Upward Growth is a health plan market advisory firm. Our weekly newsletter covers payor market strategy, regulatory shifts, and go-to-market insights for health tech vendors, investors, provider organizations, and consultancies competing in the health plan market.
🤝 Work with us on payor market strategy: Contact us
🟦 Connect with the author, Ryan Peterson, on LinkedIn.
🎧 Listen to the Upward Growth Podcast: Apple | Spotify
📰 Newsletter sponsorships: Learn More
This week’s newsletter is presented in partnership with RISE
CMS is coming to Orlando. Bring your questions.
With accelerated RADV audits, the exclusion of unlinked chart review diagnoses, and the CY 2028 Advance Notice on the horizon, we know you’re watching closely for what comes next. At The 27th RISE Risk Adjustment Forum on October 27-29 in Orlando, Eliot Fishman of the CMS Innovation Center will present on Regulatory & Policy Updates from CMS: Preparing for 2027 and Beyond. Hear directly from CMS on the policy and regulatory shifts shaping risk adjustment, and what they mean for your organization.
Interested in sponsoring Upward Growth? Contact Us
A quick note before we get into it. This one has been sitting with me. It came up in payer and provider conversations at a conference I attended last week, and the recent New York Times piece framing the story as hospital AI versus insurer AI gave the market a shared vocabulary for something many of us have been talking about more and more over the past year. On the flight home, I sat with it and wrote down what each side is actually doing and why. The article that follows is what came out of that.
I am not trying to take a side or offer a solution. What I do think is that starting from the assumption that both sides have real reasons for what they are doing, and that both sides are responding to pressures that are shaping the whole market, not just their side of it, is the first step toward a more useful conversation than the one the market is currently having. That is what I have tried to do here.
Both sides of the prior authorization (PA) interaction are automating, and the pace has compounded through 2026. Providers are deploying AI to draft, submit, and clinically justify PA requests faster and more completely. Plans are deploying AI to receive, adjudicate, and document PA decisions faster and more defensibly. The pressure clock underneath it all is the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), which requires plans to support electronic prior authorization exchange by January 1, 2027. The arms race is the operating condition heading into CY 2027.
My read is that the arms race framing is doing part of the work but missing the actual mechanism. What is happening in PA is more accurately what I would call a parallel defense. Both sides are automating for defensive reasons, but their defenses run in parallel, driven by independent pressures rather than by each other. Providers are automating because their margin math would fail regardless of what plans do. Plans are automating because their compliance math would fail regardless of what providers do. The two defenses interact at the encounter level, which makes the pattern look like an arms race, but that interaction isn't what is driving either side. The pressures underneath each side are. I will use both terms throughout the article, but the parallel defense is the frame that actually explains the pattern.
The article walks through what each side is defending and why neither can back down unilaterally. From there, the frame carries into how to listen to Q3 payor and hospital-system earnings calls starting mid-October, and how to read PA-adjacent infrastructure spend heading into 2027 and 2028. Finally, it closes on the plan-provider pairs that sit outside the arms race, and what their absence from it says about the ones still in it.
What Providers Are Actually Defending on the Submission Side
Providers are automating prior authorization to defend margin at the encounter level. Every denied PA on a submitted claim takes margin out of that visit or admission, and in a 2026 provider environment where the underlying rate math is already tight, the volume of leakage from PA denials has moved from operational annoyance to strategic priority. That is a primary driver behind the AI investment on the submission side.
A submitted PA is a bet that the documentation is complete enough, coded correctly enough, and clinically justified well enough to clear the plan’s adjudication threshold. If it doesn’t clear, the encounter gets reworked with additional documentation, appealed, or written off. Rework and appeals carry labor costs on both sides of the interaction. Write-offs are pure margin loss for the provider. Automating the submission raises the average quality of what gets sent in, so more requests clear on first pass and fewer land in the rework and appeal pipeline that compounds cost across the encounter.
Rates are tighter than they were two years ago, so every denied PA hurts more. The American Hospital Association (AHA) and hospital systems have publicly characterized the FY 2026 Inpatient Prospective Payment System (IPPS) payment update as inadequate relative to the actual cost trend. Medicaid Disproportionate Share Hospital (DSH) payments took a step-down under the One Big Beautiful Bill Act (OBBBA), and safety-net systems have been vocal about the pressure that has put on their operating margins. Commercial rate negotiation has tightened as plans absorb their own Medical Loss Ratio (MLR) compression and push back harder on annual increases.
Provider CFOs are saying this on their earnings calls. On Tenet Healthcare Corporation’s (Tenet) Q2 2026 call, CEO Saumya Sutaria pointed to clinical operations cost improvements and technology-driven automation and AI as core to the margin expansion the quarter delivered. HCA Healthcare (HCA) carried the same theme on its Q2 2026 call. The Community Health Systems (CHS) and Universal Health Services (UHS) Q2 conversations sat inside the same margin-management frame that dominated the public hospital systems this cycle. A recent BCBSA analysis found that hospitals using AI coding tools cost Blues plans roughly $942 million more for similar care than hospitals not using them, which is the parallel defense showing up as measurable dollars moving between the two sides.
A second layer of provider-side defense runs alongside the margin-management one, and it mirrors what the plan side is doing on its own compliance stack. Providers are automating for defensible clinical documentation against the post-payment scrutiny environment that has grown around prior auth. Downcoding on paid claims, retrospective denials that reopen previously approved encounters, and post-payment audits that reach back multiple years all live downstream of the PA decision. A clean, well-documented PA submission is the front-end evidence that supports the back-end defense. Automating the submission defends against denial today and clawback tomorrow.
Read together, the AI investment on the provider side is a rational response to margin compression from multiple directions at once, and to a documentation trail that has to hold up longer than it used to. The provider is defending revenue on the front end and defending the record on the back end. Both are defensive.
What Plans Are Actually Defending on the Adjudication Side
Plans are automating prior authorization to defend a compliance and audit exposure that has outrun manual PA. The AI investment on the adjudication side produces a defensible audit trail on every decision. The AI investment on the adjudication side produces a defensible audit trail on every decision. The compliance environment has moved that from optional to essential.
The pressure came from several directions at once, and it accelerated fast. The CMS-0057-F requirement set is the deadline everyone knows about, but the operational timelines around it have been active since January 2026. The argument that vendors who don’t sell prior auth still needed to price the deadline in already turned on the fact that plans were standing up new infrastructure ahead of the January 1, 2027 exchange requirement. Missing the operational milestones does not just create a technology problem for the plan; it creates a documented compliance failure that regulators, competitors, and the public can see.
Public reporting made that visibility concrete. On March 31, 2026, plans published PA metrics under the CMS-0057-F transparency provisions for the first time. The report card data which surfaced the range of approval rates, appeal outcomes, and processing times across Medicare Advantage (MA) contracts showed a level of granularity the market had not seen before. Once a plan's PA behavior is publicly available at that level of detail, the compliance environment stops being an internal problem and becomes a competitive and regulatory one.
CMS published its Program Audit and Enforcement Report on July 27, 2026, naming 14 civil money penalties totaling roughly $1.54 million and specifically flagging recurring problems with prior authorization and appeals processing. The dollar figures on individual civil money penalties matter less than the signal: CMS is naming PA compliance as a category it will enforce with the tools it has, and doing it in the same calendar year the exchange requirement lands.
Alongside the CMS enforcement thread runs a False Claims Act (FCA) settlement pattern that reset the ceiling for MA compliance exposure earlier in 2026. Kaiser Permanente affiliates settled for $556 million in January 2026, the largest MA FCA settlement to date, and Aetna followed with a $117.7 million settlement on March 12, 2026. To be clear, both of those are risk-adjustment cases, not PA cases, but the FCA pattern is relevant to the PA compliance environment as a market-level signal about MA compliance economics broadly, rather than as PA-specific enforcement. The pattern extends to the provider side of the network too. In August 2026, DOJ announced a $541.5 million self-disclosed settlement with The Villages Health System and a $2.4 million settlement with Monogram Health covering the same category of diagnosis-coding conduct on the provider-partner side of MA risk arrangements. Health plans and provider organizations are both getting hit by the same category of MA compliance enforcement, and the dollar ceilings are climbing on both sides.
The audit environment sits beneath it all. Risk Adjustment Data Validation (RADV) expansion, the V28 model phase-in, the chart review exclusion, and the Office of Inspector General (OIG) and Department of Justice (DOJ) focus on risk adjustment more broadly all raise the standard for what a defensible record looks like on any given interaction. The risk adjustment audit environment is not stabilizing even as the rest of the MA market is, and plans are defending their PA compliance economics against that same audit environment. What a plan decides on a PA today becomes an audit record tomorrow, and any decision a manual process can't document to the standard auditors apply becomes exposure the plan carries forward.
Read together, the plan side of the arms race is a rational response to a compliance environment neither the plan nor any single vendor can unilaterally change. Manual PA can't produce the volume of defensible records the environment now demands, and the cost of getting caught without them is denominated in tens or hundreds of millions of dollars per settlement.
Why Neither Side Started It and Neither Can End It
The economics and compliance drivers on both sides are stacked so neither side can unilaterally back down. That is why the volume of automated PA submissions and adjudications has kept rising through 2026 rather than leveling off.
If providers back off submission automation, they accept margin compression on denied encounters and documentation exposure to plan-side post-payment scrutiny. Neither cost is one the provider CFO can absorb voluntarily in the 2026 rate environment. If health plans back off adjudication automation, they accept compliance and audit exposure at the same time they accept operational-metric exposure to the public reporting environment. Neither cost is one the plan CFO can absorb voluntarily either.
Both sides of PA are automating a fight neither side started, and neither side can end it alone, which is why the spend keeps compounding. Each side carries a cost the other side won’t accept, and the two positions reinforce each other at the encounter level.
AI-drafted submissions are meeting AI-adjudicated responses at scale through 2026. The first-pass denials from automated adjudication feed into an appeals workload the market did not carry at this scale just a year ago. Friction is relocating from the initial submission-and-decision interaction into the appeals pipeline, and my read of the March 31 public reporting was that the appeals volume was already trending that way.
Which is why the article keeps distinguishing between the two terms. Arms race captures the volume and the friction moving into appeals, which is why the market has landed on it. Parallel defense captures why neither side started it or can end it, which is why arms race is not quite the right term for what is happening. Both sides are protecting existing positions at rising scale, and the pattern is what a defensive equilibrium under real pressure looks like.
None of the added automation resolves the underlying opposition, as the two economic positions are opposed: provider revenue depends on approvals, and health plan margin depends on appropriate denials. AI on both sides accelerates the interaction and produces defensible records, but it does not touch what puts the two positions in opposition.
Reading the Earnings Calls and the Next 24 Months of PA Spend
The Q2 2026 payor earnings calls turned the compliance environment into publicly stated operational commitments, and that step matters more than the specific numbers. When a public plan tells its shareholders on a recorded call what its PA plans look like heading into CY 2027, the plan has priced the arms race into its guidance and next year’s budget. Analysts have it in their models, and the plan is on the hook for it.
I wrote about what the Q2 health plan earnings calls locked in for CY 2027, and the pattern across the public plans was that PA operational targets, compliance spend, and CY 2027 planning came up on nearly every call, not just the ones from plans with the largest MA books. The Q3 calls in October and the Q4 calls in January will speak to progress against those commitments. The arms race is not a technology cycle plans can pause; it is how they run the business going forward.
Parallel defense captures why neither side started it or can end it, which is why arms race is not quite the right term for what is happening.
Q3 payor earnings calls start in mid-October. What the plans say out loud on those calls (and what they don't) will signal how deeply the parallel defense is baked into CY 2027 for each of them.
The language worth listening for on the payor side runs across a few threads. If PA compliance spend gets framed as investment tied to CY 2027 rather than as an expense to be optimized, the plan is on the defensive-compliance frame and has priced the parallel defense into its budget. If PA operational metrics get discussed against public accountability rather than against clinical program quality, the plan is defending against the reporting standard the March 31 data now sets. Calls that treat the January 1, 2027 electronic exchange requirement as on track without caveat tell you the plan is on the compliance side of the deadline, not the exposure side. And if appeals volume shows up as its own operational line item, the friction moving into appeals is being priced in as a standing cost of doing business.
Whether the plans use that language or not is informative in both directions. If they do, the plan has built the parallel defense into CY 2027, and their guidance reflects it. If they don't, one of two things is happening. Either the plan sits outside the parallel defense because it is an integrated system or sits inside a tight value-based payment (VBP) book, or the plan is behind on what CY 2027 actually requires. Both readings are useful, and telling one from the other means matching the language on the call to the plan-provider pair the plan actually sits in.
Hospital system Q3 calls run in the same window and give a complementary read. Tenet, HCA, CHS, and UHS are the public-company hospital reads on the provider side, and each is worth listening to for a specific thread. Tenet on ambulatory acuity and how the technology-driven margin work that showed up in Q2 carries into the back half. HCA on the ACA volume-to-uninsured conversion and how that affects the DSH and margin math heading into CY 2027. CHS and UHS on turnaround-plan progress and where cost discipline sits alongside documentation investment. On all four, PA-related revenue leakage commentary, denial and appeal metrics reported as separate operating indicators, and clinical documentation investment named as its own line all show whether the provider side is treating the parallel defense as CY 2027 reality with the same seriousness the plans are.
The read on 2027 and 2028 PA-adjacent infrastructure spend across the market follows from the same frame. PA-adjacent spend keeps rising because parallel defense keeps producing new investment categories on both sides, and the plan-provider pairs outside it represent a small share of national lives. The spend shows up across three categories: submission-side automation on the provider side, adjudication and appeals infrastructure on the plan side, and the FHIR interoperability layer between them. Each category is defending against a different pressure. Beyond Q3, the levers that would meaningfully change the underlying pressure sit further out. The CY 2028 rate cycle, the next CMS enforcement report, and the next wave of FCA settlements can each move one side of the pressure, and each is worth watching for that reason.
Why Some Plan-Provider Pairs Sit Outside the Arms Race
A small number of plan-provider pairs sit outside the parallel defense because of how their relationship is structured. Looking at them says something specific about why the rest of the market is inside it.
Fully integrated systems where the plan and the provider organization are the same enterprise do not run PA the same way transactional plan-provider pairs do. Kaiser Foundation Health Plan and Permanente Medical Group is the canonical case. Utilization decisions get made inside the same organization rather than across a contract boundary, so front-end submission automation and back-end adjudication automation serve the same organization’s economics rather than opposed ones. Geisinger Health Plan and Geisinger fit the same pattern at a smaller scale. Integration weakens the transactional PA arms race but does not exempt any organization from the broader MA compliance environment. The same Kaiser affiliates named as the canonical integrated case are on the FCA settlement side of the plan-side argument earlier. Integration changes how a plan-provider pair experiences PA specifically. It does not change what compliance environment the parent organization operates inside.
Tight VBP relationships with meaningful shared risk sit in the same neighborhood, though the dynamic weakens for a different reason. When both parties share the downside on inappropriate utilization, the friction that transactional PA is trying to manage gets absorbed inside the risk-sharing arrangement rather than fought at the encounter level. SelectHealth and Intermountain are a great example. Some regional Blues with tight in-market health system alignment have a similar version, including BCBS Michigan with Corewell and Highmark with Allegheny Health Network. And some Risant-model integrations still forming are building toward it. The submission and adjudication automation still exist in these relationships, but they serve a shared economic frame instead of opposed ones. Provider-sponsored plans picking which lines of business integration pays for is where the next wave of these archetypes is likely to form.
Final Thought
The parallel defense is a rational response to conditions neither side can unilaterally change. The provider side is defending margin and documentation exposure. The plan side is defending compliance and audit exposure. Neither side can back off without accepting a cost the other side is not accepting, and the calendar and enforcement environment heading into CY 2027 give neither side reason to try.
Two conditions would change what each side is defending against. Payment model change with real shared risk, meaningful capitation or VBP arrangements, would weaken what puts the two economic positions in opposition and remove the incentive to automate the fight. Regulatory change that resets the pace of the compliance and enforcement calendar would give both sides room to unwind the defense rather than expand it. Neither is within the control of any single plan or vendor, and neither is teed up on the current calendar.
Which means the next 24 months of PA-adjacent infrastructure spend will keep compounding on the same defensive math that produced it, and the plans still inside the parallel defense will keep spending against a fight neither they nor their providers can end alone.
Thanks for reading.
Here’s to upward growth,
Ryan Peterson
The frameworks in the weekly Upward Growth newsletter help health plans, health tech vendors, investors, provider organizations, and consultancies understand the health plan market as it continues to shift.
If your colleagues are in those conversations, they should be reading this too.
💰 Invest In Your Team with a Paid Subscription.
💡 Pro tip: Many subscribers expense Upward Growth through their company’s professional development, training, or learning budget. Here’s a one-minute email template to get your manager to approve expensing your subscription.