Forward-Deployed Engineering · Healthcare · Insurance desk and revenue cycle
Case study: cashless pre-authorisation, from admission advice to a complete packet
Illustrative engagement — not a client record. The hospital network, people, volumes and results below are a representative composite, written to show how a forward-deployed engagement runs end to end. The workflow, the architecture, the controls and the method are real and technically valid.
Offering usedRegulated & Secure DeploymentInside your perimeter: your cloud, your premises or no network at all.
Illustrative results, first 90 days after cut-over, in-scope payers only:
55 minutes
Median time from admission advice to pre-authorisation request submitted, emergency and same-day admissions
Before 2.4 hours
11%
Initial requests that drew an insurer query for missing documents or details
Before 27%
50 minutes
Median hospital-side time to prepare a discharge authorisation packet
Before 2.1 hours
0, by design
Clinical statements sent to an insurer without the treating doctor's approval
Before not tracked
Explainer09 obs
The whole story in about a minute
Nine short scenes, from slow insurer packets to the results. Press play, or pick a scene.
Over 7,000 packets a month
Advice to request
2.4 hours
median, emergency admissions
Initial requests
Queried
Five insurance desks
27%
of initial requests came back with a query
Slow packets · Before
Patients waited while the paperwork was built.
Over 7,000 insurer packets a month were gathered and typed by hand. An emergency request took a median of 2.4 hours to send, and 27% came back with a query.
At a glance
- Client
- A private hospital network: five multi-speciality hospitals, about 1,400 beds, in two states, with an insurance desk at each hospital and a central revenue-cycle team
- Workflow
- Cashless requests to insurers and TPAs: initial pre-authorisation, enhancement and discharge authorisation packets, and responses to insurer queries
- Engagement
- Regulated & Secure Deployment (scoped per environment: the network's own data centre), run together with a Production Sprint (six weeks)
- Team
- One named senior forward-deployed engineer, full time. Client side: the Head of Revenue Cycle (owner), the Medical Superintendent of the flagship hospital (clinical owner), an HIS analyst, an infrastructure engineer, the Data Protection Officer, a security reviewer
- Where it runs
- On the network's own servers in its primary data centre, with open-weight models self-hosted. No patient record leaves the network
- Handover
- Runbook executed by the client's team in week six; our access revoked the same day
| Measure | Before | After |
|---|---|---|
| Median time from admission advice to pre-authorisation request submitted, emergency and same-day admissions | 2.4 hours | 55 minutes |
| Initial requests that drew an insurer query for missing documents or details | 27% | 11% |
| Median hospital-side time to prepare a discharge authorisation packet | 2.1 hours | 50 minutes |
| Clinical statements sent to an insurer without the treating doctor's approval | not tracked | 0, by design |
| Patient records sent outside the network for model processing | not applicable | 0, by design |
FDE / 01Case study
01 / 12
In shortHospital desks built insurer packets by hand, and patients waited while they did.
The network admitted around 7,000 in-patients a month. A little under half were cashless: the patient held a health policy, and the hospital asked the insurer, or the insurer's TPA, to authorise treatment before and during the stay. Each cashless admission produced, on average, two to three packets: the initial request, one or more enhancements when the estimate changed, and the discharge authorisation. Replies to insurer queries came on top. The five insurance desks handled a little over 7,000 packets a month, for about thirty insurers and TPAs.
A packet is not one document. It is the request form, the admission notes, the provisional diagnosis and planned treatment, investigation reports, an itemised estimate, the policy or member card, an identity document and the patient's signed consent. The desk staff gathered these by hand from the hospital information system (HIS), the radiology system, the billing module and paper at the bedside. They typed the form into a payer portal or attached it to an email. A few payers received requests through the national health claims exchange.
The regulator's 2024 health master circular set tight clocks on insurers: a decision on a cashless request within an hour, and on a discharge authorisation within three hours of the request. It also said the insurer or TPA should collect documents from the hospital, not the patient. Those clocks start when a complete request arrives. They say nothing about the hours a hospital spends assembling it. That was where the network lost time:
Admissions. For emergency and same-day admissions, the median time from the doctor's admission advice to a submitted request was 2.4 hours. Patients waited in casualty or paid a deposit while the file was built.
Queries. 27% of initial requests came back with a query for a missing report, an unclear diagnosis or an estimate that did not add up. Each query restarted the insurer's clock.
Discharges. A patient declared fit for discharge waited a median of 2.1 hours for the hospital to prepare the discharge packet, before the insurer's three hours even began. Beds stayed blocked.
People. Desk staff chased doctors for signatures by phone. Doctors answered the same questions about the same patient several times a day.
FDE / 02Case study
02 / 12
In shortDoctors, data protection and thirty payer formats each had a sound reason to say no.
The network had looked at automation twice. Neither went further than a meeting, for reasons that were sound.
Clinical statements. A pre-authorisation form says what is wrong with the patient and what the doctor plans to do. The Medical Superintendent would not accept any tool that wrote those sentences for doctors to sign without reading. Nor would the medical staff committee.
Data could not leave. Every document in a packet is health data about a named patient. The Data Protection Officer and the IT security team would not send it to an outside model service, and the network had no plan for running models itself.
Thirty payers, thirty formats. An earlier attempt with screen-recording bots filled one portal well and broke each time that portal changed.
No single owner. The desks reported to finance. The notes belonged to medical services. The HIS belonged to IT. Everyone agreed the process was slow, and nobody owned all of it.
None of these is a model problem. They are questions of clinical ownership, perimeter, integration and accountability. That is where the engagement started.
FDE / 03Case study
03 / 12
In shortA week at the desks, a plan to keep everything on the network's own servers, and a signed scope.
The first week was spent with the security lead, the Data Protection Officer and the infrastructure team, and at the desks. The engineer sat at two insurance desks through a day and a night shift, walked a discharge from ward to billing, and read the HIS, the radiology system and the billing module.
The environment plan. The network's policy did not allow patient data in any public cloud service. The deployment was therefore on premises: the workflow service, a model gateway, a document store and the audit log on servers in the primary data centre, with open-weight models self-hosted on two GPU servers left over from an earlier imaging project. Egress would be blocked at the network edge. The only outbound traffic would be what already existed: the desks' own portal sessions and the exchange connection, both driven by people.
What was found:
FIG. 3.1- The HIS exposed admission, transfer and discharge events, orders and lab results through an approved interface already used by the lab analysers. Radiology reports were PDFs in the radiology system, linked by visit number.
- Estimates came from the billing module's package rates. They were reliable when a package existed and hand-typed when it did not.
- A false assumption, found early. Everyone had said admission notes were typed in the electronic record. At two hospitals they were. At the other three, most admission notes were handwritten and scanned. Handwriting would be read poorly, so the design had to fall back gracefully, not pretend.
- Twelve payers carried 86% of cashless volume. Each had a published document checklist, and most of their queries were for items on it.
- Medico-legal cases, international patients and government-scheme patients followed separate processes with separate rules.
The one-page scope, signed by the Head of Revenue Cycle and countersigned by the Medical Superintendent:
- WorkflowInitial pre-authorisation, enhancement and discharge authorisation packets, and query responses, for the top twelve payers, at all five hospitals
- Out of scopeGovernment-scheme patients, reimbursement claims, final claim files after discharge, medico-legal cases, international patients
- MetricMedian time from admission advice to submitted request; share of initial requests drawing a query for missing items. Gate: at or above 98.5% accuracy on critical fields and no unsupported clinical statement in the golden set
- OwnerHead of Revenue Cycle; clinical content owned by the Medical Superintendent
- GuardrailsThe treating doctor approves every clinical statement. The system never assesses or asserts medical necessity. The desk submits every packet. No record leaves the network
- Exit gateOne week of shadow-run parity, one week live with rollback armed, runbook executed by the client's own engineer
The Medical Superintendent added one line in her own hand: a drafted clinical sentence with no source is not a draft, it is an error. That line became a rule in the code.
Timeline09 stages
The engagement, stage by stage
Nine stages on one clock, from before the engagement to ninety days after cut-over. Press play, or pick a stage.
09 stages
+90 daysResults
Faster packets, fewer queries.
Illustrative, first 90 days: emergency requests sent in a median of 55 minutes instead of 2.4 hours, and queries for missing items fell from 27% to 11%. No desk role was cut.
- Queries 27% → 11%
- Discharge 2.1 h → 50 min
- No desk role was cut
FDE / 04Case study
04 / 12
In shortSix weeks and a five-day pause, written down: build, shadow, cut over, hand over.
five working days
W0Scope
What happened
Scope page signed; environment plan agreed with security; access requested for the HIS interface, radiology reports, billing and the desks' shared mailboxes
What existed at the end
The signed scope, the environment plan and an access checklist
What happened
Scope page signed; environment plan agreed with security; access requested for the HIS interface, radiology reports, billing and the desks' shared mailboxes
What existed at the end
The signed scope, the environment plan and an access checklist
What happened
Repository created in the client's source control; engineer joined the revenue-cycle stand-up. Importing the model weights needed a change-control approval that took five working days, so the sprint clock paused, as agreed at scoping
What existed at the end
First pull request merged on day seven: HIS events opening a case record for each cashless admission, with documents landing in the local store
What happened
Extraction and checklist checks running behind a feature flag on real, current cases at the flagship hospital. Golden set agreed with the desks and two consultants
What existed at the end
A working prototype and a golden set of 900 past cashless cases with known answers
What happened
Payer checklists as rules, citation-linked drafting, the doctor's approval screen in the HIS worklist, the desk queue, deadline tracking, audit log, dashboards. Shadow run began in week four
What existed at the end
A system preparing every in-scope packet in parallel with the desks, without anything reaching a payer
What happened
Live at the flagship hospital, then at two more, then at all five, each step gated on the shadow-run comparison
What existed at the end
Real packets prepared by the system and submitted by the desks, rollback one switch away
What happened
Client's infrastructure engineer performed a release, a rollback and a model update without us at the keyboard
What existed at the end
Signed runbook, security manifest, decision record, revoked access
five working days
Calendar time was six weeks and five working days. The five days were the change-control wait in week one. They were written down on the day the clock stopped, with the ticket number.
FDE / 05Case study
05 / 12
In shortThe model reads and drafts with sources, rules check completeness, the doctor approves, the desk submits.
Try a packet
Pick what a case brings. Watch where the packet goes.
The same pipeline prepares every packet. What the documents show decides whether it reaches the desk or is held with a named reason.
What the case brings05 cases
A complete emergency admission09 / 09 steps
Packet status
Records leaving the network0
Submitted by the systemNever
RunsOn premises
- Case openedAdmission advice recorded for a cashless patient; the HIS opens a case
- AssembleOnly what the payer's checklist asks for; identity number masked
- ReadTyped and printed pages read on the network's own GPUs
- ExtractFields filled; every clinical field carries its document, page and line
- Payer rulesEvery checklist item present; names and member number match; estimate adds up
- DraftPayer's request form filled, each value linked to its source
- Doctor approvesThe treating doctor approves the clinical sections in the HIS worklist
- Desk reviewsThe desk sees the packet, the checks and the approval
- SubmittedSubmitted by the desk through the payer's portal, email or the exchange
Case opened. When a doctor records admission advice for a patient flagged as cashless, the HIS event opens a case. Planned admissions open days ahead; emergencies open at triage.
Assemble. The service pulls what the payer's checklist asks for and no more: the admission note, relevant investigation reports, the estimate, and the policy card, identity document and signed consent captured at the desk. Identity documents are stored with the national identity number masked. Minimum necessary is a rule, not a habit.
Read. A layout-aware document model, running on the network's own GPUs, reads typed and printed pages. Handwritten notes are read with a confidence score. Below the threshold, the service does not guess: it asks the ward for the typed admission summary, or puts the field to the desk and doctor blank.
Extract. A self-hosted language model fills a strict schema: patient identifiers, policy and member number, provisional diagnosis as written, planned procedure, relevant history, investigation findings, expected length of stay, room category and the estimate lines. Every clinical field carries the document, page and line it came from. A field with no source cannot be saved. The model may suggest a diagnosis code for the desk's coding team to confirm. It never adds a diagnosis the notes do not contain, and it keeps the doctor's uncertainty: "suspected" stays "suspected".
Check. Deterministic rules, one set per payer: every checklist item present; patient name, date of birth and member number consistent across card, identity document and notes; policy active on the admission date; estimate lines adding up to the total; room category within the policy's eligibility; report dates inside the admission window; consent signed. A missing item holds the packet with a named reason. Rules decide completeness. No model does.
Draft. The service fills the payer's request form, and drafts replies to queries, with each value linked to its source. For a query, the draft lists the documents that answer it and the sentence in each that does. Nothing in the draft says a treatment is necessary or justified. That judgement belongs to the treating doctor, and the insurer's medical reviewer then makes their own.
Doctor approves. The clinical sections appear in the treating doctor's HIS worklist beside the source documents. The doctor approves, edits or rejects them, sentence by sentence, under their own login. An edited sentence is saved as the doctor's. A packet without an approval cannot move to the desk.
Desk reviews and submits. The desk sees the complete packet, the checks and the doctor's approval, and submits it through the payer's portal, by email or through the exchange connection. The person submits, as before. The system never presses submit.
Track. Each case shows its status, when it was submitted, the insurer's one-hour or three-hour clock, and any query and its deadline. When an insurer's clock runs out, the desk supervisor is alerted to escalate. When a patient is marked fit for discharge, the discharge packet is assembled at once, so the hospital's part of the wait shrinks.
Audit and monitoring. Every read, extraction, check, draft, approval and submission, with the model version and the person, goes to the network's own log store, kept for at least the year the data-protection rules require. Dashboards show packet times, query reasons, doctor edit rates and checklist failures. Thresholds page the infrastructure engineer.
System map20 objects
How the pieces connect
Every part of the system and of the story, lit one scene at a time. Press play, or pick an event.
Timeline09 events
Ontology/Pre-authorisation/Results
Graph · 20 objects11 selected
ObjectEnd
Insurance desk
Teamsubmits
Faster packets, fewer queries.
Metric
55 minmedian to submit an emergency request, down from 2.4 hours
Description
Illustrative, first 90 days: emergency requests sent in a median of 55 minutes instead of 2.4 hours, and queries for missing items fell from 27% to 11%. No desk role was cut.
Properties
Queries 27% → 11%
Discharge 2.1 h → 50 min
No desk role was cut
Linked objects
HISSystem
CaseRecord
ReadModel
ExtractModel
Payer rulesRules
DraftDocument
Treating doctorPerson
Insurers and TPAsOrganisation
HeldQueue
Network edgeControl
FDE / 06Case study
06 / 12
In short900 past cases, labelled with the desks and two consultants, that every release must pass.
The golden set was built with the people who would be held responsible for the packets: desk leads and two consultants.
900 past cashless cases across the twelve payers, all five hospitals, eight specialities, planned and emergency, typed and handwritten notes.
Answers taken from what actually happened: the packet as finally approved by the insurer, the queries it drew and the documents that answered them.
Clinician labelling. For 300 of the cases, the consultants marked every drafted clinical sentence as supported by the source, unsupported, or missing something clinically relevant. An unsupported sentence that could change an insurer's view of the case was marked major.
A red-team slice: a report from another patient's file scanned into the wrong visit, a member card with a different date of birth, an expired policy, an estimate whose lines do not reach the total, a note saying "suspected appendicitis".
Thresholds: 98.5% on critical fields; 99% recall on missing checklist items; no major unsupported clinical sentence; every red-team case caught.
The suite runs in the client's CI on the network's own runners. In week three it did its job. A model update improved reading of discharge summaries and quietly started dropping hedges: "suspected appendicitis" became "appendicitis" in four golden cases. The build failed and the update did not ship. A check for uncertainty words, compared between source and draft, was added to the rules the same day.
FDE / 07Case study
07 / 12
In shortEverything runs inside the network, and nothing calls an outside model.
Egress is blocked at the network edge and was tested by attempting it from each service and recording the block.
Perimeter. Everything runs on the network's own servers. Models are open-weight and self-hosted; nothing calls an outside model. Egress is blocked at the network edge and was tested by attempting it from each service and recording the block.
Data protection. The Data Protection Officer reviewed the design against the network's duties under the Digital Personal Data Protection Act: the purpose stated in the patient's consent, minimum necessary documents per payer, masking of identity numbers, access limited by role, logs kept, and a breach procedure with its notification steps written into the runbook.
Identity. Doctors and desk staff act through the HIS and the network's identity provider. The service account can read the listed sources and write case records and drafts. It cannot submit to a payer. Our engineer's access was visible in the network's audit log and revoked at handover.
Can
- read the listed sources
- write case records and drafts
Cannot
- submit to a payer
Autonomy is bounded. The model reads and drafts, with sources. Rules decide whether a packet is complete. The treating doctor owns every clinical statement. The desk submits. No part of the system judges medical necessity, and nothing it produces is shown to the patient or the insurer as a decision.
Review. Security reviewed the environment plan in week one and the deployment in week five. The Medical Superintendent reviewed the approval screen before any doctor saw it. Each finding and how it was closed is in the decision record.
FDE / 08Case study
08 / 12
In shortA week in shadow, then live hospital by hospital, with one flag to go back.
The shadow run was the gate. For a week at the flagship hospital, the system prepared every in-scope packet while the desks worked as before. Neither the drafts nor the checks reached a doctor or a payer. Each packet was compared with the one the desk actually sent. Differences went into three piles: the system missed something, the desk missed something, and the payer's checklist was ambiguous. The third pile went to the Head of Revenue Cycle, who settled each with the payer's liaison.
For a week at the flagship hospital
the system missed something
the desk missed something
the payer's checklist was ambiguous
went to the Head of Revenue Cycle
The desk-missed pile was the larger: consent forms not attached and estimates not updated after an ICU transfer. Those became checks.
Rollout went by hospital, not by date: the flagship, then two more, then all five. Each step needed a clean day of doctor edit rates and a clean desk sample audit. Rollback was one flag that returned every case to the desk's manual process. It was tested in week five and has not been needed.
01the flagship
02two more
03all five
EACH STEP · a clean day of doctor edit rates and a clean desk sample audit
FDE / 09Case study
09 / 12
In shortThe client's engineer released, rolled back and updated a model before the runbook was signed.
The engagement ended on two manifests, not on the calendar.
In the dry run, the client's engineer added a new payer's checklist, scored it against the golden set, loaded an updated model through change control, released, and rolled back, with our engineer in the room but not at the keyboard. The runbook was signed after that, not before.
Key numbers09 readings
The story in nine numbers
One number for each scene, from 2.4 hours to send a request down to 55 minutes. Press play, or pick a number.
Results09 / 09
Faster packets, fewer queries.
55 minmedian to submit an emergency request, down from 2.4 hours
Illustrative, first 90 days: emergency requests sent in a median of 55 minutes instead of 2.4 hours, and queries for missing items fell from 27% to 11%. No desk role was cut.
- Queries 27% → 11%
- Discharge 2.1 h → 50 min
- No desk role was cut
FDE / 10Case study
10 / 12
In shortRequests and discharge packets are ready much sooner, and fewer draw a query.
Figures are illustrative, measured on in-scope payers over the first 90 days after cut-over.
Emergency and same-day requests submitted in a median of 55 minutes, down from 2.4 hours. Most of the gain came from assembly starting at admission advice, not when the desk found time.
Queries for missing items fell from 27% to 11% of initial requests. The payer checklists as rules did more of this than the model did.
BEFORE27%AFTER11%Discharge packets prepared in a median of 50 minutes, down from 2.1 hours, because assembly starts when the patient is marked fit.
Doctors edited 14% of drafted clinical sections, mostly to add context the notes lacked. The edit rate is tracked as a quality signal, not a target.
AFTER14%No clinical statement reached a payer without the treating doctor's approval, and no record left the network, because the design does not allow either.
No desk role was cut. Two senior desk staff now handle escalations with payers and train new hospitals' desks.
What did not improve, and was never promised:
FIG. 10.2Insurers' decision times after submission did not change. They are the insurers' to meet, and the system only makes a late one visible.
Handwritten admission notes at the three older hospitals are still read poorly. They fall back to the typed summary or to people, and those hospitals now have a date for typed notes.
Rejections for policy exclusions did not fall. A faster, complete packet does not change what a policy covers.
FDE / 11Case study
11 / 12
In shortSix rules for anyone putting models near clinical paperwork.
- Decide who owns each sentence before you build.
Clinical content with doctors, completeness with rules, submission with the desk. Every design choice followed from that page.
- Make citation a rule, not a feature.
A clinical field with no source cannot exist. That settled the medical staff committee's questions in one meeting.
- Test for lost uncertainty.
"Suspected" becoming a diagnosis is the error that matters in this work, and ordinary accuracy scores miss it.
- Most queries are a checklist nobody enforced.
Write each payer's list as rules first.
- Ask how notes are really written, at every site.
Two of five is not all of them.
- Pause the clock in writing.
A change-control wait is not a slip if both sides recorded it the day it began.
FDE / 12Case study
12 / 12
In shortThe network took it in-house, extended it to final claim files, and came back for more.
The network took the system in-house and did not buy managed operations. Three months after handover their team extended the same pipeline to the final claim file after discharge, using the same harness and runbook. They came back for a second Production Sprint on government-scheme pre-authorisations, which had been out of scope the first time and follow different rules.