Amazon's Nova Act is an AI that runs inside a web browser. It does not just answer questions or generate text. It actually operates websites: navigating pages, filling out forms, clicking through dropdown menus, and completing multi-step tasks from start to finish. Think of it as software that does the kind of clicking and typing that a back-office employee would otherwise spend hours doing each day.
It was first released in March 2025 as a developer preview, and moved to general availability on AWS since then. The tool was built specifically for browser automation, trained exclusively for that purpose rather than adapted from a general-purpose model. That focus matters for reliability: most general AI agents struggle to complete long sequences of browser steps without making errors, while Nova Act was designed to break complex workflows into many small, precise actions and recover gracefully when something goes wrong.
The barrier to healthcare adoption was simple: patient data. Any tool that touches records containing names, diagnoses, insurance IDs, or treatment details is subject to HIPAA, the US law that sets privacy and security standards for health information. Until a service is formally declared HIPAA-eligible by AWS and covered by a signed business agreement, organisations legally cannot use it for workflows that involve that kind of data. Nova Act has now crossed that line.
This matters most in the parts of healthcare that are almost entirely administrative. Prior authorization, the process where a provider must get insurer approval before a patient receives a treatment, consumes an average of 14 hours of physician and staff time per week per practice. Billing and coding specialists alone spend around 11 hours weekly just on prior authorization tasks. Across the US system, the administrative cost of prior authorization runs to roughly $35 billion a year. These are not clinical tasks requiring judgment. They are form-filling, portal-logging, status-checking tasks that happen to involve protected patient data.
Nova Act, now HIPAA-eligible, can handle exactly that work: logging into insurance portals, submitting authorisation requests, checking claim status, filing appeals, and tracking referrals across provider systems. It can also flag when a situation falls outside its ability to handle and escalate to a human, which is important in any regulated environment. AWS manages the underlying security infrastructure; the deploying organisation is responsible for configuring it correctly and signing the required business associate agreement with AWS.
Amazon is not alone here. The broader push to bring compliant AI into healthcare administration is accelerating. AWS launched Amazon Connect Health in March 2026 specifically for healthcare organisations. Anthropic has Claude for Healthcare. Optum has launched AI-powered prior authorization tools with an estimated 56 percent reduction in review time in internal testing. The compliance question is increasingly answered; what remains is execution.
One caution is worth keeping in mind. AI tools applied to the insurer side of prior authorization have already drawn scrutiny: a 2024 US Senate committee report cited denial rates running up to 16 times higher than normal in some AI-assisted systems. Nova Act, used on the provider side to submit and track requests rather than to adjudicate them, sits in a different position. But organisations deploying any AI in healthcare workflows should build in audit trails and human review points from the start, not as an afterthought.
For organisations running healthcare back-office operations, the clearest near-term application is not a full automation project. It is identifying the three or four highest-volume, most repetitive browser tasks your team does every week with patient data, and starting there. The compliance gate is open. The bottleneck now is operational readiness.