submission, we implemented a Playwright-driven headless browser workflow against a simulated insurer portal. Instead of relying on a timer to imitate submission, the automation interacts with the portal, fills in the form, clicks submit, and waits for a confirmation element before capturing the resulting reference number.

Challenges We Ran Into

Agent Loop Function-Calling Sequencing

One of the trickiest challenges was managing OpenAI's function-calling message flow while assembling conversation turns dynamically. The SDK's ChatCompletionMessageParam union did not fully capture the shape of a function-role message when constructing it manually, so we used a more flexible AgentMessage type and relied on the SDK for validation when sending requests.

Tool result messages also needed to include the correct function name and follow the corresponding assistant function call. Incorrect sequencing could cause API errors and interrupt the entire agent loop.

Tool Result Capture Under Pressure

While iterating on the agent, we discovered that calling tools was not enough. Their outputs also needed to be captured correctly in the session cache and used to extract the final form and submission result.

We fixed this by explicitly handling relevant tool names and capturing the resulting artifacts, ensuring that information produced during the agent loop was available to the caller.

JSON Parsing Failures in Function Arguments

OpenAI returns function arguments as strings, which means malformed JSON can interrupt execution. We introduced error handling around JSON parsing and logging to make these failures easier to diagnose during development.

Supporting Different Clinical Data Input Methods

Adding manual entry introduced another consideration: the application needed to support clinical information supplied directly by the user as well as information retrieved through the Epic FHIR integration.

We designed the workflow to accommodate both input methods while retaining the core purpose of generating a structured prior authorization draft from the available information.

Accomplishments We're Proud Of

Real-World Authentication and Consent Flows

The Auth0 Token Vault and CIBA consent flow are implemented for the EHR-connected workflow. Rather than relying on a hardcoded Epic token, the backend communicates with Auth0 to initiate the consent process and obtain a short-lived access token for retrieving clinical data.

We wanted the project to demonstrate the importance of secure data access and patient consent, even in a hackathon prototype.

Flexible Clinical Data Input

PriorPilot supports both Epic FHIR-based retrieval and manual clinical data entry. The integration supports a connected EHR workflow, while manual entry gives clinicians another way to provide patient information when direct EHR access is unavailable or unnecessary.

This makes the application more adaptable to different scenarios without changing its central goal of reducing the administrative burden of prior authorization.

Headless Browser Submission, Not a Timer

We built a Playwright-driven workflow that interacts with a simulated insurer portal, fills out the relevant HTML form, submits the request, and waits for the portal's confirmation element.

This allowed us to demonstrate a more complete workflow than simply generating a document or simulating a submission with a delay.

Clinical Data Grounding

The agent is instructed not to fabricate diagnoses, medication names, or other clinical information. Its justification is based on the information available from retrieved FHIR resources or manually supplied details.

The workflow also validates required fields before submission and identifies missing information rather than intentionally inventing clinical facts to fill gaps.

An End-to-End Prior Authorization Pipeline

We brought together authentication, consent, clinical data handling, AI-assisted form generation, validation, and browser-based submission in one application.

From supplying patient information to generating a prior authorization draft and submitting it to a simulated insurer portal, PriorPilot demonstrates how AI can help streamline administrative work while keeping clinicians in control.

What We Learned

OpenAI Function Calling Requires Careful Validation

The model may request unavailable tools, repeat tool calls, or return malformed JSON. We learned to validate function calls before executing them and to handle errors carefully. The agent's ability to continue reasoning after receiving tool results is powerful, but message sequencing and tool-result handling need to be implemented precisely.

Session State Is Fragile

We cache patient data, medications, and conditions in memory so the agent can reuse them across tool calls. However, interrupted calls or cache issues can cause the agent to lose context and retrieve information again.

We learned to store session data immediately after each successful fetch rather than waiting until the end of the workflow.

Patient Consent Is Non-Negotiable

The CIBA flow adds time because the patient must approve the request. However, we believe that this step should not simply be removed for convenience. Building the consent flow into the EHR-connected workflow reinforced the importance of treating secure access and patient consent as essential parts of healthcare technology.

Flexibility Matters in Healthcare Workflows

Implementing manual data entry alongside Epic FHIR retrieval taught us that a useful healthcare application should accommodate different ways of providing information. Integrations are valuable, but alternative input methods can make a workflow more flexible when connected systems are unavailable or when users need to supply details directly.

Built With

React
TypeScript
Vite
Node.js
Express
Auth0
Auth0 Token Vault
CIBA
Epic FHIR
OpenAI API
Playwright

Try It Out

GitHub Repository: https://github.com/ meenakchi/priorpilot-1
Backend Deployment: https://priorpilot-backend.onrender.com

Future Improvements

Potential next steps include expanding EHR interoperability, improving clinical data validation, strengthening error recovery, and integrating with real insurer APIs where supported. Additional testing with representative clinical workflows would also help evaluate the application's reliability and usability.

PriorPilot's goal is to reduce repetitive administrative work so clinicians can spend more time focusing on patient care, without surrendering control over clinical decisions.