Your biller's desk on a Monday morning tells the whole story of this article. Half her work is typing: checking eligibility, keying charges, resubmitting the same claim with one field changed. The other half is judgment: reading a doctor's note and deciding what it really supports, smelling a denial before it happens, knowing that one payer wants the modifier here and another wants it there. Artificial intelligence is coming for the first half. It isn't coming for the second half yet, and the distance between those two halves is where every honest answer about AI in medical billing lives.

Here is the map. The mechanical work is already automated, and that part is not news. Coding AI is real but narrow, and its accuracy numbers need an auditor's eye. The payers are automating too, and the law has started pushing back. The true brake on all of it isn't the technology. It's HIPAA, plus a signature rule nobody can delegate. And the companies building these tools are struggling with problems that will sound familiar to anyone who has ever read a payer policy. The typing is being automated. The judgment — and the signature — are not.

The mechanical work crossed the finish line years ago

Eligibility checks and claim submission are already almost fully electronic (96% and 98% respectively, across more than 600 provider organizations in the CAQH Index 2025), which means the simple plumbing of billing was solved before anyone said the words "artificial intelligence." What's still manual is exactly the work that requires reading and deciding: prior authorizations are fully electronic only 40% of the time, and claim attachments only 24% of the time. That gap is the territory AI is now entering.

It's entering because the pain is real. In Experian Health's 2025 survey of 250 revenue-cycle leaders, 41% said their denial rates run at 10% or higher — nearly half of providers losing at least a tenth of their claims on first pass. Yet only 14% of them use AI against denials today. A big problem, a tool still in few hands: that's the honest snapshot of 2026.

Coding AI exists — in a few rooms, with a human at the door

Software that reads a clinical note and assigns the codes by itself is in production, but the first KLAS evaluation of autonomous coding, in 2025, describes an early market that works best where medicine is most templated (radiology, emergency care), with only three vendors — Fathom, CodaMetrix and Nym — having enough live customers to evaluate. Think of it as a fast resident: excellent on the routine cases, not yet trusted alone on the complicated ones.

Scale exists, but mostly in big houses. Epic reports that more than 200 organizations use its coding AI, Penny, and that the most active users saw coding-related denials fall by more than 20%. Worth knowing, and worth labeling: those are Epic's own figures, not an independent audit. For a small practice, the realistic door is different. When athenahealth folded AI features into athenaOne at no extra cost in late 2025, it showed the route most small offices will take: AI inside the system you already pay for, not a separate product to shop for. The AMA's 2026 survey of 1,692 physicians fits that picture — 81% use some form of AI, but only 28% use it for documenting billing codes. AI is in the building. It's barely in the billing office.

Every accuracy number deserves the question: measured how?

In July 2026, the U.S. Government Accountability Office reviewed the evidence and reached an uncomfortable conclusion: few independent studies exist, and these tools' accuracy is difficult to verify. No neutral party has run the vendors head-to-head. Instead, each vendor grades its own homework.

The independent numbers that do exist are sobering. In a 2024 study published in NEJM AI, GPT-4 matched the exact ICD-10-CM code only 33.9% of the time and the exact CPT code 49.8% of the time across 27,320 code descriptions — and sometimes invented codes that don't exist, the way a confident trainee might write a plausible-sounding drug name that isn't in the formulary. A fine-tuned model did far better in a 2025 study, reaching about 97% on code descriptions, but fell to 69.2% exact matches against real clinical notes. The exam is not the clinic.

That's also how to read the 95–98% accuracy figures in vendor brochures. They're measured on the subset of cases the software chose to code on its own, the straightforward ones. The difficult charts never enter the photo. The number can be true and still not answer your question: what happens on my hardest 20% of visits?

The payers automated first — and the law is pushing back

Your side isn't the only side. A U.S. Senate investigation found that UnitedHealthcare's post-acute prior-authorization denial rate rose from 8.7% to 22.7% between 2019 and 2022, the years its predictive tools spread, a denial rate nearly tripling while the company insisted humans made the final calls. Lawsuits against UnitedHealthcare, Humana and Cigna over AI-driven denials are working through the courts; those are allegations, not verdicts, but legislatures didn't wait for verdicts. California's SB 1120, in force since January 2025, and laws in Texas, Arizona, Maryland, Nebraska and Illinois now bar AI from being the sole basis of a medical-necessity denial: a licensed professional has to make that call.

Even Medicare is experimenting on itself. CMS's WISeR pilot, running 2026 through 2031 in six states, uses AI plus licensed clinicians to review certain services, and its first months produced documented stumbles and a fight in Congress. One regulatory change, though, is solid ground: from January 1, 2027, Medicare Advantage, Medicaid and marketplace plans must offer standardized electronic prior-authorization interfaces under rule CMS-0057-F. When the pipes are standard, automating through them gets easier for everyone, your office included.

HIPAA is the brake — not the technology

Here is the part the keynote speeches skip. Before a single line of patient data touches an outside AI, federal law requires a signed Business Associate Agreement: a BAA, the contract in which the vendor accepts HIPAA duties (45 CFR 164.502(e)). The ChatGPT or Gemini account anyone can open signs no BAA, which is why pasting a patient note into a consumer chatbot isn't a gray area. It's a violation waiting for a date. Compliant versions exist inside enterprise clouds that do sign, but a BAA still doesn't let the vendor train its models on your patients' data.

Regulation has not caught up with any of this. As of mid-2026, the federal privacy office has published no AI-specific HIPAA guidance. The modernized Security Rule proposed in January 2025, which would require practices to inventory the AI tools touching their data, is still not final; its target has slipped to July 2027. Meanwhile the cost of trusting the wrong vendor is written in one number: the Change Healthcare breach of 2024 exposed the data of roughly 193 million people, about one in every two Americans, through a single company most practices never chose directly. Until the rules are written, cautious adoption isn't technophobia. It's compliance.

The builders are fighting your fight: ambiguity, variability, blame

It helps to know why progress is slower than the brochures. The people building these systems face a code set of more than 72,000 ICD-10-CM codes and over 10,000 CPT codes, two catalogs the size of a small city's phone book, with hundreds of changes landing every year, each one a retraining for the machine. Layered on top is the variability you already know from your own desk: every payer reads the rules slightly differently, so software that satisfies one payer's policy can fail another's on the same visit.

The deepest problem is upstream, in the note itself. In the 2025 fine-tuning study, the model's errors on real notes were dominated by codes the documentation didn't support (42%) and diagnoses whose criteria weren't fully documented (38%). That's a precise way of saying the AI fails where your coder fails: when the note doesn't say enough. A note that reads "heart failure, continue meds" without type or acuity is a prescription without a dose; no coder, human or machine, can bill it at its full value honestly. And when the machine guesses wrong anyway, the law is clear about who pays: liability under the False Claims Act sits with the provider whose NPI signs the claim. "The AI suggested it" isn't a defense, and vendor contracts are written to keep it that way.

What this means for your office — and for your biller

Expect the work to change shape before it shrinks. The federal Bureau of Labor Statistics still projects medical records specialists to grow 7% between 2024 and 2034, and certified coders reported 2.5% unemployment in the AAPC's 2024 survey — numbers that describe a profession moving toward auditing the machine's output and working the exceptions, not one being deleted. MGMA's polls show the adoption wave is real (68% of responding practices added or expanded AI in 2025), though each survey measures something different, so treat the trend as direction, not decimals.

Two practical expectations hold up. First, price discovery will annoy you: the leading autonomous-coding vendors publish no prices at all, so every evaluation is a sales process, not a web page. Second, the first real savings in a small practice won't be a salary. They'll be hours: fewer evenings reworking denials, fewer authorization phone trees, a biller whose judgment finally gets spent on the 20% of claims that need it instead of the 80% that never did.

What to expect next — expectations, labeled as such

Everything below is expectation, not fact; the difference matters.

In the next one to two years, expect the standard prior-authorization pipes of January 2027 to make authorization software genuinely better, and expect your EHR's built-in coding suggestions to become the default way small practices meet AI — bundled, cautious, human-approved. In three to five years, expect autonomous coding to expand specialty by specialty where accuracy gets independently audited, and expect the delayed HIPAA security rule to finally draw the compliance lines everyone is currently guessing at. Beyond five years, honest people disagree: the models will surely be stronger, but the binding constraint is likely to be liability and politics — who answers when the machine is wrong — rather than what the software can do. Anyone who promises you a date for a biller-free office is selling something.

So the Monday-morning version is this. Let the machine do the typing where a signed BAA covers it and a human reviews what matters. Ask every vendor one question — "measured how, on which cases, audited by whom?" — and enjoy the silence. Keep your name on the signature line with your eyes open, because it stays yours either way. The typing is being automated. The judgment, and the signature, are not.