Implementation Guide: Draft prior authorization letters for insurance carriers

# Create VLANs and enable UTM features on Clinical VLAN outbound policy

# FortiGate CLI - Create VLANs
config system interface
  edit "clinical-vlan"
    set vdom "root"
    set ip 10.10.10.1 255.255.255.0
    set allowaccess ping https ssh
    set interface "internal"
    set vlanid 10
  next
  edit "admin-vlan"
    set vdom "root"
    set ip 10.10.20.1 255.255.255.0
    set allowaccess ping https ssh
    set interface "internal"
    set vlanid 20
  next
  edit "guest-vlan"
    set vdom "root"
    set ip 10.10.30.1 255.255.255.0
    set allowaccess ping
    set interface "internal"
    set vlanid 30
  next
end

# Enable UTM features on Clinical VLAN outbound policy
config firewall policy
  edit 1
    set name "clinical-to-internet"
    set srcintf "clinical-vlan"
    set dstintf "wan1"
    set srcaddr "all"
    set dstaddr "all"
    set action accept
    set schedule "always"
    set service "ALL"
    set utm-status enable
    set av-profile "default"
    set ips-sensor "default"
    set application-list "default"
    set ssl-ssh-profile "deep-inspection"
    set logtraffic all
    set nat enable
  next
end

# Connect to Microsoft Graph and configure basic policies

# PowerShell - Connect to Microsoft Graph and configure basic policies
Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes 'Policy.ReadWrite.ConditionalAccess','DeviceManagementConfiguration.ReadWrite.All'

# Create Security Groups
New-MgGroup -DisplayName 'PA-Staff' -MailEnabled:$false -MailNickname 'pa-staff' -SecurityEnabled:$true
New-MgGroup -DisplayName 'PA-Clinicians' -MailEnabled:$false -MailNickname 'pa-clinicians' -SecurityEnabled:$true
New-MgGroup -DisplayName 'IT-Admins' -MailEnabled:$false -MailNickname 'it-admins' -SecurityEnabled:$true

# Intune BitLocker Policy (via Endpoint Security in Intune portal)
# Navigate to: Endpoint security > Disk encryption > Create policy
# Platform: Windows 10 and later
# Profile: BitLocker
# Settings:
#   Require device encryption: Yes
#   BitLocker OS drive policy: Require
#   Startup authentication: Require TPM + PIN
#   Recovery key rotation: Enabled
#   Encryption method: XTS-AES 256-bit

# SentinelOne deployment via Intune
# 1. Download SentinelOne MSI installer from Management Console > Sentinels > Packages
# 2. Upload MSI to Intune: Apps > Windows > Add > Line-of-business app
# 3. Assign to 'All Devices' group
# 4. Command-line arguments for silent install:
SentinelOneInstaller.msi /q SITE_TOKEN=<your_site_token>

# DNSFilter deployment via Intune
# 1. Download DNSFilter agent MSI from dnsfitler.com/dashboard/deployment
# 2. Upload to Intune as LOB app
# 3. Silent install:
msiexec /i DNSFilter_Agent.msi /qn ORGANIZATION_ID=<your_org_id>

# Verify deployments
# SentinelOne: Check Management Console > Sentinels for all endpoints reporting
# DNSFilter: Check Dashboard > Roaming Clients for all endpoints reporting

# Azure CLI - Provision core infrastructure
az login
az account set --subscription "<subscription-id>"

# Create Resource Group
az group create --name rg-pa-lettergen --location eastus

# Create Virtual Network with subnet for private endpoints
az network vnet create --resource-group rg-pa-lettergen --name vnet-pa --address-prefix 10.0.0.0/16 --subnet-name snet-private-endpoints --subnet-prefix 10.0.1.0/24

# Create Azure Key Vault
az keyvault create --resource-group rg-pa-lettergen --name kv-pa-lettergen --location eastus --sku standard --enable-purge-protection true --enable-soft-delete true

# Create Cosmos DB account (serverless)
az cosmosdb create --resource-group rg-pa-lettergen --name cosmos-pa-lettergen --kind GlobalDocumentDB --capabilities EnableServerless --default-consistency-level Session --locations regionName=eastus

# Create Cosmos DB database and containers
az cosmosdb sql database create --resource-group rg-pa-lettergen --account-name cosmos-pa-lettergen --name pa-letter-db
az cosmosdb sql container create --resource-group rg-pa-lettergen --account-name cosmos-pa-lettergen --database-name pa-letter-db --name audit-logs --partition-key-path /practiceId
az cosmosdb sql container create --resource-group rg-pa-lettergen --account-name cosmos-pa-lettergen --database-name pa-letter-db --name prompt-templates --partition-key-path /templateCategory

# Create Azure OpenAI resource
az cognitiveservices account create --resource-group rg-pa-lettergen --name aoai-pa-lettergen --kind OpenAI --sku S0 --location eastus --custom-domain aoai-pa-lettergen

# Deploy GPT-5.4 model
az cognitiveservices account deployment create --resource-group rg-pa-lettergen --name aoai-pa-lettergen --deployment-name gpt-5.4 --model-name gpt-5.4 --model-version 2024-08-06 --model-format OpenAI --sku-name Standard --sku-capacity 30

# Create App Service Plan and Web App
az appservice plan create --resource-group rg-pa-lettergen --name asp-pa-lettergen --sku B2 --is-linux
az webapp create --resource-group rg-pa-lettergen --plan asp-pa-lettergen --name app-pa-lettergen --runtime "PYTHON:3.11"

# Store Azure OpenAI key in Key Vault
AOAI_KEY=$(az cognitiveservices account keys list --resource-group rg-pa-lettergen --name aoai-pa-lettergen --query key1 -o tsv)
az keyvault secret set --vault-name kv-pa-lettergen --name aoai-api-key --value $AOAI_KEY

# Clone the application repository (MSP internal repo)
git clone https://github.com/<msp-org>/pa-letter-generator.git
cd pa-letter-generator

# Create Python virtual environment
python3.11 -m venv venv
source venv/bin/activate

# Install dependencies
pip install -r requirements.txt
# requirements.txt contents:
# fastapi==0.115.0
# uvicorn==0.30.0
# openai==1.52.0
# azure-identity==1.18.0
# azure-cosmos==4.7.0
# azure-keyvault-secrets==4.8.0
# python-multipart==0.0.9
# jinja2==3.1.4
# weasyprint==62.0
# python-dotenv==1.0.1
# pydantic==2.9.0

# Configure environment variables (stored in App Service Configuration)
az webapp config appsettings set --resource-group rg-pa-lettergen --name app-pa-lettergen --settings \
  AZURE_OPENAI_ENDPOINT=https://aoai-pa-lettergen.openai.azure.com/ \
  AZURE_OPENAI_DEPLOYMENT=gpt-5.4 \
  AZURE_OPENAI_API_VERSION=2024-08-06 \
  COSMOS_ENDPOINT=https://cosmos-pa-lettergen.documents.azure.com:443/ \
  COSMOS_DATABASE=pa-letter-db \
  KEY_VAULT_URL=https://kv-pa-lettergen.vault.azure.net/ \
  PRACTICE_NAME="Example Medical Associates" \
  REQUIRE_CLINICIAN_APPROVAL=true

# Deploy to Azure App Service
az webapp deployment source config-zip --resource-group rg-pa-lettergen --name app-pa-lettergen --src app.zip

# Enable managed identity for Key Vault access
az webapp identity assign --resource-group rg-pa-lettergen --name app-pa-lettergen
PRINCIPAL_ID=$(az webapp identity show --resource-group rg-pa-lettergen --name app-pa-lettergen --query principalId -o tsv)
az keyvault set-policy --name kv-pa-lettergen --object-id $PRINCIPAL_ID --secret-permissions get list

# Configure custom domain and SSL (optional but recommended)
# az webapp config hostname add --resource-group rg-pa-lettergen --webapp-name app-pa-lettergen --hostname pa.example-practice.com
# az webapp config ssl bind ...

# Example FHIR data pull (Python - using requests library)
# This code is integrated into the main application

import requests

def get_patient_data_for_pa(fhir_base_url, patient_id, access_token):
    headers = {
        'Authorization': f'Bearer {access_token}',
        'Accept': 'application/fhir+json'
    }
    
    # Get patient demographics
    patient = requests.get(f'{fhir_base_url}/Patient/{patient_id}', headers=headers).json()
    
    # Get active conditions (diagnoses)
    conditions = requests.get(
        f'{fhir_base_url}/Condition?patient={patient_id}&clinical-status=active',
        headers=headers
    ).json()
    
    # Get recent medications
    medications = requests.get(
        f'{fhir_base_url}/MedicationRequest?patient={patient_id}&status=active',
        headers=headers
    ).json()
    
    # Get relevant procedures/service requests pending PA
    service_requests = requests.get(
        f'{fhir_base_url}/ServiceRequest?patient={patient_id}&status=active',
        headers=headers
    ).json()
    
    # Get recent clinical notes (last 90 days)
    from datetime import datetime, timedelta
    date_90_days_ago = (datetime.now() - timedelta(days=90)).strftime('%Y-%m-%d')
    notes = requests.get(
        f'{fhir_base_url}/DocumentReference?patient={patient_id}&date=ge{date_90_days_ago}&type=http://loinc.org|11506-3',
        headers=headers
    ).json()
    
    return {
        'patient': patient,
        'conditions': conditions,
        'medications': medications,
        'service_requests': service_requests,
        'clinical_notes': notes
    }

# Cosmos DB audit log document structure (Python dataclass)
from dataclasses import dataclass, asdict
from datetime import datetime
import hashlib
import json

@dataclass
class PAAuditLog:
    id: str                          # UUID
    practice_id: str                 # Practice identifier
    timestamp_created: str           # ISO 8601 UTC
    timestamp_approved: str          # ISO 8601 UTC (null until approved)
    requesting_user: str             # Staff member email
    reviewing_clinician: str         # Clinician email/NPI
    patient_mrn: str                 # Medical Record Number (not SSN)
    payer_name: str                  # Insurance carrier
    pa_type: str                     # medication | procedure | imaging | dme
    procedure_codes: list            # CPT codes
    diagnosis_codes: list            # ICD-10 codes
    prompt_template_id: str          # Template version used
    model_deployment: str            # e.g., gpt-5.4
    input_token_count: int           # Tokens sent to model
    output_token_count: int          # Tokens received
    generated_output_hash: str       # SHA-256 of raw AI output
    clinician_edits_made: bool       # Did clinician modify the draft?
    edit_diff_hash: str              # SHA-256 of final vs. original
    approval_status: str             # pending | approved | rejected
    submission_method: str           # fax | portal | electronic
    letter_pdf_hash: str             # SHA-256 of final PDF

# Write to Cosmos DB
from azure.cosmos import CosmosClient

def log_pa_event(audit_log: PAAuditLog):
    client = CosmosClient(COSMOS_ENDPOINT, COSMOS_KEY)
    db = client.get_database_client('pa-letter-db')
    container = db.get_container_client('audit-logs')
    container.create_item(body=asdict(audit_log))

# main.py - FastAPI Application for PA Letter Generation

from fastapi import FastAPI, HTTPException, Depends, Request
from fastapi.responses import HTMLResponse
from fastapi.security import HTTPBearer
from pydantic import BaseModel, Field
from typing import Optional, List
from datetime import datetime
import hashlib
import uuid
import os
from openai import AzureOpenAI
from azure.cosmos import CosmosClient
from azure.keyvault.secrets import SecretClient
from azure.identity import DefaultAzureCredential

app = FastAPI(title='PA Letter Generator', version='1.0.0')

# Configuration from environment
AOAI_ENDPOINT = os.environ['AZURE_OPENAI_ENDPOINT']
AOAI_DEPLOYMENT = os.environ['AZURE_OPENAI_DEPLOYMENT']
AOAI_API_VERSION = os.environ['AZURE_OPENAI_API_VERSION']
COSMOS_ENDPOINT = os.environ['COSMOS_ENDPOINT']
KEY_VAULT_URL = os.environ['KEY_VAULT_URL']

# Initialize clients with Managed Identity
credential = DefaultAzureCredential()
kv_client = SecretClient(vault_url=KEY_VAULT_URL, credential=credential)
aoai_key = kv_client.get_secret('aoai-api-key').value

oai_client = AzureOpenAI(
    azure_endpoint=AOAI_ENDPOINT,
    api_key=aoai_key,
    api_version=AOAI_API_VERSION
)

cosmos_client = CosmosClient(COSMOS_ENDPOINT, credential=credential)
db = cosmos_client.get_database_client('pa-letter-db')
audit_container = db.get_container_client('audit-logs')
template_container = db.get_container_client('prompt-templates')

# Pydantic models
class PARequest(BaseModel):
    patient_name: str
    patient_dob: str
    patient_mrn: str
    member_id: str
    group_number: Optional[str] = None
    payer_name: str
    payer_address: Optional[str] = None
    provider_name: str
    provider_npi: str
    provider_specialty: str
    practice_name: str
    practice_address: str
    practice_phone: str
    practice_fax: str
    diagnosis_codes: List[str] = Field(..., description='ICD-10 codes with descriptions, e.g. ["M54.5 - Low back pain"]')
    procedure_codes: List[str] = Field(..., description='CPT/CDT codes with descriptions, e.g. ["72148 - MRI lumbar spine without contrast"]')
    clinical_history: str = Field(..., description='Relevant clinical history and exam findings')
    failed_treatments: Optional[str] = Field(None, description='Prior treatments attempted and outcomes')
    medical_necessity: str = Field(..., description='Clinical rationale for the requested service')
    urgency: Optional[str] = Field(None, description='If urgent, explain clinical urgency')
    additional_context: Optional[str] = Field(None, description='Any additional payer-specific info')
    pa_type: str = Field(..., description='medication | procedure | imaging | dme | dental')

class PAResponse(BaseModel):
    request_id: str
    draft_letter: str
    model_used: str
    input_tokens: int
    output_tokens: int
    generated_at: str
    approval_required: bool = True
    warnings: List[str]

def get_system_prompt():
    return """You are a medical prior authorization letter drafting assistant working within a HIPAA-compliant healthcare environment. Your role is to generate professional, clinically appropriate prior authorization request letters addressed to insurance carriers on behalf of the requesting provider.

CRITICAL RULES:
1. ONLY use the clinical information explicitly provided in the user message. NEVER fabricate, assume, or hallucinate any clinical details, study citations, drug dosages, policy numbers, or patient information.
2. If information needed for a complete letter is missing from the input, clearly mark it with [MISSING: description of needed information] so the reviewing clinician can fill it in.
3. NEVER invent or cite specific clinical studies, journal articles, or guideline references unless they are provided verbatim in the input. Instead, use phrases like "per current evidence-based guidelines" or "consistent with standard of care for this condition."
4. Every letter MUST include the following disclaimer at the bottom: "This letter was drafted with AI assistance and has been reviewed and approved by the undersigned provider."
5. Format the letter as a formal business letter with: date, provider letterhead placeholder, payer name and address, RE line with patient name and member ID, salutation, body paragraphs, and provider signature block.

LETTER STRUCTURE:
- Paragraph 1: Provider introduction, patient identification, and specific authorization request (procedure/medication/service with CPT/HCPCS/CDT codes)
- Paragraph 2: Clinical history and diagnosis (ICD-10 codes with descriptions)
- Paragraph 3: Medical necessity justification
- Paragraph 4: Treatment plan and expected outcomes
- Paragraph 5: Urgency statement (if applicable) and request for expedited review
- Closing: Provider contact information for peer-to-peer review, signature block

TONE: Professional, clinical, assertive but respectful.
OUTPUT FORMAT: Plain text formatted as a letter. Do not use markdown."""

def get_payer_template(payer_name: str, pa_type: str) -> str:
    query = f"SELECT * FROM c WHERE CONTAINS(LOWER(c.payer), LOWER('{payer_name}')) AND c.category = '{pa_type}'"
    templates = list(template_container.query_items(query=query, enable_cross_partition_query=True))
    if templates:
        return templates[0].get('additional_instructions', '')
    return ''

def build_user_message(req: PARequest, payer_template: str) -> str:
    msg = f"""Generate a prior authorization request letter with the following information:

PATIENT INFORMATION:
- Name: {req.patient_name}
- Date of Birth: {req.patient_dob}
- MRN: {req.patient_mrn}
- Member ID: {req.member_id}
- Group Number: {req.group_number or '[MISSING: Group Number]'}

INSURANCE CARRIER:
- Payer: {req.payer_name}
- Address: {req.payer_address or '[MISSING: Payer Address]'}

REQUESTING PROVIDER:
- Name: {req.provider_name}
- NPI: {req.provider_npi}
- Specialty: {req.provider_specialty}
- Practice: {req.practice_name}
- Address: {req.practice_address}
- Phone: {req.practice_phone}
- Fax: {req.practice_fax}

DIAGNOSES:
{chr(10).join('- ' + d for d in req.diagnosis_codes)}

REQUESTED SERVICES:
{chr(10).join('- ' + p for p in req.procedure_codes)}

CLINICAL HISTORY:
{req.clinical_history}
"""
    if req.failed_treatments:
        msg += f"\nPRIOR TREATMENTS ATTEMPTED:\n{req.failed_treatments}\n"
    msg += f"\nMEDICAL NECESSITY JUSTIFICATION:\n{req.medical_necessity}\n"
    if req.urgency:
        msg += f"\nURGENCY:\n{req.urgency}\n"
    if req.additional_context:
        msg += f"\nADDITIONAL CONTEXT:\n{req.additional_context}\n"
    if payer_template:
        msg += f"\nPAYER-SPECIFIC REQUIREMENTS:\n{payer_template}\n"
    return msg

@app.post('/api/generate-pa-letter', response_model=PAResponse)
async def generate_pa_letter(req: PARequest, request: Request):
    request_id = str(uuid.uuid4())
    warnings = []
    
    # Get payer-specific template
    payer_template = get_payer_template(req.payer_name, req.pa_type)
    if not payer_template:
        warnings.append(f'No payer-specific template found for {req.payer_name}. Using generic format.')
    
    # Build messages
    system_prompt = get_system_prompt()
    user_message = build_user_message(req, payer_template)
    
    # Call Azure OpenAI
    response = oai_client.chat.completions.create(
        model=AOAI_DEPLOYMENT,
        messages=[
            {'role': 'system', 'content': system_prompt},
            {'role': 'user', 'content': user_message}
        ],
        temperature=0.3,
        max_tokens=3000,
        top_p=0.95
    )
    
    draft_letter = response.choices[0].message.content
    input_tokens = response.usage.prompt_tokens
    output_tokens = response.usage.completion_tokens
    
    # Check for hallucination markers
    if '[MISSING:' in draft_letter:
        warnings.append('Letter contains [MISSING] placeholders that require clinician input.')
    
    # Log to Cosmos DB
    audit_entry = {
        'id': request_id,
        'practiceId': req.practice_name,
        'timestamp_created': datetime.utcnow().isoformat(),
        'timestamp_approved': None,
        'requesting_user': request.headers.get('X-User-Email', 'unknown'),
        'reviewing_clinician': None,
        'patient_mrn': req.patient_mrn,
        'payer_name': req.payer_name,
        'pa_type': req.pa_type,
        'procedure_codes': req.procedure_codes,
        'diagnosis_codes': req.diagnosis_codes,
        'prompt_template_id': f'system-v1.0 + {req.payer_name}-{req.pa_type}',
        'model_deployment': AOAI_DEPLOYMENT,
        'input_token_count': input_tokens,
        'output_token_count': output_tokens,
        'generated_output_hash': hashlib.sha256(draft_letter.encode()).hexdigest(),
        'clinician_edits_made': False,
        'edit_diff_hash': None,
        'approval_status': 'pending',
        'submission_method': None,
        'letter_pdf_hash': None
    }
    audit_container.create_item(body=audit_entry)
    
    return PAResponse(
        request_id=request_id,
        draft_letter=draft_letter,
        model_used=AOAI_DEPLOYMENT,
        input_tokens=input_tokens,
        output_tokens=output_tokens,
        generated_at=datetime.utcnow().isoformat(),
        approval_required=True,
        warnings=warnings
    )

@app.post('/api/approve-pa-letter/{request_id}')
async def approve_pa_letter(request_id: str, clinician_email: str, final_letter_text: str, submission_method: str, request: Request):
    # Retrieve audit log
    audit_entry = audit_container.read_item(item=request_id, partition_key=request.headers.get('X-Practice-Name', ''))
    
    # Update with approval
    original_hash = audit_entry['generated_output_hash']
    final_hash = hashlib.sha256(final_letter_text.encode()).hexdigest()
    
    audit_entry['timestamp_approved'] = datetime.utcnow().isoformat()
    audit_entry['reviewing_clinician'] = clinician_email
    audit_entry['clinician_edits_made'] = (original_hash != final_hash)
    audit_entry['edit_diff_hash'] = final_hash
    audit_entry['approval_status'] = 'approved'
    audit_entry['submission_method'] = submission_method
    
    audit_container.replace_item(item=request_id, body=audit_entry)
    
    return {'status': 'approved', 'request_id': request_id}

@app.get('/health')
async def health_check():
    return {'status': 'healthy', 'timestamp': datetime.utcnow().isoformat()}

# fhir_connector.py

import requests
from typing import Optional, Dict, Any
from datetime import datetime, timedelta
import logging

logger = logging.getLogger(__name__)

class FHIRConnector:
    def __init__(self, fhir_base_url: str, client_id: str, client_secret: str, token_url: str):
        self.fhir_base_url = fhir_base_url.rstrip('/')
        self.client_id = client_id
        self.client_secret = client_secret
        self.token_url = token_url
        self._access_token = None
        self._token_expiry = None

    def _get_token(self) -> str:
        if self._access_token and self._token_expiry and datetime.utcnow() < self._token_expiry:
            return self._access_token
        response = requests.post(self.token_url, data={
            'grant_type': 'client_credentials',
            'client_id': self.client_id,
            'client_secret': self.client_secret,
            'scope': f'{self.fhir_base_url}/.default'
        })
        response.raise_for_status()
        token_data = response.json()
        self._access_token = token_data['access_token']
        self._token_expiry = datetime.utcnow() + timedelta(seconds=token_data.get('expires_in', 3600) - 60)
        return self._access_token

    def _headers(self) -> Dict[str, str]:
        return {
            'Authorization': f'Bearer {self._get_token()}',
            'Accept': 'application/fhir+json'
        }

    def get_patient(self, patient_id: str) -> Dict[str, Any]:
        resp = requests.get(f'{self.fhir_base_url}/Patient/{patient_id}', headers=self._headers())
        resp.raise_for_status()
        patient = resp.json()
        name = patient.get('name', [{}])[0]
        return {
            'name': f"{name.get('given', [''])[0]} {name.get('family', '')}",
            'dob': patient.get('birthDate', ''),
            'mrn': next((i['value'] for i in patient.get('identifier', []) if i.get('type', {}).get('coding', [{}])[0].get('code') == 'MR'), ''),
            'member_id': next((i['value'] for i in patient.get('identifier', []) if 'insurance' in i.get('system', '').lower()), ''),
            'gender': patient.get('gender', ''),
            'address': self._format_address(patient.get('address', [{}])[0]) if patient.get('address') else ''
        }

    def get_active_conditions(self, patient_id: str) -> list:
        resp = requests.get(
            f'{self.fhir_base_url}/Condition?patient={patient_id}&clinical-status=active',
            headers=self._headers()
        )
        resp.raise_for_status()
        bundle = resp.json()
        conditions = []
        for entry in bundle.get('entry', []):
            resource = entry.get('resource', {})
            coding = resource.get('code', {}).get('coding', [{}])[0]
            conditions.append({
                'code': coding.get('code', ''),
                'display': coding.get('display', ''),
                'system': coding.get('system', ''),
                'onset': resource.get('onsetDateTime', '')
            })
        return conditions

    def get_active_medications(self, patient_id: str) -> list:
        resp = requests.get(
            f'{self.fhir_base_url}/MedicationRequest?patient={patient_id}&status=active',
            headers=self._headers()
        )
        resp.raise_for_status()
        bundle = resp.json()
        medications = []
        for entry in bundle.get('entry', []):
            resource = entry.get('resource', {})
            med_coding = resource.get('medicationCodeableConcept', {}).get('coding', [{}])[0]
            medications.append({
                'name': med_coding.get('display', ''),
                'code': med_coding.get('code', ''),
                'dosage': resource.get('dosageInstruction', [{}])[0].get('text', '') if resource.get('dosageInstruction') else '',
                'authored': resource.get('authoredOn', '')
            })
        return medications

    def get_pending_service_requests(self, patient_id: str) -> list:
        resp = requests.get(
            f'{self.fhir_base_url}/ServiceRequest?patient={patient_id}&status=active',
            headers=self._headers()
        )
        resp.raise_for_status()
        bundle = resp.json()
        requests_list = []
        for entry in bundle.get('entry', []):
            resource = entry.get('resource', {})
            coding = resource.get('code', {}).get('coding', [{}])[0]
            requests_list.append({
                'code': coding.get('code', ''),
                'display': coding.get('display', ''),
                'reason': resource.get('reasonCode', [{}])[0].get('text', '') if resource.get('reasonCode') else '',
                'authored': resource.get('authoredOn', '')
            })
        return requests_list

    def get_recent_notes(self, patient_id: str, days: int = 90) -> list:
        date_cutoff = (datetime.utcnow() - timedelta(days=days)).strftime('%Y-%m-%d')
        resp = requests.get(
            f'{self.fhir_base_url}/DocumentReference?patient={patient_id}&date=ge{date_cutoff}',
            headers=self._headers()
        )
        resp.raise_for_status()
        bundle = resp.json()
        notes = []
        for entry in bundle.get('entry', []):
            resource = entry.get('resource', {})
            for content in resource.get('content', []):
                attachment = content.get('attachment', {})
                if attachment.get('contentType') == 'text/plain' and attachment.get('data'):
                    import base64
                    notes.append({
                        'date': resource.get('date', ''),
                        'type': resource.get('type', {}).get('text', 'Clinical Note'),
                        'text': base64.b64decode(attachment['data']).decode('utf-8')
                    })
        return notes

    def build_pa_context(self, patient_id: str) -> Dict[str, Any]:
        """Aggregates all patient data needed for a PA letter into a single context object."""
        return {
            'patient': self.get_patient(patient_id),
            'conditions': self.get_active_conditions(patient_id),
            'medications': self.get_active_medications(patient_id),
            'service_requests': self.get_pending_service_requests(patient_id),
            'recent_notes': self.get_recent_notes(patient_id)
        }

    @staticmethod
    def _format_address(addr: dict) -> str:
        lines = addr.get('line', [])
        city = addr.get('city', '')
        state = addr.get('state', '')
        postal = addr.get('postalCode', '')
        return f"{', '.join(lines)}, {city}, {state} {postal}".strip(', ')

# pdf_generator.py

from weasyprint import HTML
from datetime import datetime
import os
import hashlib

def generate_pa_letter_pdf(
    letter_text: str,
    practice_name: str,
    practice_address: str,
    practice_phone: str,
    practice_fax: str,
    practice_logo_path: str = None
) -> tuple:
    """
    Generates a PDF from the approved PA letter text.
    Returns (pdf_bytes, sha256_hash).
    """
    logo_html = ''
    if practice_logo_path and os.path.exists(practice_logo_path):
        import base64
        with open(practice_logo_path, 'rb') as f:
            logo_b64 = base64.b64encode(f.read()).decode()
        logo_html = f'<img src="data:image/png;base64,{logo_b64}" style="max-height:80px; margin-bottom:10px;">'

    # Convert plain text letter to HTML paragraphs
    letter_paragraphs = letter_text.strip().split('\n\n')
    letter_html_body = '\n'.join(f'<p>{para.replace(chr(10), "<br>")}</p>' for para in letter_paragraphs)

    html_content = f"""
    <!DOCTYPE html>
    <html>
    <head>
        <meta charset="utf-8">
        <style>
            @page {{
                size: letter;
                margin: 1in;
            }}
            body {{
                font-family: 'Times New Roman', Times, serif;
                font-size: 12pt;
                line-height: 1.5;
                color: #000000;
            }}
            .letterhead {{
                text-align: center;
                border-bottom: 2px solid #003366;
                padding-bottom: 15px;
                margin-bottom: 25px;
            }}
            .letterhead h1 {{
                font-size: 18pt;
                color: #003366;
                margin: 5px 0;
            }}
            .letterhead p {{
                font-size: 10pt;
                color: #555;
                margin: 2px 0;
            }}
            .letter-body p {{
                margin-bottom: 12px;
                text-align: justify;
            }}
            .disclaimer {{
                font-size: 9pt;
                color: #777;
                border-top: 1px solid #ccc;
                padding-top: 10px;
                margin-top: 30px;
            }}
            .generated-info {{
                font-size: 8pt;
                color: #999;
                text-align: right;
                margin-top: 20px;
            }}
        </style>
    </head>
    <body>
        <div class="letterhead">
            {logo_html}
            <h1>{practice_name}</h1>
            <p>{practice_address}</p>
            <p>Phone: {practice_phone} | Fax: {practice_fax}</p>
        </div>
        <div class="letter-body">
            {letter_html_body}
        </div>
        <div class="disclaimer">
            This letter was drafted with AI assistance and has been reviewed and approved by the undersigned provider.
        </div>
        <div class="generated-info">
            Generated: {datetime.utcnow().strftime('%Y-%m-%d %H:%M UTC')} | Document ID: {{request_id}}
        </div>
    </body>
    </html>
    """

    pdf_bytes = HTML(string=html_content).write_pdf()
    pdf_hash = hashlib.sha256(pdf_bytes).hexdigest()

    return pdf_bytes, pdf_hash

curl -X POST https://aoai-pa-lettergen.openai.azure.com/openai/deployments/gpt-5.4/chat/completions?api-version=2024-08-06 -H 'Content-Type: application/json' -H 'api-key: <key>' -d '{"messages":[{"role":"system","content":"You are a PA letter assistant."},{"role":"user","content":"Draft a PA letter for a knee MRI."}],"temperature":0.3}'