The client is an attorney who defends doctors in disputes with insurance companies. He founded a startup, and we built his idea as the first version of an online service (a SaaS MVP). On the bill to the insurance company, a doctor lists the code for the medical service (the CPT code). To defend that code, the attorney has to show the insurer’s own published rule that backs it. Most of the time went into finding that rule, not into choosing the code. Now the attorney uploads the patient’s medical chart. The system reads the chart, suggests the service code, checks the codes already on the bill, and finds the insurer’s rule for the right region, with a link to the source. The attorney decides which code to defend, and that decision now takes about 75% less time
The insurance company, its claims adjuster or the other side’s lawyer can challenge the code on a bill. Two competent experts can read the same chart and pick different codes, and both codes can be defended. So the attorney has to decide which code to defend and show the insurer’s rule that backs it
First the attorney reads the medical chart and forms a view of which code it supports. Then he looks for the rule, and the search takes longer than the reading. Medicare, the federal health insurance program, splits the country into 12 regions, and each one publishes its own rules for codes. On top of that come 50 states, private insurance companies with their own rules, and Medicaid, government health coverage for people with low income. Finding the rule that applies to one chart is research of its own.
He founded a startup to have the tool he wanted. AI alone can suggest a code, so that was not the goal. The goal was the full opinion with its sources, ready for the attorney to check in minutes instead of putting it together over hours. Until the rule is in hand, there is nothing to decide.
The attorney creates a case, enters its details and uploads the chart. The AI analyzes the chart in four separate steps, and the system returns one opinion. The attorney checks it and decides
Step one suggests the service code, the diagnosis codes (ICD) that support it, the service’s level of complexity with the reasons, and an estimate of the time spent on the patient. Step two checks the codes already on the bill and says for each one whether it fits or not, and why. Step three searches the web for the insurer’s rule for the case’s region and returns it with a link to the official source. Step four is optional and finds further reading. The attorney reviews all of it before he decides.
If the file is not a usable medical chart, the AI says so in a separate field. The chart is marked as an error, with the reason, for a person to look at. The system does not suggest a code for a document it could not read.
On each case the attorney picks from lists: the type of insurance (private, Medicare, Medicaid or other), the state, the Medicare region, the insurance company, the treatment and the codes already on the bill. So nothing can be misspelled or made up. Every analysis step receives these details, so the AI does not have to guess the region.
The AI follows written instructions (prompts), one for each of the four steps. The four are stored together as one set in the admin panel, not in the program code, and each case runs on one such set. The specialist who writes these instructions (a prompt engineer) changes them there, for example to make the system treat a Medicare case differently from a private insurance case. The next chart runs on the new instructions, with no developer and no software update. The attorney does not edit the instructions. He adds his own documents to the knowledge base, and the analysis uses them.
The service reads the file in memory, without writing it to disk, and then deletes it, so there is no document store that could be broken into. Only the text from the file and the file name are kept. The text is encrypted one field at a time, and each value gets its own random start, so two identical entries do not look identical in the database. Someone who copies the database still cannot read the medical records. The application itself runs on the server without administrator rights.
The attorney can run the analysis of a chart again, for example after the instructions or the case details change. The new result is saved as a new version, and the earlier one stays. The record of what the system said, and when, stays complete. That matters because an opinion may be shown to the insurance company.
Each analysis step records how much work the AI did, and the chart stores it. So the cost of an analysis is a number in the database. Nobody has to work it out from the AI provider’s invoice.
Each organization that signs up sees only its own cases, charts, files and tags. It has three roles: admin, lawyer and user. The server checks the role on every request. Charts are grouped into cases, assigned to people and tagged. The AI may only suggest tags from the organization’s own list. Every comment, status change, handover to another person and rename is logged in the chart’s history. The service also has notifications, subscription billing with a customer portal, a help center and a support desk.
A separate copy of the four analysis steps exists only to be measured. For each run, a platform administrator sets how long the AI reasons and how much it writes, step by step. Each run records when the whole run and each step started and ended. The AI’s reasoning is saved next to its answer, and runs can be compared side by side. It takes pasted text instead of uploaded files, because it is a measuring tool and not a feature for users.
Three decisions in the first 2 weeks did most of the work. A fourth kept every AI answer checkable
We used a ready-made content management system as the foundation of the server. For each of the 26 types of data we defined, it created an admin screen and the data access the app needs, with no extra code. The team spent its time on the product itself.
The prompt engineer changed the instructions in the admin panel, without asking a developer to change the code. The developer hours those changes would have taken went into the product instead.
A rule the AI finds for a region does not count without a link to its source: the attorney has to show the insurer its own published rule.
The AI works through a chart in four steps instead of one large request, and the test bench times each step. A change to the instructions is kept or dropped on those numbers, not on a feeling.
Running at real volume needs all three. We would rather say so here than have a prospect discover it
An analysis runs inside the same program on the server that received the file. It is simple and it works. But if the server restarts in the middle of an analysis, for example during an update, that chart gets stuck. A queue that retries failed analyses is the first item of the next phase.
Billing works: subscriptions, plan changes and the customer portal. Payment notifications from the billing provider are received and processed. The counter that should stop an organization at its monthly limit of analyses is still only a placeholder. Nothing is billed incorrectly. The limit is just not enforced yet.
The safeguards described above are real. The platform lacks a compliance program for HIPAA, the US law on protecting medical data: no business associate agreements binding each service the data passes through to protect it, no log of who viewed a record, no written rule for how long data is kept. It is not HIPAA-certified, and we have never described it as such.
Deciding which code to defend now takes about 75% less time. Everything below is what the system does, and it can be checked in the code. Charts per month and the accuracy of the chosen codes are the client’s to publish, so they are not here
A 30-minute call about one process in your business. We will say where automation fits and where it does not