Prior Authorization Management — Integration

​

Table of Contents

• Overview
• Quick Reference
• Integration Points (from Spec)
• API / Data Contracts
• Event Contracts
• Security and RLS
• Related Docs

​

Overview

​

Quick Reference

​

Integration Points (from Spec)

​

API / Data Contracts

​

PM-08 → PM-10: Authorization Verification at Claim Scrub

-- Claim scrub checks active authorization for patient/service/date
SELECT id, authorization_number, status, approved_units, used_units,
       approved_start_date, approved_end_date
FROM pm_prior_authorizations
WHERE organization_id = p_org_id
  AND patient_id = p_patient_id
  AND status = 'approved'
  AND approved_start_date <= p_service_date
  AND approved_end_date >= p_service_date
  AND deleted_at IS NULL
LIMIT 1;

• If found: claim passes auth check; used_units may be incremented on claim payment.
• If not found: claim flagged with scrub warning “No active authorization found.”

​

PM-10 → PM-08: Used Units Update

// In payment posting flow
await supabase
  .from('pm_prior_authorizations')
  .update({ used_units: newUsedUnits })
  .eq('id', authorizationId)
  .eq('organization_id', orgId);

​

CL-16 (Da Vinci PAS): FHIR PA API

• Da Vinci CRD STU 2.0.1: Coverage Requirements Discovery
• Da Vinci DTR STU 2.0.0: Documentation Templates and Rules
• Da Vinci PAS STU 2.1: Prior Authorization Support

​

Event Contracts

​

PM-10 → PF-10: Authorization Expiration Alert

{
  event: 'prior_auth_expiring';
  publisher: 'PM';
  subscriber: ['PF'];
  payload: {
    authorization_id: uuid;
    authorization_number: string;
    patient_id: uuid;
    approved_end_date: date;
    days_until_expiry: number;
  };
  metadata: {
    organization_id: uuid;
    timestamp: timestamptz;
  };
}

​

PM-10 Status Transition Events

// Published on status transitions
{
  event: 'prior_auth_submitted' | 'prior_auth_approved' | 'prior_auth_denied';
  publisher: 'PM';
  subscriber: ['CL', 'PM'];
  payload: {
    authorization_id: uuid;
    patient_id: uuid;
    payer_id: uuid;
    status: string;
    service_type: string;
  };
  metadata: {
    organization_id: uuid;
    user_id: uuid;
    timestamp: timestamptz;
  };
}

• CL-08 (CDS): Alert clinicians when authorization is approved or denied
• PM-08: Gate claim submission on active authorization

​

Security and RLS

• All access to pm_prior_authorizations and pm_auth_reviews is tenant-isolated via organization_id and RLS.
• FORCE ROW LEVEL SECURITY enabled on both tables.
• RLS policies use pm_has_org_access(organization_id, auth.uid()) SECURITY DEFINER helper.
• pm_auth_reviews INSERT uses pm_prior_auth_can_insert_review(authorization_id, auth.uid()) to validate parent PA org access.
• UPDATE policies include both USING and WITH CHECK to prevent organization_id mutation.
• DELETE restricted to pf_is_org_admin(organization_id, auth.uid()).
• PHI: PA records and clinical justification are PHI; no PHI in logs or external API payloads beyond authorized use.

​

Related Docs

• PM-02 Insurance & Eligibility Verification
• PM-08 Claims Management (spec)
• CL-16 FHIR Interoperability
• CROSS_CORE_INTEGRATIONS.md
• EVENT_CONTRACTS.md
• Prior Authorization User Guide