Prior authorization should prove a fact, not ship the chart. A coverage criterion might turn on a lab value above a threshold. Another might turn on a course of therapy that lasted 6 weeks. Yet a request often arrives with dozens of pages of notes, because sending everything is the easiest way to show the facts are in there somewhere.
The reviewer reads the packet to find a single number. Everything else in it travels along. That can include medication history and notes about family life. None of it was needed for the decision, and all of it now sits in another organization’s systems.
HIPAA already points the other way. The Privacy Rule counts utilization review, including preauthorization, as payment under 45 CFR § 164.501. Disclosures for payment fall under the minimum necessary standard. A provider may rely on a plan’s request as the minimum necessary when that reliance is reasonable, according to HHS. In practice, the size of the disclosure is set by what the plan asks for.
A proof instead of a packet
Cryptography offers 2 ways to send less while proving more.
The first is selective disclosure. A lab signs a result record when it issues it. The provider can later reveal only the fields a plan needs and hide the rest. The test name and date might be enough. The signature still checks out on the fields that were shown. The W3C has a cryptosuite built for this, known as BBS. It was still in development when the W3C published its other verifiable credential standards in May 2025, according to the W3C’s overview.
The second is a zero-knowledge proof. It shows that a statement about hidden data is true without revealing the data. Google released its zero-knowledge libraries as open source in July 2025 so that people could prove they are over 18 without handing over their birth date, according to Google. The same post noted that the EU’s digital identity rules encourage member states to build such proofs into their wallets.
A prior authorization version would work the same way. Suppose a request needs proof that a lab value crossed a threshold within the last 90 days.
- The lab signs. The lab issues the result as a signed record, the way a licensing board could issue a license.
- The provider proves. The provider’s system produces a proof that the signed value meets the threshold. It also proves that the test date falls inside the window.
- The plan checks. The plan verifies the proof against the lab’s public key. It learns that the criterion is met and that the data came from the lab.
The plan never sees the value itself or any other result. It sees a yes it can verify. This is an illustrative design, not a description of any product in use today.
A reviewer who needs 1 number should not have to read 40 pages to find it.
The pieces are not new to health care. Our piece on signed credentials described how SMART Health Cards carried vaccination records as signed data for more than 150 million people. Signed lab results would use the same idea for a different record.
Why plans should want less
Every chart a plan collects is a chart it must protect. The 2024 cyberattack on Change Healthcare affected about 190 million people, UnitedHealth said in January 2025, according to Chief Healthcare Executive. Records that a plan never received cannot be taken from it.
Less data also means faster review. A reviewer who receives a verified statement that a criterion is met has nothing left to search. When every criterion for a request is proved, software can approve it on the spot.
The proof also states its own reason. It names the criterion it satisfies and the source of the data behind it. That fits the documentation step of the prior authorization API, which already asks targeted questions instead of requesting whole records. Our piece on the API deadline described how that step fills answers from the chart. A proof would add one thing those answers lack, which is evidence that they came from a signed source rather than a typed field.
Where proofs fit and where they do not
Proofs fit criteria that can be stated precisely. Thresholds on lab values and vital signs can be checked by a proof. So can date ranges and counts of visits. A criterion that calls for clinical judgment cannot. When a policy asks whether conservative care failed, a clinician has to read what happened.
That limit argues for sorting criteria, not for giving up on proofs. Many policies mix a few precise thresholds with a judgment call. The thresholds can be proved without disclosure. The judgment can be documented in a short narrative that the provider writes for the purpose. Our piece on publishing criteria like code argued that precise criteria should be published in a form software can test. The same precision is what makes a proof possible.
The approach needs signing at the source. Labs and EHRs would have to sign the records they issue. Standards bodies would need common formats for the most frequent statements, so that a proof built for one plan works for the next.
Audits do not go away. A plan or a regulator may still need the underlying record later. An appeal or a payment audit can require it. The proof changes what moves by default. It does not end anyone’s right to look when there is a reason to.
Redlake builds tools that health plans use in utilization review. A machine can say yes, but only a person can say no. A request whose criteria are all proved can be approved by software. A request that fails a proof, or cannot produce one, should go to a clinician who can ask for the records that matter. Every decision should also be possible to reconstruct, and a verified proof is a record that reconstructs itself.