AI-assisted pre-authorization and fraud review in health insurance

Why pre-authorization and fraud review are hard

In Turkish health insurance, provizyon is the insurer's approval to cover, under the policy, the cost of care the insured receives at a healthcare provider; for planned procedures, this approval is requested before treatment and is called ön provizyon, or pre-authorization. The examples in this guide use Türkiye's systems, but the checks themselves apply to any health insurer. When a request arrives, the insurer's medical reviewer looks for several answers at once. Is the procedure covered, has the waiting period ended, does an exclusion apply? Is the remaining limit sufficient? Does the clinical document actually support the request?

These answers usually sit in different places. The policy wording is in one system, limit usage on another screen and earlier authorizations in the archive, while the clinical document is often a scanned file or free text. As request volumes grow, the reviewer's time goes into preparation rather than assessment, and decisions that rest on different information become less consistent.

Fraud poses a different problem. Its traces rarely show in a single file; they emerge as a pattern when many files are placed side by side, and when systems are fragmented, connecting those traces is hard. Across the health system, fraud losses are seen in the 3–15% range and claim denials in the 5–10% range, which shows that neither problem is small.

Checks every pre-authorization file needs

A well-prepared file gives the reviewer everything the decision needs on one page, already checked. Whether or not AI is used, these checks form the basis of the assessment:

1. Check whether the requested procedure is within the policy's coverage, whether the waiting period has ended and whether a relevant exclusion applies.
2. Show how much of the insured's limit has been used and whether the remaining limit covers the amount requested.
3. Place earlier authorizations and paid amounts next to the new request.
4. Where SUT applies, check the request against its rules. SUT is the Healthcare Implementation Communiqué published by SGK, Türkiye's Social Security Institution, and it sets reimbursement rules; outside Türkiye, the same step applies to whichever reimbursement rules govern the claim.
5. Separate the diagnosis, the planned procedure and the supporting findings in the clinical document into their own fields, and assess whether the request is consistent with current clinical guidelines.
6. Flag missing or inconsistent points before the file reaches the reviewer; if a single document is missing, request only that document.

Screening for fraud signals

Fraud review works at two levels. At file level it looks for inconsistencies within a single request, and at portfolio level it looks for patterns across many files. Signals commonly watched in health insurance operations include the following:

• The requested diagnosis or procedure has no support in the clinical document, or contradicts it.
• More than one request arrives for the same procedure, or the amount requested does not match earlier similar authorizations.
• The same diagnosis pattern recurs unusually often in certain files.
• Requests cluster around particular hospital and physician pairings.
• An atypical relationship appears between the procedure and the policy; for example, a request arrives shortly after the policy starts for a condition that appears to predate it.

None of these signals is proof of fraud on its own. A chronic condition can explain a recurring diagnosis, and a hospital focused on one specialty can explain frequent pairings. A signal only shows that a file needs a closer look. Good screening presents each signal with the reason it was raised, leaves the decision to the specialist and produces no automatic outcome about the insured or the physician.

The role of AI and how to set it up

Large language models are strong at reading documents, summarizing them and answering questions asked in free text. A pre-authorization decision, however, has to rest on the right rule, give the same result for the same input every time and be defensible afterwards, and a probabilistic model cannot guarantee that on its own. The work is therefore divided: a rule engine applies the rules, AI explains which document and which rule the outcome rests on, and a person makes the decision.

The legal framework points the same way. Under KVKK, Türkiye's personal data protection law, health data is a special category of personal data, and GDPR also treats it as special category data. KVKK gives individuals the right to object to an outcome against them that arises solely from automated analysis of their data, and GDPR restricts decisions based solely on automated processing that significantly affect a person. The following steps help with setup:

1. Identify the channel each request arrives through, which system holds each piece of information and which screens the reviewer opens for a file.
2. Define coverage, waiting-period, exclusion, limit and SUT checks as written, versioned rules, and move these policy terms from the document into the system at policy issuance.
3. Show the wording the AI takes from the document separately from its own inference in every answer.
4. Send fraud signals to a review queue with their rationale, and make sure no signal triggers a rejection on its own.
5. State in process documents that approvals, further-document requests and rejections stay with the specialist, and record the system's recommendation and the specialist's decision separately.
6. Run the system on the institution's own servers or in an isolated cloud environment, and mask personal data before it reaches the model.
7. Run a POC in a single process such as pre-authorization, and compare file preparation time, the rate of further-document requests and decision consistency across specialists with the previous period.

What Opinion AI does in this process

SIT-I is the insurance integrity platform Opinion AI has built for health insurers, and it works as a control layer that comes into play before any payment is made. It works alongside the specialist at pre-authorization, policy issuance, claims, reimbursement and medical advisory. When a file reaches the specialist, policy analysis, limit tracking, file history, SUT compliance and clinical context are on the same page, and the specialist can put questions about the file to the system through Doctor Assistant and Council Mode.

MINA's Fraud Risk Analysis query systematically screens for recurring diagnosis patterns, pairings between hospitals and physicians and atypical relationships between procedures and policies, and passes the findings to the specialist for review. Decision rules run in the rule engine and AI explains the outcome and its rationale; in pharmacy claims, each of the 6 rejection types is checked by its own rule.

MINA is built on a base model adapted to Turkish and the clinical language of 14 specialties through continued pre-training (CPT). Specialty, institution and task expertise comes from LoRA adapters, and information retrieval runs through agentic orchestration on a clinical knowledge graph (GraphRAG). In the model evaluation of MINA's latest release, the result for distinguishing fraud was 93% (93 of 100 comparisons) and for reimbursement compliance 91% (91 of 100 claims) (MINA v3.7 · 8 protocols · ~9,300 cases).

SIT-I runs in the insurer's own environment; data is not transferred to Opinion AI, the insurer itself is the data controller and personal data is masked in line with KVKK. Opinion AI does not collect personal data. The Physician Ethics and Advisory Board, whose members are physicians from 15 specialties, regularly reviews the model's clinical accuracy and ethical boundaries. On the hospital side, the same clinical intelligence runs as a separate deployment through TIS. Our work with health insurers is described on the Success Stories page.

Frequently asked questions

To look at pre-authorization and fraud review on your own file structure together, use the POC Request form. We cover rejection causes in the guide on reducing denials in health insurance pre-authorization, and how data can be processed without leaving the institution in the guide on using AI without patient data leaving the institution.