MAOs cannot rely solely on AI tools in making determinations

Under the final rule, MAOs must comply with national coverage determinations (NCD), local coverage determinations (LCD), and general coverage and benefit conditions set forth in traditional Medicare laws.^[5] In preamble commentary to the final rule, CMS explained that MAOs must ensure that they are making these determinations “based on the circumstances of the specific individual, as outlined at [42 C.F.R.] § 422.101(c), as opposed to using an algorithm or software that doesn’t account for an individual’s circumstances” (emphasis added).^[6]

In the FAQs, CMS clarified that MAOs may use algorithms or other forms or artificial intelligence (AI) to assist in making coverage determinations, but only if the algorithm or AI “complies with all applicable rules for how coverage determinations by MA organizations are made.”^[7] Specifically, CMS explained that “compliance is required with all of the rules at [42 C.F.R.] § 422.101(c) for making a determination of medical necessity, including that the MA organization base the decision on the individual patient’s circumstances, so an algorithm that determines coverage based on a larger data set instead of the individual patient’s medical history, the physician’s recommendations, or clinical notes would not be compliant with § 422.101(c).” Thus, while an MAO may use an algorithm to predict a patient’s potential length of stay in deciding to terminate a patient’s post-acute care stay, “that prediction alone cannot be used as the basis to terminate post-acute care services . . . the patient must no longer meet the level of care requirements needed for the post-acute care at the time the services are being terminated, which can only be determined by re-assessing the individual patient’s condition prior to issuing the notice of termination of services” (emphasis added).

Referencing the nondiscrimination requirements of the Affordable Care Act, the FAQs also note concern that “algorithms and many new artificial intelligence technologies can exacerbate discrimination and bias” and suggest that MAOs “prior to implementing an algorithm or software tool, ensure that the tool is not perpetuating or exacerbating existing bias, or introducing new biases.”

The alleged use of AI in making coverage determinations is the subject of pending litigation against two payers—UnitedHealth Group and Humana—in two separate lawsuits filed late last year.^[8] The complaint against Humana alleges that Humana uses an AI tool, nH Predict, “to predict how much care an elderly patient ‘should’ require but overrides real doctors’ determinations as to the amount of care a patient in fact requires to recover. As such, Humana makes coverage determinations not based on individual patient’s needs, but based on the outputs of the nH Predict AI Model, resulting in the inappropriate denial of necessary care prescribed by the patients’ doctors.”^[9] The complaint further alleges that “Humana’s implementation of the nH Predict AI Model resulted in a significant increase in the number of post-acute care coverage denials.” Raising similar allegations, the complaint against UnitedHealth Group claims that the “nH Predict AI Model spits out generic recommendations that fail to adjust for a patient’s individual circumstances and conflict with basic rules on what Medicare Advantage plans must cover.”^[10]

Though they are in the very early stages, these lawsuits demonstrate that, while Congress continues to debate how to regulate AI across various industries, such technologies are already being deployed in the healthcare space.

The lawsuits also come at a time when providers are seeing an increase in MA denials. A recent report published by the American Hospital Association and Syntellis identified a 55.7% jump in overall revenue reductions related to MA denials from January 2022 to July 2023.^[11] By contrast, denial-related revenue from commercial payers also rose, but by just 20.2% over the same period.

MAOs must comply with strict rules when creating internal coverage criteria

Under the final rule, MAOs may create “publicly accessible” internal coverage criteria that are based on current evidence in widely used treatment guidelines or clinical literature when coverage criteria are “not fully established in applicable Medicare statutes, regulations, NCD or LCD . . .”^[12] However, in doing so, the MAO must demonstrate that the additional criteria provide clinical benefits that are “highly likely to outweigh any clinical harms.”^[13]

In the FAQs, CMS clarified that, to make this demonstration, MAOs must offer a “public explanation [that] should systematically explain the harms and benefits and use appropriate clinical evidence and citation of current, widely used treatment guideline or clinical literature.”^[14] Even if an MAO seeks to use coverage criteria in an LCD adopted by a Medicare contractor outside of the plan’s jurisdiction, the MAO must still follow the coverage requirements set forth in the final rule, including ensuring that the criteria is based on current, widely used evidence and making the criteria publicly available.

CMS also clarified that “predictive algorithms or software tools cannot apply other internal coverage criteria that have not been explicitly made public and adopted in compliance” with the requirement in the final rule that the criteria be publicly accessible and based on current evidence in “widely used treatment guidelines or clinical literature.”^[15] In other words, MAOs cannot mask unpublished coverage requirements using AI tools.

CMS warned that it will “continue to monitor . . . to ensure compliance” and that it “may issue additional guidance as needed to ensure that internal coverage criteria are being developed only in those situations where clinical benefit is highly likely to outweigh clinical harm.”^[16]

MAOs bound by two midnight benchmark, not two midnight presumption

The “two-midnight rule” colloquially describes the rule that inpatient admissions are generally covered under Medicare Part A if the admitting physician expects the patient to require a hospital stay that crosses two midnights.^[17] In the final rule, CMS clarified that this rule applies to MAOs.

In the FAQs, CMS reiterated that MAOs are required to follow the inpatient admission criteria codified in 42 C.F.R. § 412.3, including the two-midnight rule. In doing so, CMS emphasized the importance of the admitting physician’s judgment, explaining that while an MAO may evaluate whether the admitting physician’s expectation that the patient would cross two midnights was reasonable, such evaluation “should defer to the judgment of the physician as long that judgment was reasonable” based on the medical record.

However, the FAQs, like the final rule, also included a notable caveat: MAOs are not required to follow the two midnight “presumption.” The two midnight presumption refers to the presumption that all inpatient claims that cross two midnights following the inpatient admission order are “‘presumed’ appropriate for payment [under Medicare Part A] and are not the focus of medical review” by traditional Medicare audit contractors (absent other evidence).^[18] This presumption does not apply to MAOs’ “decision[s] about when and how to engage in review of a particular inpatient stay.”^[19] CMS added that MAOs “may still use prior authorization or concurrent case management review of inpatient admissions to determine” medical necessity of the admission.

MAOs may continue to use prior authorization, but within certain guardrails

Preamble commentary to the final rule noted that “[i]n recent years, CMS has received feedback from various stakeholders . . . that utilization management in MA, especially prior authorization, can sometimes create a barrier to accessing medically necessary care.”^[20] The commentary referenced a report issued by the U.S. Department of Health and Human Services Office of Inspector General (OIG) which found that MAOs sometimes denied prior authorization requests “even though the requested services met Traditional Medicare coverage guidelines.”^[21] In the final rule, CMS established guardrails for MAOs’ use of prior authorization.

In the FAQs, CMS reiterated that while MAOs may continue to use prior authorization, they must comply with the provisions at 42 C.F.R. § 422.138. Additionally, CMS reminded MAOs that prior authorization should not function to delay or discourage care; approval of a prior authorization request must be valid for as long as medically reasonable and necessary to avoid disruptions in care; and all MAOs “must establish a Utilization Management Committee to annually review utilization management policies and ensure consistency with Traditional Medicare” coverage standards to ensure prior authorization is being used appropriately. CMS added that prior authorization decisions must be made “as expeditiously” as the patient’s health condition requires.

CMS is monitoring MAO compliance, may take enforcement action

In October, following publication of the final rule, CMS issued a memorandum notifying MA plans that starting in January 2024, it would begin “conducting both routine and focused audits of organizations to assess compliance with the UM [utilization management] requirements” published in the final rule.^[22]

Although provider groups have expressed concern that MAOs would not comply with the new regulations,^[23] in the FAQs, CMS warned that it would be “monitoring closely” MAOs’ compliance with the new regulations and noted that it has “a number of tools” to address noncompliance, including imposition of civil monetary penalties.^[24]

Conclusion

Although it is too early to tell whether MAOs will comply with these new regulations, publication of these FAQs indicates that MAO behavior continues to be a focus point for CMS. In fact, MA continues to capture the attention of the broader government, as members of Congress have begun urging CMS “to increase oversight of [AI] tools used by MA plans.”^[25] Additionally, on March 18, 2024, OIG published an impact brief highlighting OIG’s work on MA prior authorization issues and noting that its work “drew national attention to the problem.”^[26]

Providers should ensure that they are familiar with these regulations—and the preamble commentary—so that they can hold MAOs accountable for inappropriate and improper denials.

Takeaways

• Medicare Advantage organizations (MAOs) cannot use artificial intelligence (AI) tools alone in making coverage determinations; instead, such determinations must be based on the circumstances of the specific individual.

• MAOs cannot use AI tools that apply internal coverage criteria that have not been made publicly available in accordance with 42 C.F.R. § 422.101(b)(6).

• MAOs are bound by the two midnight benchmark, but not the two midnight presumption.

• MAOs may use prior authorization but must comply with the requirements in 42 C.F.R. § 422.138; prior authorization should not function to delay or discourage care.

• The Centers for Medicare & Medicaid Services is conducting audits of MAOs to assess compliance with the new regulations.