The only systems that will be able to query are those who are covered entities or are known users (e.g. patient or registered care-giver for that patient) that are deemed by the payer system to have reason to access the prior authorization information for that particular patient.  The existing paper world would allow any imaging center or other service provider to phone a payer, provide the patient's card info and ask for information about current prior authorizations.  (They wouldn't even need the prior authorization identifier.)  Servers will audit all requests.  Systems/individuals that access patient information inappropriately are subject to ramifications under HIPAA.