New CMS Guidance on Use of Algorithms and AI in Prior Authorizations and Utilization Management

Use of algorithms and artificial intelligence (AI) in prior authorization and utilization management is facing growing criticism and litigation. Notable lawsuits include alleged automatic authorization denials for tests that don’t match plan-determined diagnosis or that denied payment for post-acute care that exceed AI-predicted lengths of stays. The criticism has been that these decisions are not based on proper criteria or made in compliance with regulations.

In October 2023, President Joe Biden signed an executive order to establish AI standards. Specifically, regarding AI in healthcare, the order requires “responsible use of AI in healthcare” and affordable drug development. It also charges the Department of Health and Human Services to set up a safety program to collect reports of “harms or unsafe healthcare practices involving AI.” Regulators have now attempted to clarify “responsible use” through regulations. To help clarify, the Centers for Medicare and Medicaid Services (CMS) released a Health Plan Management System (HPMS) memorandum with responses to frequently asked questions (FAQs) regarding the use of algorithms and AI in utilization management in Medicare Advantage (MA). The memorandum reiterates regulations put out in 2023 that algorithms, software tools and AI may only assist in utilization management if regulatory requirements for coverage determinations are based on a patient’s individualized circumstances.

Prior to the memo’s release, CMS published limits on the use of internal prior authorization rules and AI in their April 5, 2023, final rule for basic benefits in making coverage determinations and the memo cites to the rule several times. The rule stressed that MA plans must take into account individual circumstances, including medical history and physician recommendations, and apply criteria stated in Medicare statutes, regulations, national coverage determinations and local coverage determinations for benefits that would be covered under Parts A and B in original Medicare. 42 C.F.R. § 422.101(c)(i)(C); 42 C.F.R. § 422.101(b), (c)(i)(A). The memorandum reminded MA plans at FAQ 1 that they may only use internal coverage criteria if the criteria are not fully established, criteria used is evidence-based, use of criteria has clinical benefits that exceed clinical harms, and additional criteria are publicly accessible. 42 C.F.R. § 422.101(b)(6). Finally, the rule requires that adverse medical necessity determinations be reviewed by a physician or other appropriate health care professional that is appropriate for the service at issue with expertise in the field of medicine or health care. 42 C.F.R. §?422.566(d).

The HPMS memo guidance gives more specific examples for when the use of AI is compliant with new coverage determination regulations for benefits that would be covered under Original Medicare. For example, AI may be used to suggest tests a patient should receive for a diagnosis or predict the length of stay for inpatient or post-acute care. See FAQ No. 2. However, coverage determinations cannot be based on larger data sets alone without considering patient-specific circumstances, including a patient’s medical history, physician recommendations and clinical notes. The memo also notes algorithms cannot adjust coverage criteria or deviate from the publicly posted criteria under § 422.101(b)(6) and determinations to terminate services or discharge a patient must include a reassessment of a patient’s condition with a detailed explanation as to why services are either no longer reasonably necessary or are no longer covered and a description of the applicable coverage criteria and rules. See FAQ No. 7. Note, CMS made a distinction regarding supplemental benefits and the use of clinical standards, algorithms, and AI. Coverage of these benefits is expected when clinically appropriate, but also CMS notes that Medicare does not have its own coverage criteria for these benefits and that a standard of medical necessity might not be appropriate for these benefits. See FAQ No. 13. With much looser restrictions on coverage criteria, it is possible for MA plans to work algorithms and AI in the utilization management for supplemental benefits more than traditionally covered services.

The memorandum also reminds MA plans at FAQ 2 of their non-discrimination requirements under Section 1557 of the Affordable Care Act. The memo reiterates that MA organizations should ensure that any software tools used are not incorporating bias or introducing new biases towards any group of patients. However, the memo did not detail examples of practices to avoid falling out of compliance.

Also at FAQ 2, the memo acknowledges MA plans may use algorithms and AI to assist in several activities, but these tools cannot be the bases for their decisions as individual patient circumstances must be the focus. The memo wrapped with reminders of tools CMS has at its disposal for noncompliance and detailing heightened audit plans for the near future. CMS will be using the updated guidance for already planned routine audits. For plans not undergoing routine audits, CMS will be adding new focused audits to review utilization management practices against the new regulations and guidance. See FAQ No. 14.

Note, this guidance also applies to plans under the Medicare-Medicaid Plans. While we are likely to see guidance come down from individual state entities regarding use of algorithms and AI resembling the CMS stance, state Medicaid agencies will need to opine on their stance regarding managed-care plans use of these tools in utilization management for further restrictions to apply in the Medicaid space.