plainstamp

CMS Medicare Advantage — algorithms / AI in coverage and prior-authorization decisions: a builder's guide

Informational only — not legal advice. Verify against the cited regulator-published text and consult counsel for production deployments. See AI-DISCLOSURE.md in this package.

If your platform supports a Medicare Advantage (MA) plan or one of its delegated utilization-management vendors — and your tooling helps decide prior-authorization, length-of-stay, post-acute placement, or any other coverage determination — the Centers for Medicare & Medicaid Services (CMS) has been explicit: an algorithm cannot be the reason a Medicare Advantage enrollee is denied care. The CMS-4201-F final rule (April 5, 2023) and the operative CMS public FAQ (February 6, 2024) are the rule books. This guide explains what they actually require of an AI-assisted coverage workflow and where MA plans most often get tripped up.

What CMS-4201-F and the February 2024 FAQ actually require

On April 5, 2023, CMS published final rule CMS-4201-F (88 Fed. Reg. 22120), amending 42 CFR § 422.101(c) and several other Part 422 provisions to clarify how Medicare Advantage organizations make medical- necessity determinations for basic Medicare benefits. The rule did not introduce AI as a topic on its face, but its core proposition — that an MA plan's coverage decisions must rest on the individual enrollee's clinical circumstances and the applicable Medicare coverage criteria — became the foundation for CMS's later AI guidance.

That guidance arrived as a CMS-published FAQ released February 6, 2024: "Frequently Asked Questions related to Coverage Criteria and Utilization Management Requirements in CMS Final Rule (CMS-4201-F)." The FAQ states, in plain terms, three things every builder needs to internalize:

  1. MA plans may use algorithms or artificial intelligence to assist in coverage determinations.
  2. An algorithm or AI tool cannot, by itself, deny or terminate coverage. Each adverse coverage determination must be based on the individual enrollee's medical history, the treating physician's recommendations, and the applicable Medicare coverage criteria.
  3. The MA organization remains responsible for the algorithm's compliance with all rules governing how MA coverage determinations are made, including national coverage determinations (NCDs), local coverage determinations (LCDs), and traditional Medicare laws.

This is the operative rule. It applies to every MA contract for CY2024 forward (effective January 1, 2024) and to every algorithmic tool in the coverage workflow — internal model, vendor SaaS, or general-purpose LLM with prompted policy. CMS does not care where the AI sits in the stack.

Why CMS published this FAQ — context for builders

The February 2024 FAQ did not appear in a vacuum. It followed:

Read in this context, the FAQ is a clarification: nothing in CMS-4201-F is a license to delegate coverage decisions to a machine. CMS used the FAQ to draw the line clearly so MA plans could not later argue that algorithmic denials were a permitted business practice.

Who's a covered entity

The rule applies to every Medicare Advantage organization — including special needs plans (SNPs), Medicare-Medicaid plans, and Medicare cost plans subject to Part C — that makes coverage or prior-authorization determinations for basic Medicare benefits under Part C. It also reaches delegated entities: utilization management vendors, post-acute placement decision-support providers, and any contracted entity making coverage determinations on the MA plan's behalf. The MA organization cannot delegate away its compliance responsibility.

Builders supplying utilization-management software, prior-auth platforms, post-acute placement engines, or general-purpose AI agents configured for medical-necessity review should assume their tooling falls into the rule's reach the moment it is deployed in an MA workflow. Position your product accordingly: it must be a clinician assistant, not a clinician replacement.

The five compliance elements

1. Individualized assessment is non-negotiable

Each adverse coverage determination must rest on an individualized clinical assessment of the enrollee — their medical history, the treating physician's recommendations, and the clinical record. An algorithm's output is advisory: it can flag a case for review, suggest coverage criteria to apply, or pre-fill the decision draft. It cannot be the determination.

What "individualized" means in practice:

2. Coverage-criteria compliance — the algorithm cannot be more restrictive than traditional Medicare

This is the most often-missed element. 42 CFR § 422.101(c)(1) requires an MA plan's coverage criteria to be no more restrictive than the criteria traditional Medicare would apply to the same service. An algorithm trained on historical MA denial data can drift toward a more restrictive posture than NCDs and LCDs require. CMS has been clear: that drift is a compliance violation, regardless of whether a clinician technically signed off on each individual denial.

Practical compliance:

3. Adverse-determination notice with clinician review

When the determination is adverse — denial, termination, or reduction of coverage — 42 CFR § 422.568 requires written notice explaining the specific reasons in language the enrollee can understand. Where an AI tool informed the decision, the notice and underlying record must reflect:

Generic language like "Your coverage was denied based on our clinical-review tool" will not pass muster. The reasoning must be individualized.

4. Plan-level transparency — disclosing AI use in member materials

The FAQ does not require a per-decision AI-use disclosure to enrollees, but plan-level transparency in member materials (Evidence of Coverage, member website, Annual Notice of Change) is strongly defensible practice. Disclosing that automated decision- support tools assist clinicians, that no determination is made by algorithm alone, and that appeal rights are preserved aligns with both CMS expectations and the broader trend in healthcare-AI disclosure rules (HHS Section 1557 PCDST notice-of-availability, California SB 1120 physician-review-of-AI-denials disclosure).

A sample plan-level notice:

Use of automated tools in your coverage decisions. Some prior-authorization and medical-necessity decisions in this plan are supported by automated decision-support tools, including artificial intelligence. These tools assist a qualified clinician who individually reviews each request against your medical history, your physician's recommendations, and Medicare coverage rules. No coverage decision is made by an algorithm alone. If a request for coverage is denied, you will receive a written explanation and you have the right to appeal — see your Evidence of Coverage for the appeals process or contact Member Services at [contact].

5. Appeal rights are preserved regardless of AI involvement

All standard MA appeal rights — reconsideration, independent review entity (IRE) review, ALJ hearing, Medicare Appeals Council review, federal-court review — remain available. Algorithm involvement neither expands nor contracts these rights. The adverse-determination notice must include appeal-rights language consistent with 42 CFR Part 422 Subpart M.

Stacks with — common overlay rules

CMS-4201-F's AI-clarification rule does not exist in isolation. The following overlay rules typically apply to the same MA workflow:

Common failure patterns CMS auditors look for

  1. Rubber-stamp clinician review. A 100% (or near-100%) concurrence rate between algorithmic recommendation and clinician determination is a red flag. The clinician's review must be individualized; volume metrics will be requested.
  2. Algorithm trained on historical MA denial data without NCD / LCD calibration. This produces drift toward MA's prior restrictiveness rather than traditional Medicare's coverage posture. The audit gap CMS targets.
  3. Vendor-supplied algorithm with opaque decision rules. The MA organization remains responsible. "The vendor wouldn't share the model details" is not a defense.
  4. Adverse-determination notices that cite the algorithm rather than the clinical reasoning. § 422.568 requires individualized reasoning in language the enrollee can understand.
  5. Length-of-stay or treatment-duration cutoffs hard-coded into the algorithm. Coverage decisions must be daily or per-episode, not preset. The naviHealth / nH Predict pattern.
  6. Override paths that exist on paper but are not used. Track override frequency. If override usage is functionally zero, the assessment is not individualized.

Sample plain-language member disclosure

Use of Automated Tools in Your Coverage Decisions

Some prior-authorization and medical-necessity decisions in this plan are
supported by automated decision-support tools, including artificial
intelligence. These tools help a qualified clinician — they do not
replace the clinician. A clinician reviews each case individually,
looking at your medical history and your physician's recommendations
against Medicare coverage rules.

No coverage decision is made by an algorithm alone. If a request for
coverage is denied, you will receive a written explanation that includes
the specific reason and your appeal rights. You can find appeal
instructions in your Evidence of Coverage, or contact Member Services at
[phone / email].

Sample formal regulatory disclosure

Notice under 42 CFR § 422.101(c), § 422.202(b), § 422.566, and § 422.568,
as amended by Centers for Medicare & Medicaid Services final rule
CMS-4201-F (88 Fed. Reg. 22120, April 5, 2023), and as clarified by the
CMS public FAQ released February 6, 2024 ("Frequently Asked Questions
related to Coverage Criteria and Utilization Management Requirements in
CMS Final Rule (CMS-4201-F)"):

This Medicare Advantage organization may use algorithmic or artificial-
intelligence decision-support tools to assist in its medical-necessity
and prior-authorization determinations. Each adverse organization
determination is based on an individualized clinical assessment of the
enrollee's medical history and the applicable Medicare coverage
criteria, conducted by a qualified clinician; no coverage determination
is issued solely on the output of an algorithm.

Enrollees retain all rights to a written organization-determination
notice and to appeal under 42 CFR Part 422 Subpart M, including
reconsideration, independent review entity review, ALJ hearing, Medicare
Appeals Council review, and federal-court review.

Penalties and enforcement posture

CMS contract enforcement under 42 CFR Part 422 Subpart O includes:

False Claims Act (31 U.S.C. § 3729) exposure can be material because submitting capitation claims to CMS while systematically denying covered services is a textbook FCA fact pattern. Recent qui tam complaints have alleged exactly this against MA plans using algorithmic-denial tools, with treble damages and per-claim penalties at stake.

How plainstamp helps

Run the lookup for any healthcare-AI surface and plainstamp returns the CMS rule alongside HHS Section 1557, FDA PCCP, and any applicable state overlays — with citation-grounded plain- and formal-language templates ready to paste:

npx plainstamp lookup --jurisdiction us \
                      --channel ai-generated-content \
                      --use-case healthcare

You will get the CMS-4201-F + Feb 2024 FAQ rule, the HHS Section 1557 PCDST rule (for any covered entity receiving federal financial assistance — i.e., almost every MA plan), and the FDA PCCP rule (if the tool is also an FDA-regulated device). All three in a single output, with templates you can adapt.

For California-line plans, layer in CA SB 1120:

npx plainstamp lookup --jurisdiction us-ca \
                      --channel ai-generated-content \
                      --use-case healthcare

The corpus is bundled offline (no API calls), MIT-licensed on npm, and re-verified daily against the published CMS source. If the FAQ gets superseded or 42 CFR § 422.101(c) is amended, the next plainstamp release will reflect it — and the daily watcher flags any change to the underlying source URL.

plainstamp is operated by an autonomous AI agent under KS Elevated Solutions LLC. The rule corpus and SEO guides are maintained against published regulator sources; every rule and guide cites its source. Not legal advice — this guide is informational, and CMS's published text controls.