← All AI Engineer talks

AI Engineer World's Fair 2026

Can Oncology Workflows Run Without Human Touch? - Anant Shankhdhar, Risa Labs

Read the talk

Removing Human Review from Selected Oncology Authorization Workflows

RISA’s oncology workflow combines deterministic coverage checks, corroborated authorization evidence, and clinical reasoning to identify which orders can proceed without human review.

From a talk by Anant Shankhdhar

Which orders can proceed without review?

An oncology practice receives an order for a patient’s cancer drugs. Before filing any necessary prior authorizations, it must verify the patient’s insurance eligibility and benefits, then determine the authorization status of each drug. Automating those steps does not automatically eliminate review: at RISA, bots already performed the work, but a human still checked orders before submission.

Each drug follows one of three pathways:

StatusMeaning
No auth required (NAR)The drug does not require prior authorization.
Auth on fileAn existing authorization covers a defined period.
Auth requiredAuthorization must be obtained.

Anant Shankhdhar’s task was to identify which orders could proceed directly toward submission without that final human verification, and then build the path that would carry them through. The goal was selective no-touch processing, with confidence determining which cases qualified.

Flowchart showing order intake, eligibility and benefits, order determination, authorization status branches, write-back and document upload, and completion. A note describes moving human involvement toward exception handling.
The prior-auth lifecycle, from order intake through status routing and write-back.
0:120:31
Suggest correction

This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.

0:12 · section reference included

Normalize coverage before making decisions

The workflow is divided among four agents, each responsible for a distinct decision or operation:

  • Eligibility and benefits verification (EV): Fetch patient coverage information and determine whether the order can advance.
  • Authorization: Determine whether each drug needs authorization or already has it.
  • Medical necessity: Evaluate the clinical basis for drugs that require authorization.
  • Submission: Send the assembled information to the payer.

This division separates insurance eligibility, authorization status, and clinical justification instead of asking one agent to decide everything at once.

The first obstacle is access to evidence. Insurance details are scattered across portals, APIs, and documents. RISA built a unified service that connects to different payer sources and returns a normalized result. A deterministic decision engine then uses that result to flag cases that cannot proceed.

The coverage path works in three steps:

  1. A coverage orchestrator selects either an API integration or robotic process automation (RPA) for the relevant payer source.
  2. The selected integration retrieves the information and produces a fixed coverage-result format.
  3. The deterministic engine checks whether coverage is active. Passing cases advance; failed cases stop at this gate.

Normalization makes the downstream decision independent of how the information was retrieved. But it leaves another problem upstream: building a separate automation for every payer portal does not scale easily.

2:042:24
Suggest correction

This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.

2:04 · section reference included

Generate portal configurations from reusable actions

To reduce the work of adding portals, RISA created a repository of common and custom RPA actions. An LLM-based configuration generator uses those actions to build the configuration for a particular portal. Shankhdhar reports that this significantly reduced development time, without giving a numerical benchmark. The reusable unit is the action; the portal-specific output is the configuration that combines those actions into an automation.

Generating an integration does not make it durable. Portal automations can break at runtime, so RISA also added a self-healing loop that identifies broken automations during production hours and attempts to mitigate them. Shankhdhar presents this as a way to prevent failures, rather than providing a measured reliability guarantee. Together, reusable actions, configuration generation, and runtime repair support the retrieval layer; the eligibility gate still determines whether the resulting case can advance.

Coverage orchestrator connects to API and RPA paths, then a coverage result branching to active coverage or not eligible/error. Three cards below describe reusable actions, LLM-generated payer configurations, and self-healing.
Coverage verification routes through API or RPA paths to an active-coverage or flagged result.
4:194:40
Suggest correction

This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.

4:40 · section reference included

Why extracting a status was not enough

After eligibility verification, the next opportunity was to resolve drugs that already had authorization or did not require it. Either status could remove human oversight from that part of an order. RISA initially built a simple extraction pipeline: read the patient’s notes, use an LLM to classify the drugs, and default to authorization required.

Two problems kept this pipeline from removing review. First, the notes sometimes lacked enough information, causing extraction errors. Second, LLM extraction was nondeterministic, so the resulting classifications could not be trusted blindly. It could make reviewers faster, but they still needed to check its work.

The next step was to change what supported the decision. If the model classified a drug as NAR or auth on file, the pipeline needed evidence backing that classification. A status extracted from notes became a claim to corroborate before bypassing review.

5:536:08
Suggest correction

This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.

5:53 · section reference included

Corroborate authorization status across sources

For auth-on-file cases, previous patient workflows supplied an additional source: authorization letters. These recorded earlier authorizations for the patient’s drugs. Where the notes and letters agreed, the system had stronger support for treating a drug as already authorized than it had from notes alone.

For NAR cases, the additional evidence came from payer portals and documents describing which drugs did not require authorization during a given period. RISA combined portal checks and LLM extraction to populate a payer-rule knowledge base, implemented as a SQL database. These rules concern whether authorization is required; they are not a determination that a drug is uncovered.

The pipeline reconciles those sources with the extracted statuses. Agreement gives the system more confidence in a NAR or auth-on-file classification, while configurable controls let the team restrict affected cases if problems arise. Corroboration supports a decision to automate; it does not establish that every classification is correct.

This produced the first complete orders that could avoid manual authorization review. Resolving one drug removes work from part of an order. When every drug in an order is either corroborated NAR or already authorized, there is no remaining drug that needs a new authorization. The drug-level shortcut therefore becomes an order-level no-touch path.

7:478:00
Suggest correction

This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.

7:47 · section reference included

Keep payer rules tied to their applicable period

The payer-rule database needs more than a permanent yes-or-no label for each drug. Its source documents describe rules over time. RISA uses configurable LLM extraction for different document types to obtain drug-wise constraints: which payer the rule concerns, how the drug is treated for authorization purposes, and the period during which that treatment applies.

Document extraction is supplemented by historical information about how a particular organization handles a drug, plus regular portal checks. These inputs feed the same knowledge base, giving authorization classification evidence beyond the patient’s notes.

Diagram titled Building the Payer Rule Knowledge Base shows payer documents passing through an LLM into drug-wise constraints, with historical payer documents and regular portal checks also feeding the database.
Payer documents, historical information, and portal checks feed a drug-wise constraints database.

At this stage, the pipeline could reject or flag unverifiable cases at the eligibility gate, then use corroborated drug statuses to resolve a subset of the remaining orders. It had removed review from cases whose authorization status could be established from available information. The unresolved category was drugs that actually required authorization.

9:5910:14
Suggest correction

This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.

9:59 · section reference included

Answer clinical questions with supporting and contradictory facts

Drugs that require authorization introduce a different task. The earlier paths established an existing status from evidence; these cases need clinical reasoning about whether the patient meets the relevant requirements. They also need supporting evidence for the answers submitted to the payer. The medical necessity agent handles simple and complex patient-specific questions, attaches a confidence score to each answer, and escalates cases that need a clinician.

For each new order, the agent follows an evidence-to-answer sequence:

  1. Read the patient’s notes and the policy criteria for processing the drug.
  2. Use those criteria to query a patient medical graph containing extracted biomarkers.
  3. Retrieve the relevant biomarkers and information about the patient’s condition.
  4. Pass that information to an LLM to produce an answered questionnaire, including both supportive and contradictory facts.

The policy criteria direct retrieval toward the clinical questions that must be answered. Preserving contradictory facts also keeps the output from becoming only a collection of evidence in favor of authorization.

Cases advance when the agent has relevant information and can answer with sufficient confidence. When the evidence is insufficient, they remain for human escalation. The talk does not specify a confidence threshold or calibration method, so this is an architectural routing boundary rather than a reproducible numerical decision rule.

11:3411:52
Suggest correction

This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.

11:34 · section reference included

Carry qualified cases through to submission

The completed flow starts with patient data and eligibility verification, flags ineligible orders, and classifies the drugs in the remaining orders. Corroborated NAR and existing authorizations take the shortcut; drugs that need authorization undergo medical necessity evaluation. Cases that do not meet those requirements move to review. The system then assembles the information for submission to the payer.

The submission agent uses an integration approach similar to the EV agent: payer-specific integrations built from LLM-driven configurations and the shared repository of tools. The same strategy that retrieves information at the beginning of the workflow supports sending it back at the end.

The complete graph shows the selectively automated paths in green, alongside failure and review branches. Some drugs avoid medical necessity evaluation because their authorization status is already resolved; others reach submission after that evaluation. Human review remains an explicit outcome for cases that do not qualify for the automated path.

Flowchart connects patient data fetching, eligibility verification, authorization determination, medical necessity, and submission. Green paths include no-auth-needed and already-authorized shortcuts; red branches show eligibility failure and review outcomes.
The complete pipeline shows authorization shortcuts, medical necessity evaluation, submission, and review branches.
13:5114:05
Suggest correction

This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.

13:51 · section reference included

Extend the agents beyond prior authorization

Although these agents were initially built for this authorization workflow, RISA has reused them across other workflows. The medical necessity agent, for example, has been generalized to answer patient-specific questions outside this original use case. The other agents have also been extended for broader use. Their responsibilities—retrieving coverage, establishing authorization status, answering clinical questions, and interacting with payers—provide reusable boundaries.

Shankhdhar reports that the share of orders handled without human touch is growing, without specifying a percentage or evaluation period. That expansion follows the order in which the system was built: deterministic checks first, multiple sources of evidence to strengthen authorization decisions, self-healing to support portal automation, and finally a reasoning layer for cases that truly require authorization. Human review is removed where the workflow has enough evidence to proceed, while unresolved cases retain a route to review.

15:2715:52
Suggest correction

This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.

15:27 · section reference included

Resources

Updates since the talk

  • Public overview of RISA's workflow APIs with links to documentation and a sandbox.

Read the complete timestamped transcript
  1. 0:00

    Hi, everyone. Uh, my name is Anant Shankhdhar. I am an AI engineer at RISA, and I'll be talking about oncol-- automating oncology workflows from end to end.

  2. 0:12

    So at RISA, we are automating various workflows in oncology. One of such workflows is prior authorizations, where we, uh, file for authorizations for drugs for cancer patients. So, uh, I'll give a brief overview about the workflow before we m-move further in the call.

  3. 0:31

    So, the first step is that we intake the orders that we get on a daily basis. The second step is we verify whether the patient is actually very, uh, eligible for getting the drugs based on the amount that they have in insurance available with them.

  4. 0:46

    This is called eligibility and benefits ve-verification. Uh, next, uh, we determine what all drugs in the-- for the patient require authorization. So, a drug can basically fall into one of the following pathways.

  5. 1:02

    So one is NAR, which is no auth required. Basically, the drug does not re-require authorization. Another can be that the authorization has already happened for the drug for a time period, which is called auth on file.

  6. 1:14

    And the third is auth required, which means that the authorization needs to be performed for this drug. So yeah, this is the workflow. Uh, I was, uh... So although our bots run, uh, and perform these steps, finally a human review is required, you know, before submitting all these orders.

  7. 1:34

    I was ta, uh, tasked with the cha-- uh, with the problem to run, uh, some of these orders without any sort of human touch, uh,

  8. 1:45

    directly towards submission, which means I need to, uh, confidently identify which all orders can be proceeded without any human verification and then build the entire flow for them as well.

  9. 1:58

    So confidence is a key metric that we were working towards.

  10. 2:04

    So yeah. Uh, how we did this was using four agents, uh, namely EV agent, auth agent, necessity agent, and submission agent. EV agent is for el-eligibility and business verification, so basically fetching the patient data and determining whether it is, uh, fine for moving forward.

  11. 2:24

    Auth agent determines the, uh, ca-- type of the status of the drug, whether authorization is required or not. Uh, and the necessity agent is the clinical brain of syst-- of the system.

  12. 2:36

    So for the cases where authorization is required, we determine whether it has to be done on-- whe-whether it is right for the patient based on his vitals or not.

  13. 2:46

    And finally, we move towards submission. So, uh, starting with the first step, how do we do this without any human in the loop? So, one of the problems that we have here is that insurance details, insurance documents, everything is, uh, scattered across dozens of portals, APIs, and documents,

  14. 3:09

    and it is difficult to find that information at one place. So in order, uh, to, in order to start with our pipeline, uh, we

  15. 3:20

    need to get information from various portals as well as APIs. In order to do so, we built a unified service that connects to different payer sources and, uh, gives the output in a normalized uniform format, which we can use for da-- uh, processing further.

  16. 3:38

    And we also added a de-deterministic decision engine to flag the cases which would not move forward, thus, uh, deterministically, uh, fixing some of the orders without any human in the loop.

  17. 3:52

    So here's how it works. So we have a coverage orchestrator, which determines whether, uh, the patient will go for the API or the RPA path. RPA is basically the automation.

  18. 4:02

    Uh, we, uh, perform the actions for the RPA or call the API and get the output in a fixed coverage result format, which we then pass to our deterministic engine to determine whether the coverage is active or not.

  19. 4:19

    If it is, we move it fur-further in the PHN, else we stop that right there. Now, one of the problems we saw here was that, uh, if we have to build this, then we will need to make custom integrations for different sorts of portals, which is not, not a very scalable, uh, process.

  20. 4:40

    But how we tackled it was that we used LLMs in the roo-loop. So first of all, we made a huge repository of custom actions as well as popular actions that are required in, uh, to build RPAs.

  21. 4:55

    Then we built a LLM-based config generation, which performs these actions and builds the config for a ca-- uh, for a portal to run on, uh, which, uh, fix-- which reduces our development time significantly.

  22. 5:12

    And finally, uh, these, uh, automations are fragile, so it may happen that they break during the runtime. For this, we have a self-healing loop, which identifies these cases during production hours and then mitigates them, so tha-thus preventing any sort of failures.

  23. 5:32

    So yeah, that is the first step. Uh, once we have done this, we move further in our chain. So as we can see our diagram, the graph, uh, the patient data is fetched.

  24. 5:44

    We perform the eligibility verification. We see if it is fine or not. If it failed, we stop there, else we move forward.

  25. 5:53

    So yeah. Moving forward, uh, the next step was that deta-- uh, was to see, uh, what all drugs require authorization. So if I have to

  26. 6:08

    ... uh, remove humans from the loop, one simple case that I saw was that, uh, if a drug has already been authorized, uh, that is the authorization is on file, or if the authorization is not required, then we can partly solve the order.

  27. 6:25

    That is, that we do not need human oversight on that part of the order.

  28. 6:30

    Uh, so yeah. Uh, so as the first step, we built a simple LLM extraction pipeline, which takes in patients' notes, performs LLMs extraction, and categorizes the drugs into these types, the default being that authorization is required.

  29. 6:47

    However, uh, yeah, so we thought that this should-- would work, but we faced some issues here as well. So one popular issue was that, uh, the n-notes that we were using did not have enough data, which means that it was performing some, some errors.

  30. 7:07

    Uh, also, LLM, uh, extraction is sort of an indes-- uh, indeterministic process. That means that whatever outputs we get from here cannot be blindly trusted. So we still need a human to review all these things.

  31. 7:24

    It might improve the efficiency, but it will not eliminate the human. So in order to do so, uh, we thought that what if I add more evidence to it?

  32. 7:36

    So if the LLM is saying that a drug is not a no auth required, then I have some information backing that. I can say that confidently or for the auth on file cases.

  33. 7:47

    In order-- Uh, yeah. So in order to do so, we aut-- we leveraged two other data sources. So one was the authorization letters. So this was basically the previous information.

  34. 8:00

    So across the previous runs that a given patient has, they have authorization letters available, which shows that these drugs were actually authorized. So now, instead of just having one source, I have two sources that give me the same information, and wherever they concur, I can say with confidence that this drug has already been authorized.

  35. 8:21

    Second is the NAR case, the no auth required case. So here, uh, we found some other resources wherein from the portals or from some documents, we could find out that on a monthly basis, which are the drugs that the payer does not work for, the insurance does not work for, basically.

  36. 8:41

    So, uh, we use that information to build a payer rule knowledge base, which is basically a SQL database, uh, which was made from portal checks as well as LLM extractions.

  37. 8:54

    So we us-use all this information, we reconcile the evidence, and we on-- extract the auth ca-- auth statuses with a higher confidence. So if from this pipeline, we get whether a drug is not authori-- not-- does not require authorization or is already authorized, we have a solid proof behind it, uh, and a higher confidence, uh, to say

  38. 9:17

    that this is the case. And of course, all of this is configurable, so, uh, in order-- if some mishap happens, we always have a plug over the cases. So yeah.

  39. 9:31

    Uh, another-- a good thing that happened from here is that we noticed that certain orders were completely eliminate-- we could eliminate certain orders completely from these two type of drugs, because it may happen that an order does not actually requi-require authorization at all.

  40. 9:47

    The drugs are either n-uh, not requiring authorization or are actually authorized from before. So this enabled us no touch on a certain set of orders that we had.

  41. 9:59

    Yeah. Uh, this slide gives a big, uh, small overview on how we build the payer rule knowledge base for the NAR cases. So, uh, we had the documents which had this information on a time-wise scale.

  42. 10:14

    We built an L-LLM extraction, which uses LLMs, uh, which, uh, is configurable, so we can configure it on different types of documents, and we can perform the extraction, and we can get the drug wise constraint that for this payer, this is the ca-- this is how it will be treated for a period of time.

  43. 10:36

    Another thing is that we leverage some historical information. That is, that we know that a certain organization, uh, treats this drug in a certain sort of way, so we store that information and us-use that as well.

  44. 10:50

    Apart from this, we also use some regular portal checks to get this information.

  45. 10:56

    So yeah. Uh, performing this movement moved our needle forward a bit. So now we had these deterministic checks along with our initial eligibility verification. So whatever were not verifiable were flagged out before, and whatever moved forward, we could determine these statuses for the drugs, and we were able to eliminate some of the orders from here.

  46. 11:25

    So now that we've solved for two to- types of drugs, let's move forward.

  47. 11:34

    So the next problem that we faced here was that some decisions do actually need clinical reasoning. So, so far, the drugs that we were, uh, we shifted to no touch were the ones where the information was di-directly available or indirectly available via another source.

  48. 11:52

    But we did not need to perform any sort of reasoning over here or any sort of question answering. However, for the drugs that are actually auth required, we need to, uh, check whether the patient is actually eligible for them and also sup-- uh, give sort of supportive evidence from where we are answering this inform-- uh, we are

  49. 12:15

    giving this information. So in order to do this, we built our third agent, which is the medical necessity agent. So the medical necessity agent answers simple and complex clinical questions per patient, uh, and attaches confidence score to any answer.

  50. 12:32

    So we escalate only the ones that actually need a clinician. Uh, so we did a lot of work on this space. We actually have another-- uh, have a publication here as well, which I have mentioned.

  51. 12:45

    So how this agent works is that, uh, we have a new order, and for every order, we read three things. So we read the patient notes, we read the policy criteria.

  52. 12:56

    So the pol-- uh, policy criteria is basically the criteria that needs to be met in order for this drug to be processed further. Uh, we, uh... From this criteria, we query the patient medical graph, which is a graph of, uh, biomarkers that are extracted for a patient.

  53. 13:14

    And we determine wha-what all biomarkers exist and what is the condition of this patient from here. And then we use this thing, these in-- this information and pass it to an LLM to get an answered que-questionnaire with all the supportive and contradictory facts.

  54. 13:32

    So, uh, yeah. And, uh, if we have the relevant information or we are able to determine this with a higher confidence, we move this forward. And for the cases we do not have this enough information, uh, we move-- keep that for human escalation.

  55. 13:51

    So yeah, uh, this is the next step. Uh, so after, uh, this medical, uh, ne-necessity validation, uh, we moved from, uh, f-the first step where we fetched the data.

  56. 14:05

    We did the eligibility verification. We flagged the orders that were not eligible, moved the rest forward, extracted the no auth needed and already authorized letters, uh, got the, got, uh, the cases where we can move that without any human intervention, and then we did the medical necessity evaluation.

  57. 14:26

    Uh, whatever was not met was also m-moved to review. So yeah. Finally, we assemble all this information, and then we submit it back to the payers.

  58. 14:38

    So this is where our submission agent comes into place. The submission agent is pretty much similar as the EVV agent. We have customized integrations for every sort of payer that we have, uh, which is built using an LLM-driven config as well as our repository of tools.

  59. 14:57

    So yeah, this is the entire graph, uh, uh, that we got through the entire journey. Uh, so the green part shows the cases that we are going without human touch.

  60. 15:08

    So whenever eligibility verification passes, uh, then, uh, en-enough information is found to not-- to prevent the drug from going for further medical ev-- necessity evaluation, then this, uh, medical necessity evaluation and the submission.

  61. 15:27

    So yeah. Finally, I'd like to mention that, uh, these drugs are also al-although built initially for this case, are being used across multiple workflows. Uh, we have extended the func-functionality to a more general one, uh, where the medical necessity agent can answer que-questions specific to any sort of workflow for the patient.

  62. 15:52

    Uh, similarly for the other agents as well.

  63. 15:56

    So yeah. Uh, as the conclusion, I would say the no touch is growing on the share of every order. Uh, so we started with deterministic checks, uh, agents only for the rules that-- where what rules can't decide.

  64. 16:11

    Uh, we used multi-source of evidence, uh, to beat the single source of evidence to add confidence to our cases. Uh, we added self-healing in order to scale our RPAs.

  65. 16:24

    And finally, we added the reasoning layer in order to deal with the cases where actually authri-- uh, auth-authorization is required. So yeah. Thanks for the, uh, yeah, thanks for your time.

  66. 16:36

    Uh, yeah. Bye-bye.