Step 17 - AI-assisted medical-records review - is the highest-stakes step in the claims pipeline from a regulatory perspective. The 600-page medical-records PDF on a workers' compensation permanent-impairment rating, an L&H disability functional-capacity evaluation, or a bodily-injury demand-package review lands on an adjuster's desk; the carrier needs a structured medical-records summary that survives the privilege test, the reasonable-medical-probability test, the HIPAA minimum-necessary test, and the MHPAEA NQTL test when L&H mental-health treatment is involved. The wrong AI environment ruins the file from the start - consumer-grade ChatGPT, Claude consumer, Gemini consumer have no BAA available and move PHI outside the HIPAA-eligible environment. The right environment is Azure OpenAI with BAA, AWS Bedrock with BAA, or on-prem deployment with carrier-controlled infrastructure. The workflow: chronological treatment timeline, ICD-10/CPT code analysis bearing on causation, AME/IME separation from treating-physician opinions, AMA Guides 6th Edition impairment-rating drivers for WC, FCE results interpretation for L&H disability, demand-response framework for BI. Document the BAA chain. Document the minimum-necessary rationale. Document the file-note attestation that no PHI left the BAA-eligible environment. Address the privilege and work-product overlay when defense counsel is involved. This lesson is the artifact-level build of Step 17 with a worked WC permanent-impairment rating scenario (Iowa mechanic with shoulder injury) and the HIPAA discipline that turns AI-assisted medical-records review from regulatory liability into defensible carrier practice.

The HIPAA-Eligible Environment and the BAA Chain

HIPAA Business Associate Agreement (BAA) requirements determine which LLM environments may process PHI. Three categorically permitted: Azure OpenAI with BAA (Microsoft-Anthropic-or-OpenAI deployment with Azure BAA in place), AWS Bedrock with BAA (Anthropic-Claude-or-others deployed through Bedrock with AWS BAA), on-prem deployment (carrier-controlled infrastructure with carrier-managed PHI handling). Three categorically prohibited: ChatGPT consumer (no BAA), Claude consumer (no BAA), Gemini consumer (no BAA). Each carrier must designate which environment processes PHI and document the BAA chain end-to-end.

The BAA chain documentation. Primary BAA: between carrier (covered entity) and LLM provider. For Azure OpenAI: Microsoft as primary BAA party. Sub-processor BAAs: every entity touching PHI in the pipeline. Azure stores model inputs/outputs in carrier-controlled tenant; storage provider is Microsoft (covered by primary BAA); logging provider is Microsoft (covered); model invocation provider is OpenAI (sub-processor, covered by sub-processor BAA flow-down). Each link of the chain documents the BAA in force.

Minimum-necessary determination. HIPAA's minimum-necessary principle requires the carrier to use the minimum PHI necessary for the authorized purpose. Step 17 medical-records review for WC permanent-impairment rating accesses: medical-history relevant to the injury, treatment records from injury onset, AME/IME reports, FCE results, AMA Guides 6th Edition rating-driver evidence. Does not access: unrelated medical history, family medical history, mental-health records (unless directly relevant), substance-use records (unless directly relevant), genetic information. Minimum-necessary rationale documents what's accessed and why.

The Iowa Mechanic Worked Scenario

Iowa mechanic, age 47, shoulder injury at work 2024-11-12. WC claim opened. Medical treatment: emergency department admission, MRI showing rotator-cuff tear with labrum involvement, orthopedic consultation, arthroscopic surgery 2024-12-18, physical therapy 12 weeks, return-to-work attempt with restrictions, recurrence of symptoms, second MRI showing surgical repair intact but persistent rotator-cuff weakness, FCE (functional-capacity evaluation) 2025-09-05, IME (independent medical examination) by orthopedic specialist 2025-10-20. Treating physician opinion: 12% upper-extremity impairment. IME opinion: 8% upper-extremity impairment. AME (agreed medical evaluator) not invoked. Step 17 medical-records review needs to produce: chronological treatment timeline, AMA Guides 6th Edition rating-driver analysis, treating-physician vs. IME opinion separation, ICD-10 code list bearing on causation, demand-response framework if litigation pursues.

The 600-page records package. 280 pages from emergency department admission + initial workup. 120 pages from orthopedic consultation + surgery + post-op. 140 pages from physical therapy notes. 60 pages from second MRI + follow-up. 100 pages from FCE. 80 pages from IME. Plus 20-50 pages of administrative documentation (referrals, billing, correspondence). The adjuster cannot read all 600 pages in detail; AI-assisted review produces the structured summary; adjuster reviews summary + spot-checks key documents.

Step 17 Workflow in the HIPAA-Eligible Environment

The workflow in Azure OpenAI with BAA: adjuster uploads PHI to Azure Blob storage in carrier's tenant (BAA-covered). Step 17 invocation specifies purpose ("WC permanent-impairment rating analysis") and PHI categories needed (medical history relevant to injury, treatment records, AME/IME, FCE, AMA Guides rating evidence). Azure OpenAI processes; produces structured output. Output writes to carrier's claim file in PAS. Audit log captures: invocation timestamp, purpose, PHI categories accessed, model version, output reference, adjuster identity, §4 reason chain.

The structured output. Section 1 - Chronological Treatment Timeline: 2024-11-12 ED admission with workup; 2024-11-15 orthopedic consultation; 2024-11-22 MRI showing rotator-cuff tear with labrum involvement; 2024-12-18 arthroscopic surgery (procedure code 29827 with associated codes); 2024-12-30 post-op week 2; etc. Section 2 - ICD-10/CPT Code Analysis: ICD-10 codes bearing on causation (S46.011A initial rotator cuff strain right shoulder; S43.401A unspecified sprain right shoulder joint; M75.121 complete rotator cuff tear right shoulder not specified as traumatic; etc.); CPT codes for procedures performed; analysis of whether codes support work-related causation or alternative etiology. Section 3 - Treating-Physician vs. IME Separation: treating physician (orthopedist Dr. Chen) opinion 12% upper-extremity impairment based on AMA Guides Chapter 16 (Upper Extremity); IME (orthopedist Dr. Patel) opinion 8% based on same chapter with different ROM measurement interpretation. Section 4 - AMA Guides 6th Edition Rating Drivers: range-of-motion measurements, strength testing results, sensory deficit assessment, functional limitations, surgical-history modifiers. Section 5 - FCE Results: lifting capacity 25 lbs (down from pre-injury 50 lbs estimate), overhead reaching limited, push/pull capacity reduced, sustained-effort tolerance reduced; specific work-task restrictions documented. Section 6 - Demand-Response Framework: if claimant pursues third-party liability (vehicle struck by industrial truck), demand-response analysis includes liability assessment + damages quantification + comparable-claim references. AI confidence per section.

AME/IME vs. Treating-Physician Separation Discipline

The single most important task at Step 17 is separating AME/IME opinions from treating-physician opinions. Each carries different evidentiary weight in WC, L&H, and BI determinations.

Treating physician. Provides longitudinal care; has relationship with claimant; opinions reflect both clinical observation and treatment goals. Iowa mechanic: Dr. Chen orthopedist with 11 months of care; opinion 12% upper-extremity impairment reflects observed functional limitations and clinical judgment over the treatment course.

IME (Independent Medical Examination). Single evaluation by physician selected by carrier or by court; no ongoing relationship; opinion intended to be objective assessment of impairment at point in time. Iowa mechanic: Dr. Patel orthopedist 1-hour examination 2025-10-20; opinion 8% based on ROM measurements differing from treating physician's measurements.

AME (Agreed Medical Evaluator). When carrier and claimant agree on a physician for impairment evaluation. Higher trust value because both parties accepted the physician. Iowa mechanic: AME not invoked; both treating physician and IME stand.

The §4 reason-chain documentation. Step 17 output explicitly identifies each opinion's source category. Adjuster downstream weighs opinions per state WC law and AMA Guides framework. Without explicit separation, opinions blend in the file and downstream decisions can mis-weight evidence. Treating-physician opinion vs. IME opinion is the most consequential evidentiary distinction in WC permanent-impairment rating.

AMA Guides 6th Edition Impairment-Rating Drivers

WC permanent-impairment ratings in most states use the AMA Guides to the Evaluation of Permanent Impairment, 6th Edition. Specific chapters apply to specific body regions; specific ranking tables produce the percentage rating.

Upper-extremity ratings (Chapter 16) for the Iowa mechanic. Range-of-motion measurements: shoulder flexion observed 130 degrees (normal 180), abduction observed 100 degrees (normal 180), external rotation observed 35 degrees (normal 90), internal rotation observed 40 degrees (normal 70). ROM-based impairment per Table 16-31: approximately 6% upper-extremity impairment from ROM alone. Strength deficit: 4/5 motor strength on isolated rotator-cuff testing; per Table 16-34: approximately 2% additional. Functional adjustments (Table 16-12): mild-to-moderate functional limitation modifier. Surgical-history modifier: arthroscopic surgery with rotator-cuff repair adds 2-4% per Table 16-35 depending on outcome category. Combining: 6% ROM + 2% strength + 2% functional + 4% surgical = approximately 14% combined; adjusted down for overlap to 12% upper-extremity impairment per treating physician. IME's 8% reflects: ROM measurements at 4% (different observed measurements), strength at 2%, functional at 1%, surgical at 1% - combined 8%. The 4% difference is the dispute.

The AI's role in AMA Guides analysis. AI summarizes both physicians' measurements and ratings; presents AMA Guides table references; flags methodology differences. Adjuster + claims supervisor + medical reviewer + WC defense counsel (if litigation) review and decide. AI does not make the impairment-rating decision; AI surfaces the evidence and rating structure.

The MHPAEA NQTL Overlay for L&H Mental-Health

Mental Health Parity and Addiction Equity Act (MHPAEA) applies when L&H mental-health treatment is involved. Non-quantitative treatment limitations (NQTL) - concurrent review, peer review, medical necessity criteria, network adequacy - cannot be more restrictive on mental-health benefits than on medical/surgical analog.

When MHPAEA NQTL triggers at Step 17. AI-driven medical-records review on L&H disability or workers' comp with mental-health treatment component (e.g., PTSD post-injury, depression secondary to chronic pain) must apply review criteria with parity vs. medical/surgical analog. If AI flags mental-health treatments more aggressively than physical-health (e.g., higher denial rate, more frequent peer review, tighter medical-necessity thresholds), MHPAEA violation exposure. The §4 reason chain at Step 17 must document treatment-category parity in AI's review criteria.

The Iowa mechanic scenario. No mental-health treatment component currently. If shoulder injury produces chronic pain leading to depression treatment, MHPAEA NQTL applies. AI review criteria for the depression treatment must be no more restrictive than review criteria for the orthopedic treatment. Fairness officer + medical reviewer document parity assessment.

The BI Demand-Response Framework

Third-party BI demands typically include: liability assertion, medical records, damages quantification, settlement demand. AI-assisted demand-response framework analyzes each component and produces structured response.

The demand-response components. (1) Liability analysis: was the third party negligent; was negligence proximate cause of injury; what's comparative-negligence exposure. (2) Damages quantification: medical expenses (past + projected future), lost wages (past + projected future), pain and suffering (with comparable-claim references), permanent impairment if applicable. (3) Coverage analysis: applicable policy limits, exclusions if relevant. (4) Settlement analysis: comparable settlements for similar injury patterns + comparable jurisdictions + comparable plaintiff attorney references. (5) Response framework: counter-offer, demand for additional documentation, denial with rationale. AI produces structured analysis; adjuster + claims supervisor + defense counsel review.

The §4.4 Documentation Packet at Step 17

The §4.4 packet for Step 17 must capture: AI invocation timestamp with environment (Azure OpenAI BAA), purpose (WC permanent-impairment rating analysis), PHI categories accessed (medical history, treatment records, AME/IME, FCE, AMA Guides evidence), minimum-necessary rationale, model version, output reference, BAA chain (primary + sub-processors), audit log integrity confirmation, adjuster identity + signature, downstream actions (reserve adjustment if rating finalizes, settlement strategy, litigation posture). §4 examiner reviewing the Iowa mechanic claim should reconstruct: which AI processed PHI, with what BAA, for what purpose, with what output, integrated into what downstream decision.

Key Takeaways

• HIPAA-eligible LLM environments: Azure OpenAI with BAA, AWS Bedrock with BAA, on-prem deployment with carrier-controlled infrastructure. Categorically prohibited: ChatGPT consumer, Claude consumer, Gemini consumer - no BAA available.
• BAA chain documents primary BAA between carrier and LLM provider + sub-processor BAAs for every entity touching PHI. Azure example: Microsoft primary BAA + Azure storage covered by primary + Azure logging covered + OpenAI sub-processor covered by sub-processor BAA flow-down.
• Minimum-necessary rationale documents what PHI is accessed and why. Iowa mechanic Step 17: medical history relevant to shoulder injury, treatment records, AME/IME, FCE, AMA Guides rating evidence. Not accessed: unrelated medical history, family history, mental-health records (unless directly relevant), substance-use records, genetic information.
• The Iowa mechanic 600-page records package structured into 6-section output: chronological timeline, ICD-10/CPT codes, treating-physician vs. IME separation, AMA Guides 6th Edition rating drivers, FCE results, demand-response framework. 280 pages from ED, 120 from ortho/surgery, 140 from PT, 60 from second MRI, 100 from FCE, 80 from IME, plus 20-50 administrative.
• Treating physician vs. IME vs. AME distinction is the most consequential evidentiary distinction in WC permanent-impairment. Iowa mechanic: treating physician Dr. Chen 12%, IME Dr. Patel 8%; 4% difference is the dispute. AI surfaces evidence and rating structure; adjuster + supervisor + medical reviewer + WC defense counsel decide.
• AMA Guides 6th Edition rating drivers for shoulder injury (Chapter 16) - ROM measurements (Table 16-31), strength deficit (Table 16-34), functional adjustments (Table 16-12), surgical-history modifier (Table 16-35). Treating physician combined to 12%; IME to 8% based on different observed measurements. AI summarizes both, references tables, flags methodology differences.
• MHPAEA NQTL overlay applies when L&H mental-health treatment is involved. AI review criteria for mental-health treatment must be no more restrictive than for medical/surgical analog. Fairness officer + medical reviewer document parity assessment. §4 reason chain captures treatment-category parity in AI's review criteria.
• BI demand-response framework analyzes liability + damages + coverage + settlement comparable + response strategy. AI produces structured analysis; adjuster + claims supervisor + defense counsel review. §4.4 packet captures AI invocation + BAA chain + minimum-necessary rationale + audit log + adjuster signature + downstream actions.