The 90-Second Mental Model

The whole of US healthcare administration in one breath: money flows in as premiums, gets pooled and controlled in the middle, and flows out as claims and care. Almost every player, product, regulation, and dysfunction in this map is a move somewhere on that board.

ℹ️ In plain English

Someone pays a monthly premium to a health plan. The plan holds that money in a shared pot. When you get care, your doctor sends a claim (a bill) to the plan, which decides whether it's covered and how much to pay. To control what it pays, the plan runs a gauntlet of approval checks where the most visible one is prior authorization (getting a yes before care happens). The plan keeps whatever premium it didn't pay out. That tension of premium in, claims out, keep the difference explains almost everything else.

The one diagram to remember

           PREMIUM ($ in)
  Employer / Member / Government ────────────────► PAYER (health plan)
       │                                              │  pools the risk pool
       │ (employer often self-funds; a TPA            │  owns coverage rules
       │  runs the plan, bears no risk)               │
       ▼                                              ▼
  MEMBER / PATIENT                            ┌──── THE CONTROL LAYER ────┐
       │ gets care                            │  Eligibility check        │
       ▼                                      │  Prior Authorization (UM) │  ◄─ before care
  PROVIDER (doctor / hospital) ──────────────►│  Claim adjudication       │
       │  delivers care, then bills           │  Payment integrity        │  ◄─ after care
       │                                      └───────────────────────────┘
       │  CLAIM (837 EDI) ──► CLEARINGHOUSE ──► PAYER
       │                                              │ pays the allowed amount
       ◄──────────── REIMBURSEMENT ($ out) ──────────┘ (minus member cost-share)
       │
       ◄── member pays deductible / copay / coinsurance (cost sharing)

  Whatever premium the payer does NOT pay out in claims, it keeps.
  The MLR rule forces most of it back out as care (80% / 85%).

How the dollar flows

Money enters the system through the premium which is paid by an employer, an individual member, or a government program (Medicare, Medicaid). It is eventually received by a Healthplan (a payer), which pools many people's premiums into a risk pool. This pools facilitates the healthy subsidizing the sick, and the law of large numbers makes total spend predictable.

The payer's job is to pay out less than it took in. The gap between premiums collected and claims paid is its margin (plus the cost of running the operation). The Medical Loss Ratio caps how big that gap can be: under the ACA, plans must spend at least 80% of premium on care in the individual and small-group markets, and 85% in the large-group market, or rebate the difference. So the lever a payer pulls is not "keep more premium" — it's "pay only for care that is necessary, covered, and correctly billed."

💡 Zahid's take: Healthplans operate within a fixed margin

There are many misconceptions about insurance, and to the average reader there is likely one bouncing around in your head right about now.

It's helpful to really understand what levers Healthplans have available to them and how that impacts them and the industry on a whole. Your takeaway from this section should have been a daunting realisation that no matter how much a Healthplan charges in insurance premium, maximum they can keep is 20%. This results in interesting consequences, behavior patterns and outcomes that reverberate throughout the Healthcare system as a result.

How a claim flows

A patient gets care. The provider documents it, codes it (CPT for procedures, ICD-10 for diagnoses), and submits a claim. It's almost always submitted as an X12 837 EDI transaction routed through a clearinghouse that scrubs and forwards it to the right payer. This whole provider-side billing operation is revenue cycle management.

The payer adjudicates: checks eligibility, applies the reimbursement model and fee schedule to set the allowed amount, subtracts the member's cost share (deductible, copay, coinsurance), and pays the rest. The member gets an Explanation of Benefits; the provider gets a remittance. If the claim is wrong, denied, or overpaid, it loops into appeals or payment integrity review.

Where authorization and Utilization Management sit

Utilization management (UM) is the control layer between "care is wanted" and "care is paid." It exists because the payer is responsible for the bill, so it polices medical necessity to determine whether this care is appropriate at this site and for this patient against published clinical criteria and the plan's medical policy.

UM runs at three points in time:

Before care — prior authorization: the provider must get a yes before scheduling. This is the most contested gate in the system.
During care — concurrent review: for an inpatient stay, the plan reviews each day to confirm the patient still needs to be there.
After care — retrospective review and payment integrity: catch what slipped through, recover overpayments.

💡 Zahid's take: I hope my guide is good; but don't treat it as definitive

In-network, out-of-network and site-of-care make an already bloated topic even heavier to digest. As somebody who has never needed to access the US Healthcare system, I haven't been able to form an opinion on how much this bears on the admin layer. But, given the number of startups out there solving for this; I can only assume it's yet another rabbit-hole worth billions.

Who bears the risk

This is the hinge that is missed and overlooked at first. It's important to grasp. Whoever holds the risk pool decides what gets paid. But the payer isn't always the risk-bearer:

A fully-insured employer hands premium to an insurer that bears the risk.
A self-funded employer keeps the risk and hires a TPA to run the plan — the TPA processes claims but bears no risk (and is governed by ERISA, not state insurance law).
Under capitation and value-based care, a provider group takes a fixed per-member payment and now bears the risk itself — flipping it from biller to mini-payer.

Risk follows the money, and control follows risk. When you want to know who's making a coverage decision, ask who's on the hook for the claim.

Why admin is so heavy

Three structural reasons:

Fragmentation. Thousands of payers, each with its own networks, plan designs, policies, and forms. No single rulebook, so every transaction is a negotiation.
Misaligned incentives. The payer pays, the provider bills, the patient receives, the employer or government funds — four parties, four agendas. Every dollar is contested, which spawns review, appeal, and counter-review. This can be a healthy tension, and it creates administrative work.
Manual interfaces between systems. Provider EHRs and payer claims systems were never built to talk. The gap is bridged by fax, phone, portals, and people re-keying clinical facts. The CMS-0057-F rule is the first serious federal push to close it — mandating faster prior-auth decisions (72 hours expedited, 7 calendar days standard, from 1 January 2026) and FHIR APIs (generally from 1 January 2027).

⚠️ Where it breaks

The control layer is where the money is and where the toil is. A prior-auth request is a clinical story trapped in a fax: a UM nurse re-reads the chart, matches it line-by-line against criteria, and writes a determination letter. Multiply by millions of requests a year. Providers staff entire teams just to chase approvals; payers staff entire teams to review them. Most of the work is reading documents and applying rules which is high-volume, repetitive, and almost entirely manual. The patient, meanwhile, waits in agony.

💡 Zahid's take

Once you see the shape: premium in, claims and care out, controls in the middle everything in this map snaps into place. You'll begin to realise that a plan type is a benefit-design choice, a PBM is a payer for drugs, payment integrity is UM run after the fact. As the former founder of Anterior my read is that the control layer is the densest concentration of manual, rules-based, document-heavy work in the health economy. And it's exactly the shape modern AI is good at: read the unstructured data from a clinical record, apply the criteria, cite the policy, produce the determination. The companies that own the systems of record are well placed here, and a natural next frontier for the industry is the workflow that runs between those systems. If you only remember one thing: whoever bears the risk controls the decision, and the decision is mostly people reading documents. That's the whole game.