Claims Payment Integrity

I will define the prefilter’s promise carefully: SKIP means we have deterministic evidence that this claim is outside vendor-review value under an approved policy; SEND means eligible; ABSTAIN means missing/ambiguous facts and defaults to the safe route. The platform never directly denies a claim. Claims core remains authoritative for payment, and vendors remain external reviewers. We own decision provenance, routing, findings, proposed actions and appeal linkage. I would ask what failure is more costly: an unnecessary vendor send or a missed recoverable overpayment.

V1 ingests versioned claims/lines, snapshots eligibility facts, evaluates deterministic effective-dated rules, routes SEND/ABSTAIN cases by vendor capability and capacity, reconciles vendor callbacks, and creates human-reviewed financial actions. It supports corrected claims, replay, appeals, sampled audits of SKIP decisions and shadow rollout. Every decision cites rules and facts. We exclude final clinical adjudication, autonomous denial, replacement of payment core and unreviewed model rules.

• SKIP precision has a stricter gate than overall accuracy.
• Corrections create new claim revisions.
• Vendor finding is evidence, not a financial transaction.

Ten thousand claims/day average 0.116/s, but 100/s bursts require queue elasticity. At $7/mock vendor review, sending all costs $70k/day. An 80% safe skip sends 2,000 and costs $14k, a gross $56k/day reduction before platform and missed-opportunity cost. That upside makes false-SKIP measurement essential. With 120k lines/day and perhaps 2 KB normalized per line, daily canonical data is roughly 240 MB plus indexes and evidence.

10,000 × $7 = $70,000/day baseline
20% × 10,000 × $7 = $14,000/day routed
Gross avoided fee = $56,000/day (mock only)

Claim has stable identity; ClaimRevision is immutable and keyed by revision with canonical total cents and source-event ID. FilterDecision pins revision, fact snapshot and PolicyBundle. One revision has one active decision per policy run. VendorDispatch has a unique deterministic reference and fee. VendorFinding is append-only and deduped by vendor ID. IntegrityAction proposes a delta but needs approval before claims core integration. Appeal references the action; an adjustment is separate. Invariants include line sum equals claim total, currency consistent, and one payable business action per approved action ID.

• Money uses integer minor units.
• Reason codes are stable analytics keys; text is versioned presentation.
• No mutable “current result” without revision lineage.

The intake edge authenticates the source, persists the raw event and canonical revision, and acknowledges. A fact service resolves enrollment, provider, duplicate and policy data into a content-hashed snapshot with freshness labels. The deterministic rule engine evaluates a compiled PolicyBundle and emits SEND, SKIP or ABSTAIN plus trace. A dispatch transaction writes decision and, for SEND/ABSTAIN, a VendorDispatch outbox. The router chooses a qualified vendor using capability, contract, queue age and deterministic weighted allocation. Adapters submit with idempotency references. Signed callbacks land in a raw inbox, dedupe, map to findings and create analyst tasks. All state transitions emit an audit outbox.

• Claims ingest lane is isolated from vendor backlog.
• Search/analytics are projections, not decision truth.
• Reconciler polls open dispatches when callbacks are missing.

Rules form a conservative decision list. Hard exclusions with complete facts may SKIP—for example already-reviewed identical revision, jurisdiction outside contract, or amount below an approved threshold when legally safe. Eligible patterns SEND. Missing critical data, conflicting totals, stale facts or unknown codes ABSTAIN and route. Each rule declares inputs, freshness, effective interval, outcome, stable reason and evidence template. A constrained DSL compiles to deterministic code. Before promotion, simulate on historical data and vendor outcomes; rule owners review false-SKIP samples.

Start in full shadow: still send all claims, but record proposed decision. Join eventual vendor findings and downstream confirmed recoveries to the exact claim revision. Compute SKIP precision as the fraction of proposed SKIPs with no material confirmed finding, with confidence bounds. Because vendor findings are imperfect, randomly dual-review a stratified sample of SKIPs and use internal audits. Slice by rule, provider, service, amount, geography, vendor and effective period. A rule promotes only after minimum sample size, no severe misses, financial-weighted loss below budget and reviewer approval.

• Delayed labels require a maturity window.
• Do not train/evaluate on outcomes created by the policy itself without correction.
• Keep a permanent exploration sample routed from SKIP.

Eligibility filters vendors by contract, claim type, region, data-sharing permission and current health. Among eligible vendors, use deterministic weighted allocation with capacity tokens and sticky hash for repeatable distribution. Dispatch has states PENDING, SENT_UNKNOWN, ACKED, RESULTED, CANCELLED and EXPIRED. A timeout triggers status lookup before resubmit. Vendor fee accrual is a ledger entry tied to accepted dispatch, reconciled against invoice. Findings propose recoveries separately; financial analysts approve actions, and a downstream outbox sends adjustments to claims core idempotently.

• Do not optimize only vendor hit rate; case mix may differ.
• Contract version and fee are frozen on dispatch.
• Reconciliation compares dispatch, callback, invoice and core adjustment.

Strong consistency protects claim revision insertion, filter-decision publication, dispatch creation, action approval and adjustment outbox. Fact indexes and dashboards are eventual. Source event ID dedupes intake; a different content hash for the same event is quarantined. Filter run key is revision + fact snapshot + policy. Vendor idempotency reference is stable across retries. Queues separate intake, facts, filtering, each vendor and action processing. If vendors saturate, intake continues; capacity tokens route elsewhere or backlog SEND/ABSTAIN with SLA priority. SKIP never results merely from overload.

Create ClaimRevision 2 and link it as superseding revision 1. Do not mutate the original dispatch. If vendor supports cancellation and no result exists, send a cancellation command idempotently; otherwise mark the result stale-on-arrival and preserve any contractual fee. Evaluate revision 2 independently and route as needed. The analyst UI groups revisions and forbids applying a finding from revision 1 without revalidation against revision 2. Payment actions reference one exact revision. Metrics track wasted dispatch fees due to corrections.

An approved IntegrityAction is immutable. Appeal opens a case with claimant evidence, deadlines and access controls. It may stay, reverse or modify the action; reversal creates an adjustment referencing the original, never deletes it. The appeal decision records reviewers, evidence and policy context. Overturns feed rule-quality analytics only after governance and delayed-label safeguards. A high overturn rate for one SKIP/SEND rule triggers shadow fallback or policy suspension, but an individual appeal never silently rewrites the rule.

• Preserve a complete financial chain: finding → action → appeal → adjustment.
• Appeal workload and age are first-class SLOs.
• Separate vendor disagreement from claimant appeal.

Circuit-break new sends to A after health/error thresholds. PENDING work can reroute if no attempt occurred; SENT_UNKNOWN cannot be sent elsewhere until status lookup or a contract-defined timeout proves non-acceptance, otherwise two vendors may bill and produce conflicting findings. Capacity-aware routing shifts new eligible claims to B/C up to their limits, with priority by financial exposure and SLA age. If all saturate, backlog with visible ETA and alert contract operations. Claims ingestion and filtering remain available.

Claims contain regulated health and financial data. Tokenize member identity, encrypt claim/finding/evidence with tenant keys, use private connectivity and field minimization per vendor contract, and isolate tenant/vendor credentials. Authorization combines role, tenant, purpose and case assignment. Analysts see minimum necessary data; bulk export and break-glass require reason. Signed callbacks prevent spoofing. Rule bundles and fact snapshots are signed/hash-pinned. Models, if used for analyst assistance, run in an approved boundary and cannot issue filter or payment decisions.

• Vendor A never receives fields contracted only to Vendor B.
• Logs use claim tokens, not diagnoses or member names.
• Retention/deletion propagates to vendor where contract requires.

Operational SLIs: intake durability/lag, fact freshness, filter p95, queue age, vendor ack/result SLA, unknown dispatch age, callback dedupe, adjustment outbox lag and reconciliation breaks. Quality: proposed SKIP rate, mature-label SKIP precision with confidence, severe misses, recovered dollars, vendor yield normalized by case mix, appeal/overturn by rule, and sampled-audit disagreement. Financial: fees accrued vs invoiced, avoided fee, confirmed recovery, false-positive analyst cost and correction waste.

• Alert on stale label joins before trusting metrics.
• Trace one claim revision through every rule/fact/dispatch/action.
• Invariant monitor: no two active dispatches unless explicitly dual-review.

Ingest and replay first, then shadow filter while sending 100%, then allow only a few high-precision rules to SKIP while retaining a random audit sample, expand by rule/cohort, and keep kill switches. Conservative abstention costs vendor fees but protects missed recoveries. Deterministic rules may capture less than a model but are governable. Traps are calling vendor labels truth, optimizing raw hit rate, skipping on missing data, mutating corrected claims, double-sending after timeout, and claiming savings without subtracting platform/audit/missed-recovery costs.

ClaimShield stores immutable claim revisions and fact snapshots, then runs an approved effective-dated deterministic filter with SEND, SKIP or safe ABSTAIN. Decisions include evidence and one idempotent dispatch outbox. Capacity-aware vendor adapters use stable references, ambiguous-send states and reconciliation. Findings only propose actions; humans approve, and appeals append adjustments to the ledger. We prove safe skipping through full shadow, mature labels, independent sampled audits and per-rule financial slices, then expand gradually with exploration samples and kill switches. Vendor outages delay routing but never turn into a SKIP.