Every denial should carry its own audit trail. When a health plan denies a request today, the record of how it decided is spread across several systems. Intake holds the request. A criteria tool holds the guideline that was applied. The reviewer’s notes sit in a case file, and the letter comes from a template engine. When an appeal or a regulator asks how the decision was made, someone has to put those pieces back together.
A record rebuilt after the fact is weaker than one written at the time. It depends on what each system kept. It also depends on whether anyone can tell which version of the guideline the reviewer actually saw. The fix is to write the trail as the decision happens, and to bind it to the decision so the two cannot drift apart.
What the trail should hold
A denial’s audit trail is a short list of events. Each event has a time and an author. The list below is the minimum we would want.
- The request as received. The request and its attachments, fixed at the moment they arrived.
- What the reviewer saw. Each document the reviewer opened, with its version. A record added after the decision should show up as added later.
- The criteria version. The guideline that was applied, identified by version, so the same text can be produced later.
- Any machine recommendation. The suggestion software made, if any, with the facts it cited.
- The person who decided. The reviewer’s license and specialty, with the time of the decision.
- What was sent. The letter or electronic response exactly as it went out.
A short trail for a denied imaging request might read like this.
| Elapsed | Event | Author |
|---|---|---|
| 0 min | Request received with 2 attachments | Intake |
| 38 min | Imaging policy version 4.2 applied | Criteria tool |
| 39 min | Could not approve, so routed to a reviewer, citing no therapy notes in the record | Software |
| 5 hr 13 min | Opened 2 office notes and the imaging order | Reviewer, orthopedics |
| 5 hr 30 min | Denied because criterion 3 was not met | Reviewer, orthopedics |
| 5 hr 38 min | Letter sent | Letter engine |
This is an illustrative example. It is not a real case.
None of this is exotic. Most plans already capture much of it somewhere. The difference is that the trail is written at the time and kept with the decision.
Each event can carry a cryptographic hash of the one before it. Changing any entry later would break every hash that follows. The plan can then print a short fingerprint of the finished trail on the letter and include it in the electronic response. Anyone holding the letter can check that a trail produced later is the one that existed when the letter went out.
The record itself stays in the plan’s systems. Only the fingerprint travels. Our piece on Hyperledger Fabric used the same idea for health data on a shared ledger, where the hash proves a record has not changed.
Standards for the events exist. HL7 FHIR defines a Provenance resource that records who was involved in creating or changing a record. It can carry a digital signature, according to the FHIR specification.
Why the trail should travel with the decision
The rules already ask for pieces of this record. Under the federal claims rules for employer plans, a claimant can ask for the documents relevant to a claim free of charge. Relevant documents include those that show the plan followed its own processes and safeguards, under 29 CFR § 2560.503-1. A plan that assembles that showing after a request is reconstructing history. A plan with a trail can hand it over.
Medicaid managed care enrollees have a right to free copies of the records behind a denial, as our piece on denial letters described. Since January 2026, CMS has required payers to give a specific reason for each prior authorization denial, according to CMS’s fact sheet.
States are asking about the machines. California’s Physicians Make Decisions Act was signed in 2024. It requires that an AI tool used in utilization review be open to inspection by the state’s managed care regulator for audits and compliance reviews, according to Sheppard Mullin. The tool’s outcomes must also be reviewed periodically. Our review of state utilization review laws in 2026 found more states regulating the reviewer as well as the clock.
Courts are asking too. In the lawsuits over algorithmic denials, the question has often turned on what insurers told members about how decisions are made, as our piece on AI denial litigation described. A plan’s best answer is a record written at the time. It should show what the software suggested and what the person decided.
A denial that cannot be reconstructed cannot be defended. It cannot be corrected either.
What it would take
The engineering is modest. An append-only log with chained hashes is a well-understood design, and the storage it needs is small.
The discipline is harder. Every system that touches a decision has to write to the same trail with the same case identifier. Those systems often come from different vendors. A shared event format would help, and FHIR’s Provenance resource is a reasonable place to start.
There are fair objections. A complete trail is also a complete record for a plaintiff. But a plan that cannot show how it decided is in a worse position than one that can, and regulators are already asking. A trail also helps a plan find its own mistakes. A bad guideline shows up as a run of overturned denials that all cite the same version.
Redlake builds tools that health plans use in utilization review. We hold ourselves to a rule that every decision can be reconstructed. The audit trail is how that rule becomes real. It also makes our other rules checkable. A machine can say yes, but only a person can say no. The trail shows which of them said no.