Compliance
Agents Need a Prescriber: Authorization Is the Missing Layer in Healthcare AI
Healthcare AI has spent two years rebuilding patient identity, which already has federal standards and working infrastructure. The unsolved half is delegated authority, and the mature template for it has existed at every pharmacy counter for decades.
Quick answer
A healthcare AI agent that acts needs the same five properties a prescription has carried for decades: a scoped grant, a named authorizer with a license on the line, a complete audit trail, revocability, and one accountable human at the end. Patient identity already has federal rails (TEFCA, FHIR, CMS-0057). Delegated authority is the layer still missing, and the prescription is its working template.
Key takeaways
- Patient identity in US healthcare is largely solved infrastructure: TEFCA for exchange, FHIR for access, UDAP for credentials, and CMS-0057 obliging large payers to expose patient access, provider access, and prior authorization through APIs by 2026 and 2027.
- An agent that reads a record is a query. An agent that renews a prescription, books a procedure, or files a claim is exercising delegated authority, which is a different problem in kind.
- The prescription is healthcare's mature model of delegated authority: scoped grant, named authorizer, complete audit trail, revocability, and one accountable human.
- The software version is a consent ledger: boring, append-only, binding the agent, the scope, the signing human, the expiry, and the revocation handle.
- Utah's Department of Commerce has already authorized Legion Health's AI to renew certain psychiatric prescriptions under state supervision, with audit requirements attached.
Every health-technology company is shipping an agent that acts on a patient's behalf. Almost none of them can answer the only question that matters the first time one of those agents goes wrong: who authorized this, and can you prove it?
The industry has spent two years and a great deal of venture capital on the wrong half of that question. The identity half, establishing who the patient is and reading their chart, has federal standards and functioning infrastructure behind it. The authority half, who said this agent may act, under what scope, with what audit trail, and who answers for it, is mostly missing. Healthcare solved that problem decades ago with paper and signatures. The solution is called the prescription, and the agents merely have to catch up.
The easy half was solved while nobody was looking
Patient identity has rails. TEFCA provides the exchange framework, FHIR the access standard, UDAP the credentials, and information-blocking rules carry genuine penalties. CMS-0057 obliges the large payers to expose patient access, provider access, and prior authorization through APIs, with deadlines landing in 2026 and 2027. If an agent needs to establish who the patient is and read the record, the infrastructure exists. It is slow, bureaucratic, and faintly ugly, but it is real, and rebuilding it is a waste of a funding round.
The hard half is different in kind. An agent that reads a record is a query. An agent that acts, that renews a prescription, books the procedure, or files the claim, is exercising delegated authority. Identity answers "who is this person." Authority answers "who allowed this action, and who carries the liability for it." Nearly every "verify the patient" pitch an operator will sit through this year is the easy half wearing the hard half's clothes, because identity demonstrates well and authorization is legal work that does not screenshot.
The prescription is the working template
American healthcare already possesses a mature model of delegated authority, and every pharmacy counter in the country runs on it. Consider what a prescription actually carries:
- A scoped grant. This drug, this dose, this many refills. Never "access to my health."
- A named authorizer. The prescriber, NPI attached, license on the line.
- A complete audit trail. Written, transmitted, dispensed; every hop logged.
- Revocability. The prescriber can cancel, and the pharmacy checks again before filling.
- One accountable human at the end of the trail, the one who gets woken when something goes wrong.
That is the entire shape of agent authorization: scoped grant, named authorizer, logged, revocable, one accountable human. Software agents need the same five properties, plus a machine that verifies them at speed.
What authorization looks like in software
The working version is a consent ledger: boring, append-only, no blockchain required. Each entry binds five fields: the agent, the scope, the human who signed, the expiry, and the revocation handle. When the agent acts, the counterparty, be it pharmacy, payer, or clinic, consults the ledger exactly as a pharmacist consults a prescription. No entry, no action. Grants expire on schedule; the signer can kill one from a phone.
None of this requires new technology. Scoped tokens, signed consents, append-only logs: all of it sits on the shelf. What it requires is a party willing to put its name on the grant and carry the liability. That willingness is the actual moat in healthcare AI, because it cannot be demoed and it cannot be faked.
Utah already opened the door
This stopped being theoretical in the spring of 2026. Utah's Department of Commerce signed a regulatory mitigation agreement permitting Legion Health's AI to renew certain psychiatric prescriptions under state supervision, with audit requirements attached. Read that again: a software agent exercising clinical delegated authority while a regulator watches. The prescription model, extended deliberately to software. Meanwhile the identity crowd debates the lock while Utah tests the door.
How we built it
neolife runs on this template because the order rail cannot work any other way. Every order on the rail carries a scoped grant: this patient, this medication, this quantity. Every order is reviewed and approved by a named, licensed provider, with per-state licensing enforced before the approval is accepted. The audit trail is append-only: intake, review, approval, routing, fill, and delivery are each stamped as they happen, and nothing overwrites what came before. Approvals can be revoked, and the pharmacy sees the current state of the grant before it fills. And there is one accountable human on every order: the provider whose license is attached to the approval.
Operators evaluating healthcare AI over the next two years will sit through a hundred identity demos. The question that separates infrastructure from theater is shorter: show me the grant. The builders who matter will be the ones who made authorization boring: scoped, signed, logged, revocable, and owned by one human who answers the phone.
The technology is trivial. The liability is the product.
Primary sources
Frequently asked questions
Isn't patient identity still the hard problem in healthcare AI?
No. Identity has federal standards and functioning infrastructure: TEFCA for exchange, FHIR for access, UDAP for credentials, and information-blocking rules with real penalties. CMS-0057 obliges the large payers to expose patient access, provider access, and prior authorization through APIs on 2026 and 2027 deadlines. The rails are slow and bureaucratic, but they exist. The unsolved problem is authority: who allowed the agent to act, and can you prove it.
What does a prescription have to do with software authorization?
A prescription is a delegated-authority instrument that healthcare has refined for decades. It carries a scoped grant (this drug, this dose, this many refills), a named authorizer (the prescriber, NPI attached), a complete audit trail (written, transmitted, dispensed), revocability (the prescriber can cancel, and the pharmacy re-checks before filling), and one accountable human at the end. Those five properties are exactly what an acting software agent needs.
What is a consent ledger?
An append-only record where each entry binds five fields: the agent, the scope of the grant, the human who signed, the expiry, and the revocation handle. When the agent acts, the counterparty (pharmacy, payer, clinic) consults the ledger exactly as a pharmacist consults a prescription. No entry, no action. Grants expire on schedule and the signer can revoke from a phone. No blockchain required; the boring version is the correct version.
Has any regulator actually allowed an AI to exercise clinical authority?
Yes. In 2026 Utah's Department of Commerce signed a regulatory mitigation agreement with Legion Health permitting its AI to renew certain psychiatric prescriptions under state supervision, with audit requirements attached. A software agent exercising clinical delegated authority while a regulator watches: the prescription model, extended deliberately to software.
What does this mean for a telehealth operator evaluating AI vendors?
Ask one question of every demo: show me the grant. If the vendor can show the scoped authorization behind each action, who signed it, when it expires, and how it revokes, you are looking at infrastructure. If the demo centers on verifying the patient, you are looking at the solved half wearing the unsolved half's clothes.
This article is operator education, not medical, legal, or tax advice. Telehealth and pharmacy regulation vary by state and product and change frequently. Verify the specifics for your business with qualified counsel and your pharmacy partner.