CMS Cracks Down on Algorithmic Denials in Medicare Advantage: AI Governance Moves from Ethics to Enforcement

The Centers for Medicare & Medicaid Services (CMS) has formally proposed regulatory guardrails targeting the unaccountable use of artificial intelligence in Medicare Advantage prior authorization systems. Published as part of the April 2025 final rule (CMS-4208-F), the policy targets automation bias and opacity by mandating transparency, interoperability, and annual equity audits. The trigger: systemic evidence that machine learning tools have enabled improper denials of medically necessary care—particularly in post-acute settings.

CMS cites an alarming statistic: over 80 percent of denied claims are overturned on appeal. That figure tracks with the 2024 U.S. Senate Finance Committee report, which found that major insurers, including UnitedHealth through its naviHealth subsidiary, were using predictive models to curtail skilled nursing facility stays based on population averages rather than patient-specific needs (Senate Committee on Finance, 2024). In practice, this translated to algorithmically-driven denials that systematically offloaded clinical and financial risk onto hospitals, providers, and ultimately patients.

The CMS rule marks a shift from theoretical AI ethics to applied technical governance. First, it requires Medicare Advantage plans to publicly disclose which AI or machine learning systems are used in utilization management decisions. This represents a baseline architectural expectation: if automation is shaping clinical coverage decisions, the underlying models must be visible to both regulators and providers. That visibility must include feature inputs, decision thresholds, and model rationale—preferably surfaced through runtime explainability APIs. Anything less is regulatory theater.

Next, CMS mandates that internal coverage criteria be made publicly available. While on the surface this appears to be a policy disclosure requirement, it introduces direct technical consequences. Coverage rules must be published in structured, machine-readable formats. Static PDFs will not satisfy interoperability needs. To support automated prior auth adjudication and EHR integration, these criteria should be expressed using FHIR PlanDefinition or CQL logic objects. If insurers continue to operate their business rules in siloed, proprietary engines, they will fail the interoperability mandate, an architectural liability with both compliance and operational cost implications.

CMS also calls for annual health equity audits. But audits that merely count disparities without prompting algorithm retraining are insufficient. These reviews must analyze model performance across protected attributes—race, age, disability status—and force corrective action when variance thresholds are exceeded. To support this, payer systems will need full-featured model lifecycle management infrastructure: version tracking, retraining pipelines, and statistical audit tooling. Few MA plans have such architecture in place today.

Critically, the final rule stops short of resolving the problem of vendor opacity. Many MA organizations outsource utilization management logic to third-party platforms that refuse to disclose model architecture or training data. CMS will need to define a joint liability framework. If a black-box vendor model generates a denial, the health plan must remain accountable. Otherwise, enforcement collapses under the weight of contractual ambiguity.

The real-world failures are already documented. NaviHealth’s model, which estimated discharge readiness from generalized recovery data, produced denials for patients still requiring care, sometimes contradicting the medical judgment of treating clinicians. These denials were algorithmic only in deployment; their logic was actuarial, not clinical. And they were anything but neutral in impact. Patients requiring longer-term post-acute care, especially older adults with complex conditions, were disproportionately affected.

This rule is a statement that the infrastructure of AI in healthcare must adhere to the same standards of accountability, transparency, and equity as any other part of care delivery. Medicare Advantage plans now face a choice: retrofit governance around their existing black-box systems or redesign their architectures for regulatory-grade transparency. In either case, this rule transforms AI deployment from a technology choice into a compliance strategy. And noncompliance, in this environment, is no longer defensible.