CMS clarifies Medicare Advantage organizations' use of AI and algorithms in coverage decisions

The Centers for Medicare and Medicaid Services (CMS) has issued FAQs clarifying the use of artificial intelligence (AI) and algorithms by Medicare Advantage organizations (MAOs) in coverage decisions. Following the release of its calendar year 2024 Medicare Advantage (MA) final rule (2024 MA final rule), CMS sought to clarify certain of its new requirements, including the use of algorithms and AI by MAOs for coverage determinations. Questions regarding the use of these technologies by MAOs also come in the wake of lawsuits related to such use against health insurers as well as recent Congressional probing from the Senate Permanent Subcommittee on Investigations and a hearing by the Senate Finance Committee on the responsible and ethical deployment of AI in healthcare.

In the FAQs, CMS is permissive of MAOs' use of AI or algorithms for coverage determinations, but is clear that MAOs remain responsible for ensuring compliance with all applicable coverage rules. As an example, CMS explains that MAOs are responsible for making coverage determinations based on each patient’s individual circumstances in accordance with the rules at 42 CFR § 422.101(c) on medical necessity determinations. CMS states that algorithms that use larger data sets to make these determinations would not comply with these rules, as the decisions need to be based on the specific individual’s medical history, physician recommendations or clinical notes.

Relatedly, MAOs may only deny coverage for basic benefits based on coverage criteria listed in § 422.101(b) or (c) or other “expressly permissible bases.” Any AI utilized by MAOs should not shift the enumerated coverage criteria over time with the input of additional data. CMS also notes that AI can sometimes exacerbate inequities, and reminds MAOs of the nondiscrimination requirements within the Affordable Care Act.

In the case of deciding whether to terminate post-acute care services, CMS provides that software tools may predict how long patients may stay, but this prediction cannot be used as the predicate to terminate coverage. Instead, to properly comply with the rules at § 422.101(c), the particular patient’s condition must be assessed prior to issuing the notice of termination of services. Individual patient circumstances must also be considered when a MAO considers covering inpatient admissions.

CMS’s AI-specific guidance aligns with the American Medical Association (AMA) Principles for Augmented Intelligence Development, Deployment, and Use, in which the AMA expresses concern regarding the use of AI due to the lack of transparency and the potential for reducing needed care, stating:

Rather than payors making determinations based on individualized patient care needs, reports show that decisions are based on algorithms developed using average or ‘similar patients’ pulled from a database. Models that rely on generalized, historical data can also perpetuate biases leading to discriminatory practices or less inclusive coverage.

In addition to focusing on AI and algorithms in coverage determinations, the CMS guidance addresses prior authorization requirements in the 2024 MA final rule, explaining that prior authorization can still be used “except for emergency, urgently needed and stabilization services and out-of-network services covered by MA PPO plans.” Prior authorization is only permitted by MA coordinated care plans when they are confirming whether a service or benefit is medically necessary or clinically appropriate for supplemental benefits. Prior authorization, as CMS states, “should not function to delay or discourage care.” The 2024 MA final rule and requirements concerning prior authorization come following a number of US states considering or adopting legislation to thwart health insurers’ prior authorization practices.

Other MA requirements addressed in these FAQs include internal coverage criteria, post-acute care, the two-midnight rule, the Medicare interrupted stay policy and utilization management requirements.  

Norton Rose Fulbright attorneys will continue to monitor MA rules and requirements as they concern providers.