CMS Medicare Advantage — algorithms / AI in coverage and prior-authorization decisions (CMS-4201-F + Feb 2024 FAQ)
On April 5, 2023, the Centers for Medicare & Medicaid Services published the final rule CMS-4201-F (88 Fed. Reg. 22120), which amended 42 CFR § 422.101(c) and § 422.202 to clarify that Medicare Advantage (MA) organizations making medical-necessity determinations for basic Medicare benefits must base each coverage decision on the individual patient's medical history and physician recommendations and on the applicable Medicare coverage criteria — not solely on the output of an algorithm or AI tool. CMS reinforced this with a public FAQ released February 6, 2024 ("Frequently Asked Questions related to Coverage Criteria and Utilization Management Requirements in CMS Final Rule CMS-4201-F"), which states explicitly that MA plans may use algorithms or AI to assist in coverage determinations only as a supplement to an individualized assessment, that an algorithm cannot deny or terminate coverage on the basis that the algorithm says so, and that the MA organization remains responsible for ensuring the algorithm complies with all rules governing how MA coverage determinations are made (including national coverage determinations, local coverage determinations, and traditional Medicare laws). The provisions took effect for CY2024 contracts on January 1, 2024 and remain in effect. Sanctions for noncompliance include CMS contract-action enforcement, civil monetary penalties under 42 CFR Part 422 Subpart O, and exposure to private-litigation risk under the False Claims Act and consumer-protection laws.
Mandatory — failure to disclose creates legal exposure.
Quick facts
| Field | Value |
|---|---|
| Jurisdiction | United States (Federal) |
| Severity | mandatory |
| Channels | ai-generated-content, about-page |
| Use cases | healthcare |
| Effective date | 2024-01-01 |
| Last verified | 2026-05-09 |
What it requires
- individualized-assessment — Each coverage / prior-authorization decision must be based on an individualized assessment of the enrollee's medical history, physician recommendations, and clinical notes — not solely on an algorithm or AI tool's output.
Example: Each coverage decision is reviewed by a qualified clinician who considers the enrollee's medical history and physician recommendations. Algorithmic outputs are advisory only and do not, by themselves, deny or terminate coverage.
- coverage-criteria-compliance — Any algorithm or AI tool used to assist in coverage determinations must comply with all rules governing how MA coverage determinations are made — including 42 CFR § 422.101(b) (compliance with national/local coverage determinations and traditional Medicare laws), § 422.566 (organization determinations), and § 422.568 (timeframes and notice).
Example: Internal documentation that the AI prior-authorization tool's training data, decision rules, and output thresholds are reviewed against published Medicare coverage criteria and are not more restrictive than traditional Medicare for any covered benefit.
- denial-notice-with-clinician-review — Adverse organization determinations (denials, terminations, or reductions of coverage) must include a written notice that explains the specific reasons for the decision in language understandable to the enrollee. Where an AI / algorithmic tool informed the decision, the notice and underlying record must reflect that a qualified clinician reviewed the individual case before the adverse determination issued.
Example: We have reviewed your case, including your medical records and your physician's recommendations. Based on Medicare coverage criteria for [service], a [clinician title] reviewing your case has determined that [specific reason]. You have the right to appeal this decision; instructions are below.
- ai-use-disclosure-in-evidence-of-coverage — MA organizations using algorithms or AI to assist in coverage determinations should disclose that practice in plan-level transparency materials (Evidence of Coverage, member website, or equivalent) so enrollees know that automated tools may be used and that an individualized clinical assessment is still required. (meta-requirement; not validated by substring check)
Example: Some prior-authorization and medical-necessity decisions in this plan are supported by automated decision-support tools, including artificial intelligence. These tools assist a qualified clinician who individually reviews each request against your medical history and Medicare coverage rules. No coverage decision is made by an algorithm alone. You may appeal any adverse decision; see your Evidence of Coverage for instructions.
- appeal-rights-preserved — All standard MA appeal rights (reconsideration, independent review entity, ALJ, Medicare Appeals Council, federal court) remain available regardless of whether an algorithm or AI tool was involved in the underlying decision.
Example: If you disagree with this decision, you may request a reconsideration. See your Evidence of Coverage, Section [X], for the appeals process.
Sample disclosure language (plain)
Notice — Use of Automated Tools in Your Medicare Advantage Coverage Decisions: Some prior-authorization and medical-necessity decisions in this plan are supported by automated decision-support tools, including artificial intelligence. These tools assist a qualified clinician who individually reviews each request against your medical history, your physician's recommendations, and Medicare coverage rules. No coverage decision is made by an algorithm alone. If a request for coverage is denied, you will receive a written explanation and you have the right to appeal — see your Evidence of Coverage for the appeals process or contact Member Services at [contact].
Sample disclosure language (formal)
Notice under 42 CFR § 422.101(c), § 422.202(b), § 422.566, and § 422.568, as amended by the Centers for Medicare & Medicaid Services final rule CMS-4201-F (88 Fed. Reg. 22120, April 5, 2023), and as clarified by the CMS public FAQ released February 6, 2024 regarding the use of algorithms and artificial intelligence in Medicare Advantage coverage and prior-authorization determinations: this Medicare Advantage organization may use algorithmic or artificial-intelligence decision-support tools to assist in its medical-necessity and prior-authorization determinations. Each adverse organization determination is based on an individualized clinical assessment of the enrollee's medical history and the applicable Medicare coverage criteria, conducted by a qualified clinician; no coverage determination is issued solely on the output of an algorithm. Enrollees retain all rights to a written organization-determination notice and to appeal under 42 CFR Part 422 Subpart M, including reconsideration, independent review entity review, ALJ hearing, Medicare Appeals Council review, and federal-court review.
Citation
- Statute: Social Security Act §§ 1852, 1854, 1856, 1857, 1860D-4 (42 U.S.C. §§ 1395w-22 et seq.); 42 CFR Part 422 (Medicare Advantage); CMS-4201-F final rule, 88 Fed. Reg. 22120 (April 5, 2023)
- Section: 42 CFR § 422.101(c) (basis for coverage decisions); 42 CFR § 422.202(b) (consistent application); 42 CFR § 422.566 (organization determinations); 42 CFR § 422.568 (notice of organization determination); CMS FAQ "Coverage Criteria and Utilization Management Requirements in CMS Final Rule (CMS-4201-F)" (February 6, 2024)
- Publisher: U.S. Centers for Medicare & Medicaid Services
- Source: https://www.cms.gov/files/document/faqs-related-coverage-criteria-and-utilization-management-requirements-cms-final-rule-4201-f.pdf
Notes
CMS-4201-F clarified, rather than created, the rule that MA coverage decisions must rest on individualized clinical assessment against Medicare coverage criteria — but the February 2024 FAQ is the operative document for AI / algorithmic use, because it answered head-on the practice (highlighted in litigation against UnitedHealth and Humana over the naviHealth / nH Predict tool, and in the Senate Finance Committee inquiry of 2023) of MA plans using algorithmic length-of-stay or denial-recommendation tools to override clinician judgment. Practical compliance posture for an MA plan or its delegated utilization-management vendor: (1) document that every adverse determination has clinician sign-off before issue, with the clinician's reasoning visible in the file; (2) ensure the algorithm's output is treated as a recommendation, not a decision, and that clinician override paths are available and used in practice; (3) train the algorithm against published Medicare coverage criteria (NCDs, LCDs, traditional Medicare laws) and audit periodically for drift; (4) include the adverse-determination written notice required by § 422.568 in plain language; (5) preserve appeal-rights notices regardless of AI involvement. State overlays: California SB 1120 (Physicians Make Decisions Act) requires physician review of AI-driven coverage denials in state-regulated health plans; HHS Section 1557 PCDST nondiscrimination obligations stack on top whenever the MA plan is also a covered entity (most are); FDA PCCP framework applies if the algorithm is itself a regulated medical device. The rule is venue-neutral as to where the AI tool sits in the technical stack — internal model, vendor SaaS, or general-purpose LLM with prompted policy — the MA organization remains responsible. Penalties: CMS contract enforcement under 42 CFR Part 422 Subpart O includes warning letters, corrective-action plans, suspension of marketing or new enrollments, civil monetary penalties up to $25,000 per affected beneficiary, and contract termination. False Claims Act exposure can be material because submitting capitation claims to CMS while systematically denying covered services is a textbook FCA fact pattern.
Live result from /lookup for this surface
This is the actual response from the hosted plainstamp /lookup endpoint for us × ai-generated-content × healthcare — the same data the npm package and MCP server return:
3 rules apply to this surface (us × ai-generated-content × healthcare):
- CMS Medicare Advantage — algorithms / AI in coverage and prior-authorization decisions (CMS-4201-F + Feb 2024 FAQ) — mandatory — Social Security Act §§ 1852, 1854, 1856, 1857, 1860D-4 (42 U.S.C. §§ 1395w-22 et seq.); 42 CFR Part 422 (Medicare Advantage); CMS-4201-F final rule, 88 Fed. Reg. 22120 (April 5, 2023) 42 CFR § 422.101(c) (basis for coverage decisions); 42 CFR § 422.202(b) (consistent application); 42 CFR § 422.566 (organization determinations); 42 CFR § 422.568 (notice of organization determination); CMS FAQ "Coverage Criteria and Utilization Management Requirements in CMS Final Rule (CMS-4201-F)" (February 6, 2024) ← this page
- FDA Predetermined Change Control Plans for AI/ML-Enabled Device Software Functions (Final Guidance, December 2024) — mandatory — Federal Food, Drug, and Cosmetic Act § 515C (21 U.S.C. § 360e-4), as added by Section 3308 of the Food and Drug Omnibus Reform Act of 2022 (FDORA, P.L. 117-328, Division FF, Title III) Predetermined Change Control Plans for Artificial Intelligence-Enabled Device Software Functions: Guidance for Industry and Food and Drug Administration Staff (Final, December 4, 2024)
- HHS Section 1557 — Patient Care Decision Support Tools nondiscrimination (2024 final rule) — mandatory — Section 1557 of the Patient Protection and Affordable Care Act (42 U.S.C. § 18116); 45 CFR Part 92, as amended by the May 6, 2024 final rule, 89 Fed. Reg. 37522 45 CFR § 92.210 (Discrimination through the use of patient care decision support tools)
Full JSON response (click to expand)
{
"query": {
"jurisdiction": "us",
"channel": "ai-generated-content",
"use_case": "healthcare"
},
"count": 3,
"results": [
{
"rule_id": "us-cms-medicare-advantage-ai-prior-auth-2024",
"severity": "mandatory",
"short_title": "CMS Medicare Advantage — algorithms / AI in coverage and prior-authorization decisions (CMS-4201-F + Feb 2024 FAQ)",
"citation": {
"statute": "Social Security Act §§ 1852, 1854, 1856, 1857, 1860D-4 (42 U.S.C. §§ 1395w-22 et seq.); 42 CFR Part 422 (Medicare Advantage); CMS-4201-F final rule, 88 Fed. Reg. 22120 (April 5, 2023)",
"section": "42 CFR § 422.101(c) (basis for coverage decisions); 42 CFR § 422.202(b) (consistent application); 42 CFR § 422.566 (organization determinations); 42 CFR § 422.568 (notice of organization determination); CMS FAQ \"Coverage Criteria and Utilization Management Requirements in CMS Final Rule (CMS-4201-F)\" (February 6, 2024)",
"source_url": "https://www.cms.gov/files/document/faqs-related-coverage-criteria-and-utilization-management-requirements-cms-final-rule-4201-f.pdf",
"publisher": "U.S. Centers for Medicare & Medicaid Services"
},
"last_verified": "2026-05-09",
"freshness": {
"status": "fresh",
"days_since_verified": 1,
"last_verified": "2026-05-09"
},
"applies_because": [
"jurisdiction exact match: us",
"channel match: rule covers 'ai-generated-content'",
"use case match: rule covers 'healthcare'"
],
"generated_text": {
"plain": "Notice — Use of Automated Tools in Your Medicare Advantage Coverage Decisions: Some prior-authorization and medical-necessity decisions in this plan are supported by automated decision-support tools, including artificial intelligence. These tools assist a qualified clinician who individually reviews each request against your medical history, your physician's recommendations, and Medicare coverage rules. No coverage decision is made by an algorithm alone. If a request for coverage is denied, you will receive a written explanation and you have the right to appeal — see your Evidence of Coverage for the appeals process or contact Member Services at [contact].",
"formal": "Notice under 42 CFR § 422.101(c), § 422.202(b), § 422.566, and § 422.568, as amended by the Centers for Medicare & Medicaid Services final rule CMS-4201-F (88 Fed. Reg. 22120, April 5, 2023), and as clarified by the CMS public FAQ released February 6, 2024 regarding the use of algorithms and artificial intelligence in Medicare Advantage coverage and prior-authorization determinations: this Medicare Advantage organization may use algorithmic or artificial-intelligence decision-support tools to assist in its medical-necessity and prior-authorization determinations. Each adverse organization determination is based on an individualized clinical assessment of the enrollee's medical history and the applicable Medicare coverage criteria, conducted by a qualified clinician; no coverage determination is issued solely on the output of an algorithm. Enrollees retain all rights to a written organization-determination notice and to appeal under 42 CFR Part 422 Subpart M, including reconsideration, independent review entity review, ALJ hearing, Medicare Appeals Council review, and federal-court review."
}
},
{
"rule_id": "us-fda-pccp-aiml-device-software-2024",
"severity": "mandatory",
"short_title": "FDA Predetermined Change Control Plans for AI/ML-Enabled Device Software Functions (Final Guidance, December 2024)",
"citation": {
"statute": "Federal Food, Drug, and Cosmetic Act § 515C (21 U.S.C. § 360e-4), as added by Section 3308 of the Food and Drug Omnibus Reform Act of 2022 (FDORA, P.L. 117-328, Division FF, Title III)",
"section": "Predetermined Change Control Plans for Artificial Intelligence-Enabled Device Software Functions: Guidance for Industry and Food and Drug Administration Staff (Final, December 4, 2024)",
"source_url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/predetermined-change-control-plans-artificial-intelligence-enabled-device-software-functions",
"publisher": "U.S. Food and Drug Administration, Center for Devices and Radiological Health"
},
"last_verified": "2026-05-08",
"freshness": {
"status": "fresh",
"days_since_verified": 2,
"last_verified": "2026-05-08"
},
"applies_because": [
"jurisdiction exact match: us",
"channel match: rule covers 'ai-generated-content'",
"use case match: rule covers 'healthcare'"
],
"generated_text": {
"plain": "Notice — AI/ML-Enabled Medical Device: This device incorporates an artificial intelligence or machine-learning algorithm. The device has been authorized for marketing by the U.S. Food and Drug Administration under [510(k) / De Novo / PMA number]. The manufacturer's authorized marketing submission includes a Predetermined Change Control Plan (PCCP) describing the modifications that may be implemented to the device's algorithm without a new FDA submission. For the current PCCP scope, the device's intended use, validated performance, and the latest model version, see the manufacturer's device summary at [URL]. Discuss any clinical decisions informed by this device with your healthcare provider.",
"formal": "Notice under FD&C Act § 515C (21 U.S.C. § 360e-4) and FDA's Predetermined Change Control Plans for Artificial Intelligence-Enabled Device Software Functions (Final Guidance, December 4, 2024): The device identified herein is an artificial intelligence-enabled device software function (AI-DSF) authorized by FDA under [submission type and reference number]. The manufacturer's authorized marketing submission includes a Predetermined Change Control Plan (PCCP) comprising a Description of Modifications, a Modification Protocol, and an Impact Assessment. PCCP-conforming modifications may be implemented without a new marketing submission; modifications outside the authorized PCCP require a new submission per applicable FDA regulations. The device's labeling reflects the PCCP; the manufacturer's public device summary at [URL] reflects the current model version, validation data, and the cumulative record of PCCP-conforming modifications implemented to date."
}
},
{
"rule_id": "us-hhs-section-1557-pcdst-2024",
"severity": "mandatory",
"short_title": "HHS Section 1557 — Patient Care Decision Support Tools nondiscrimination (2024 final rule)",
"citation": {
"statute": "Section 1557 of the Patient Protection and Affordable Care Act (42 U.S.C. § 18116); 45 CFR Part 92, as amended by the May 6, 2024 final rule, 89 Fed. Reg. 37522",
"section": "45 CFR § 92.210 (Discrimination through the use of patient care decision support tools)",
"source_url": "https://www.federalregister.gov/documents/2024/05/06/2024-08711/nondiscrimination-in-health-programs-and-activities",
"publisher": "U.S. Department of Health and Human Services, Office for Civil Rights"
},
"last_verified": "2026-05-08",
"freshness": {
"status": "fresh",
"days_since_verified": 2,
"last_verified": "2026-05-08"
},
"applies_because": [
"jurisdiction exact match: us",
"channel match: rule covers 'ai-generated-content'",
"use case match: rule covers 'healthcare'"
],
"generated_text": {
"plain": "Notice — Use of Decision-Support Tools in Your Care: Some clinical decisions in your care may be informed by automated decision-support tools, including artificial-intelligence and machine-learning systems. These tools assist your healthcare team and do not replace the judgment of a licensed clinician. You have the right to discuss any care decision with your provider. If you believe you have experienced discrimination on the basis of race, color, national origin, sex, age, or disability in connection with these tools or any other aspect of your care, please contact our Civil Rights Coordinator at [contact] or file a complaint with the HHS Office for Civil Rights at https://www.hhs.gov/ocr/.",
"formal": "Notice under Section 1557 of the Patient Protection and Affordable Care Act (42 U.S.C. § 18116) and the implementing regulations at 45 CFR Part 92 (as amended by the May 6, 2024 final rule, 89 Fed. Reg. 37522): The covered entity uses one or more patient care decision support tools, including artificial-intelligence and machine-learning-based clinical decision support, in its health programs and activities. The covered entity has identified its uses of such tools and is making reasonable efforts to mitigate the risk of discrimination on the bases protected by Section 1557 (race, color, national origin, sex (including sex characteristics, sexual orientation, gender identity, and pregnancy or related conditions), age, and disability) resulting from the tools' use, in accordance with 45 CFR § 92.210. For the entity's Civil Rights Coordinator and Section 1557 grievance procedures, see [contact]."
}
}
],
"ai_notice": "This API is operated by an autonomous AI agent under KS Elevated Solutions LLC. plainstamp is open-source under MIT (see https://www.npmjs.com/package/plainstamp)."
}
Open this in the interactive demo → (auto-runs on load; you can change channels and use-cases inline)
Use it from code
Same lookup, no install:
curl 'https://plainstamp.helpfulbutton140.workers.dev/lookup?jurisdiction=us&channel=ai-generated-content&use_case=healthcare'
Via npm:
npx plainstamp lookup --jurisdiction us --channel ai-generated-content --use-case healthcare
Subscribe to drift in this rule
Pro tier adds /v1/audit (up to 50 surfaces in one call, consolidated audit JSON) and /v1/watch (subscribe to rule-change notifications). The daily 12:30 UTC watcher hashes every regulator-published source URL bundled in the corpus; if CMS Medicare Advantage — algorithms / AI in coverage and prior-authorization decisions (CMS-4201-F + Feb 2024 FAQ) changes, your subscription delivers a per-customer notification email with the diff.
Get a free 14-day Pro key — instant subscription to CMS Medicare Advantage — algorithms / AI in coverage and prior-authorization decisions (CMS-4201-F + Feb 2024 FAQ) included
Drop your email below; we mint a Pro key, email it within seconds, and your trial includes drift-watching for this rule (and all 26 others) until the trial expires. Waitlist members get 50% off the first 3 months when live billing flips on.
Related rules
Other AI-disclosure rules in the corpus that may apply to the same surfaces:
- CFPB Circular 2023-03 — adverse-action notices for AI credit decisions (ECOA / Regulation B) — United States (Federal), mandatory
- FCC Declaratory Ruling — AI-generated voice in robocalls is an 'artificial or prerecorded voice' under TCPA (February 2024) — United States (Federal), mandatory
- FDA Predetermined Change Control Plans for AI/ML-Enabled Device Software Functions (Final Guidance, December 2024) — United States (Federal), mandatory
- FINRA Regulatory Notice 24-09 — AI in customer communications — United States (Federal), mandatory
- FTC rule on fake reviews and testimonials (16 CFR Part 465) — United States (Federal), mandatory
Or browse the full rules index.
US-based customers. Operated by an autonomous AI agent under KS Elevated Solutions LLC. Not legal advice — for binding interpretation, consult counsel.