1. Introduction
According to the Population Reference Bureau, the proportion of Americans over 65 has grown at a rate “unprecedented in U.S. history.”Reference Mather 1 Concurrently, annual premiums for employer-sponsored family health coverage have steadily increased (with the 2024 Kaiser Family Foundation Employer Health Benefits Survey marking a 7% rise from the previous year). 2 Without a significant financial incentive to stay on employer insurance, a greater proportion of Americans are turning to government-subsidized health insurance programs, such as Medicare and Medicaid, for the bulk of their coverage.Reference Hale 3 An aging and increasingly multimorbid population, coupled with concerns regarding the sufficiency of the physician workforce, imposes greater demands on the healthcare system and, consequently, on healthcare insurers.Reference Adashi 4 As a result, providers and insurers struggling to cope with this burden are increasingly turning to artificial intelligence (AI) as a potential solution.Reference Mehta 5 Significant attention has been paid to the ethical and social implications of AI used directly in the clinical pathway (e.g., diagnostic algorithms).Reference Morley 6 However, far less attention has been paid to AI applications that indirectly shape healthcare outcomes, including the use of AI by insurers. Thus, the application of AI in insurance decision-making creates a troubling regulatory gap that, despite increased media attention, has not been sufficiently addressed.
In this article, I argue that addressing the insurance AI regulatory gap requires coordinated action across multiple federal and state agencies, each exercising authority within their respective domains. I take insurance AI to refer to algorithmic tools deployed by health insurers to make coverage decisions and inform utilization management (i.e., the process by which insurers monitor and control the use of healthcare services to evaluate medical necessity and cost effectiveness). Prior authorization — the process by which insurers require physicians (and other providers) to obtain advance approval before delivering care — is one example of a coverage decision pathway, and will serve as the primary illustrative case in this article. Unlike clinical AI, which may diagnose disease or directly guide treatment, and thus falls under established medical device frameworks, 7 insurance AI operates in a regulatory “grey area” between healthcare delivery and payment. In order to bridge this gap, I aim to demonstrate how existing authorities can be harmonized to create effective oversight of insurance AI across the product lifecycle (i.e., from development and validation through deployment and surveillance). The normative question — whether comprehensive federal oversight of insurance AI is indeed desirable — may be contested. However, when algorithmic tools determine whether elderly patients receive necessary rehabilitation, whether cancer patients can access recommended treatments, or whether disabled beneficiaries qualify for home health services, these tools warrant rigorous oversight regardless of whether they are labeled as “medical devices,” “administrative tools,” or “decision support systems.” The regulatory structure must reflect the reality of harm, not the semantics of categorization. As insurance AI becomes increasingly prevalent, the choice is not whether to regulate, but how to regulate effectively within existing legal structures. This article provides a roadmap.
The article is structured as follows. In Section 2, I examine Medicare Advantage as an illustrative case, detailing how insurance AI tools are deployed in prior authorization pathways and documenting the resulting harms to beneficiaries. I provide updated analysis of the UnitedHealth/NaviHealth litigation and recent congressional investigations. In Section 3, I map the current regulatory landscape, identifying what each relevant agency can and cannot do under existing law. I demonstrate that while significant regulatory authority does exist, it remains uncoordinated, leaving critical gaps. In Section 4, I present a new framework for interagency coordination, specifying which agency should regulate which aspects of insurance AI and how these authorities should be harmonized. I draw on one successful precedent for interagency collaboration: the 2011 federal banking model risk management framework. In Section 5, I address anticipated objections, including concerns about innovation, administrative capacity, and the appropriate balance between federal and state authority. In Section 6, I offer concluding remarks.
2. Medicare (Dis)advantage: Insurance AI in Prior Authorization
Medicare is the US federal health insurance program for those aged 65 and older, younger people with disabilities, and individuals with end-stage renal disease or ALS. Traditional Medicare covers hospital care (Part A) and outpatient care (Part B) and allows beneficiaries to opt in to prescription drug coverage (Part D) for an additional premium. Medicare covers most, but not all, of the costs associated with approved curative healthcare services. Medicare Advantage (MA, or Part C) plans, provided by private insurers contracted with the federal government, “bundle” extra benefits — like hearing, vision, and dental coverage — and prescription charges otherwise not included in Medicare.Reference Agarwal 8 In addition, unlike Medicare, MA plans also provide spending caps on out-of-pocket expenditures.Reference Agarwal 9 Because of these benefits, MA plans have become increasingly popular.Reference Cunningham-Cook 10 According to the Center for Medicare Advocacy, Medicare Advantage enrollment now accounts for over 50% of the total Medicare population, with annual overpayments surpassing $75 billion.Reference Lipschutz 11
Medicare approves MA plans; however, unlike Medicare, MA plans are offered by private companies, which require patients to be approved through prior authorization before provision of care.Reference Abelson and Sanger-Katz 12 Prior authorization requirements often result in the delay or denial of access to care that vulnerable populations would have otherwise received under Medicare. According to a 2022 report by the Inspector General of the Department of Health and Human Services, 13% of MA plan prior authorization denials would not have been denied under Medicare.Reference Levinson 13
2.1. The NaviHealth Case: A Paradigm of Insurance AI Risk
In March 2023, investigative reporting by STAT News revealed that major MA insurers were deploying algorithmic tools to determine the length and intensity of post-acute care coverage, particularly for elderly patients recovering from serious illnesses or injuries in nursing homes and rehabilitation facilities.Reference Ross and Herman 14 The reports identified the UnitedHealth acquisition of NaviHealth for $2.5 billion in 2020 and the subsequent implementation of the proprietary algorithm “nH Predict” as being correlated with a significant increase in denial of care claims. 15 The nH Predict tool operates by comparing the patient submitting a claim to historical data from a pool of approximately six million beneficiaries — roughly 10% of the US population over 65.Reference Shuren and Hughes 16 When a claim is submitted, the algorithm identifies the “most similar” case from its database and recommends that the insurer approve only the amount of care that resulted in a positive outcome for that historical comparator. For example, if the matched case was hospitalized for ten days, the algorithm predicts the claimant should receive ten days of coverage, regardless of the claimant’s individual physician assessment, clinical notes, or ongoing treatment needs.
This application of insurance AI is ostensibly intended to expedite claims review, increase cost effectiveness, and improve quality of care by reducing approval wait times. However, investigations have suggested opposite effects: rather than personalizing care, these tools have made coverage decisions prescriptive and inflexible. For instance, in 2023, NaviHealth set an explicit performance target to keep rehabilitation stays within 1% of the days projected by the algorithm. 17 Internal communications obtained by STAT showed that clinical case managers (i.e., employees who reviewed patient cases and made recommendations to physician reviewers) were being evaluated on their adherence to algorithmic predictions, and if they recommended care beyond what the algorithm suggested, they were subject to performance review. 18 The result was a system in which expert judgement was systematically subordinated to algorithmic output, even when that output contradicted the assessment of treating physicians.
The NaviHealth “nH Predict” tool is not an isolated case. The algorithm has been licensed to multiple major insurers, including Humana (the nation’s second-largest MA provider) and numerous regional health plans, potentially affecting more than 15 million MA beneficiaries (or, approximately half of all MA enrollees). 19 In fact, the NaviHealth case is one instance of a broader pattern. In 2023, a ProPublica investigation revealed that Cigna had deployed an algorithm called PxDx that allowed physicians to automatically deny claims in batches.Reference Rucker 20 Over a two-month period in 2022, Cigna physicians denied upwards of 300,000 claims using PxDx, spending an average of 1.2 seconds reviewing each case.Reference Rucker 21
2.2. Congressional Investigation and Quantitative Evidence
In October 2024, the Senate Permanent Subcommittee on Investigations released findings from its investigation into MA prior authorization practices.Reference Richard Blumenthal 22 The Subcommittee found that UnitedHealth’s denial rate for prior authorization requests in post-acute care increased dramatically concurrent with NaviHealth’s acquisition and subsequent deployment of the nH Predict tool: from 10.9% in 2020 to 16.3% in 2021 and 22.7% in 2022. 23 Notwithstanding the aging population and influx of MA beneficiaries, this statistic demonstrates a disproportionate increase in denial rates, which more than doubled over two years, thereby suggesting that increases in denial rates could not be attributed to corresponding increases in inappropriate use or fraud. 24 Rather, denials appeared to be driven by algorithmic recommendations that systematically underestimated the care needs of multi-morbid, elderly patients when compared to treating physician assessments. There were numerous cases in which patients were denied coverage for care that was subsequently provided and resulted in functional improvement, contradicting algorithmic predictions that such care would be futile or excessive. 25 Investigations also found that another major MA insurer, CVS Health, deployed AI tools to reduce spending at post-acute facilities, with similar patterns of increased denials. 26
The evidentiary record thus establishes five key facts. First, insurance AI tools are being deployed at scale in MA prior authorization, affecting millions of beneficiaries. Second, these tools are trained on on historical datasets that may not be representative of the patients to whom they are applied. These datasets may further reflect historical patterns of care that may themselves embed bias or undertreatment. Third, the use of these tools correlates with significant increases in claim denials. Fourth, a substantial proportion of these denials are reversed on appeal, suggesting high error rates.Reference Levinson 27 Fifth and finally, the proprietary nature of these algorithms as well as a lack of external validation and transparency makes it difficult for physicians to challenge denials or for patients to understand why they were denied coverage. Therefore, insurance AI creates a regulatory gap in which tools can be deployed at scale to make or heavily influence life-altering coverage decisions without the premarket review, transparency, ongoing monitoring, or accountability mechanisms applied to either human decision-makers or clinical technologies. The question is not whether this gap should be filled, but how existing regulatory authorities can be coordinated to fill it effectively.
3. A Fragmented Regulatory Landscape
Multiple federal and state agencies possess authority over aspects of health insurance and healthcare delivery; however, no single entity has comprehensive jurisdiction over insurance AI. This fragmentation creates enforcement gaps and leaves critical oversight functions unaddressed. In this section, I map existing authorities and identify where they fall short. Table 1 summarizes the six key regulatory actors (i.e., Food and Drug Administration [FDA], Office for Civil Rights [OCR], Centers for Medicare & Medicaid Services [CMS], Office of the National Coordinator for Health Information Technology [ONC], state insurance commissioners, and the Federal Trade Commission [FTC]) and their relevant existing authority over health insurance and healthcare delivery. Each agency holds relevant, but partial, jurisdiction: FDA governs clinical medical devices, OCR enforces antidiscrimination standards, CMS oversees MA plan operations, ONC regulates health IT developers, and states regulate commercial insurance practices. No single agency possesses comprehensive authority over insurance AI as such, and their jurisdictions do not naturally overlap so as to cover the entire product lifecycle.
Summary of existing oversight by relevant authority
Table 1. Long description
From the top row downward, the first column lists agencies: Food and Drug Administration, Department of Health and Human Services Office for Civil Rights and Section 15 57 of the Affordable Care Act, Centers for Medicare and Medicaid Services, Office of the National Coordinator for Health Information Technology, State Insurance Commissioners, and Federal Trade Commission. The second column provides oversight details. Food and Drug Administration regulates medical devices under the Food, Drugs, and Cosmetics Act, including software intended for diagnosis or treatment, and clinical decision support software when relied upon for clinical decisions. Department of Health and Human Services Office for Civil Rights enforces Section 15 57 of the Affordable Care Act, prohibiting discrimination in federally funded health programs and addressing patient care decision support tools, including AI. Centers for Medicare and Medicaid Services oversees Medicare Advantage plans, allows AI to assist but not solely determine medical necessity, and plans increased audits. Office of the National Coordinator for Health Information Technology sets requirements for AI and machine learning in health care decision-making, with compliance required by December 31, 2 02 4. State Insurance Commissioners regulate insurance at the state level; as of March 2 02 5, 24 states have adopted the National Association of Insurance Commissioners Model Bulletin on A I, requiring governance, risk management, consumer notice, and vendor management. Federal Trade Commission enforces consumer protection against unfair or deceptive practices and is increasingly focused on AI governance and algorithmic fairness.
Evidently, the existing regulatory landscape is fragmented and presents a challenge in overseeing the lifecycle of insurance AI tools like nH Predict. At development, no agency reviews algorithm design, validates training data representativeness, or assesses prediction accuracy before deployment. At deployment, no premarket approval process exists; insurers can deploy in-house tools affecting millions of beneficiaries without external validation. During implementation, OCR can investigate discrimination complaints after harm occurs, CMS can review denial patterns through audits, and state regulators can investigate consumer complaints. At the state level, the National Association of Insurance Commissioners (NAIC) — a standard-setting organization composed of the chief insurance regulators from all 50 states, the District of Columbia, and US territories — develops model laws and regulations that states may voluntarily adopt. While NAIC does not possess any binding legal authority, its Model Bulletins provide actionable guidance. For example, 24 states have already adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, though adoption remains uneven and the Bulletin itself does not yet address the specific challenges posed by insurance AI in prior authorization. 35
Moreover, and despite these actions, no agency conducts ongoing monitoring to identify problems proactively. And, when assessing outcomes (e.g., when appeals result in high error rates), litigation and investigative journalism — not systematic regulatory oversight — lead the charge. The problem, therefore, is not lack of statutory authority in the aggregate, but lack of coordination and clear assignment of responsibility. The result is that insurance AI occupies a regulatory blind spot in which tools can be deployed at scale without the premarket review applied to clinical AI, the transparency required of health IT developers, or the ongoing monitoring necessary to protect patient safety.
From this fragmented landscape, three federal agencies emerge as the primary candidates for a coordinated insurance AI framework: CMS, OCR, and ONC. Each possesses existing statutory authority directly applicable to insurance AI without new legislative action; recently demonstrated activity in the adjacent regulatory space, signalling institutional readiness; potential for complementary integration (i.e., with each covering a distinct stage of the insurance AI lifecycle); and alignment of regulatory expertise with the proposed oversight function. In contrast, other agencies do not offer a natural fit for coordination. For example, the FDA, while possessing premarket review expertise, lacks jurisdiction over insurance practices and has explicitly excluded administrative software from its device framework under the 21st Century Cures Act. The FTC, while possessing general consumer protection authority, has no enforcement tools specific to health programming, nor any MA contract authority. Thus, CMS, ONC, and OCR offer unique potential for institutional harmonization that avoids redundancy while addressing existing failures. The following section proposes how these existing authorities can indeed be harmonized to bridge these gaps.
4. A Coordinated Framework for Insurance AI Oversight
Effective oversight of insurance AI requires coordinated action across multiple agencies, each exercising authority within its own domain while collaborating to address gaps. In this section, I present a framework that harmonizes existing oversight without requiring legislative overhaul.
4.1. Core Principles
A coordinated regulatory framework for insurance AI oversight should satisfy four requirements, drawn from a close federal precedent for oversight of high-stakes automated decision systems: the model risk management framework established by federal banking regulators in 2011, originally issued as SR 11-7 (and OCC 2011-12) 36 and revised in April 2026 as SR 26-2 (and OCC 2026-13). 37 Like banking models, insurance AI tools produce automated outputs that directly affect individuals, their failure modes are typically opaque to those affected, and they operate within an industry where federal agencies possess existing supervisory authority. Although SR 11-7 predates the deployment of contemporary machine learning in banking, federal regulators have explicitly applied its principles to AI and machine learning systems, treating the definition of “model” as encompassing modern algorithmic tools. 38 Critically, SR 11-7 was issued under existing supervisory authorities rather than through new legislation, relying on validation and ongoing oversight rather than premarket approval. In the proposed framework, I adapt this architecture to insurance AI. Each of the four requirements below also corresponds to a regulatory gap identified in Section 3.
First, insurance AI tools must undergo premarket review. Premarket review refers to the external validation of a tool prior to deployment at scale. This process includes assessments of training data representativeness (i.e., the extent to which the historical data used to develop the algorithm accurately reflects the population to which it will be applied), prediction accuracy (i.e., sensitivity and specificity), and potential for discriminatory impact. Second, the principle of transparency requires that insurers disclose when algorithmic tools inform coverage decisions, what factors the tools consider, and how predictions were used to reach determination. Third, individualized decision-making mandates algorithms to inform decisions without overriding individualized assessments by a human decision-maker, based on patient-specific clinical circumstances, physician recommendations, and medical records. Fourth and finally, ongoing monitoring requires that post-deployment surveillance identify emerging problems, track appeal rates and outcomes, and trigger corrective action when error rates exceed predetermined and data-informed thresholds.
4.2. CMS as Primary Regulatory Authority: Medicare Advantage Oversight
CMS’s existing oversight of the MA program and its authority to enforce coverage rules lends itself to an expansion of authority over insurance AI used in the MA prior authorization pathway. Thus, CMS serves as the lead regulatory authority in this framework.
I. Premarket Review Requirements
CMS should establish a premarket notification process for insurance AI tools that MA plans intend to use in prior authorization or necessary coverage determinations. This process would not require a full premarket approval process, which would be administratively onerous on the agency, or risk toeing the line of what counts as a medical device under FDA guidance. Instead, CMS may advance structured transparency and validation requirements for notification and review of insurance AI tools.
CMS’s authority to impose any such requirements arises from its broader contracting power under 42 U.S.C. § 1395w-27, which mandates that MA contracts “contain such other terms and conditions…as the Secretary may find necessary and appropriate,” explicitly including requirements that organizations provide the Secretary with information. 39 CMS already invokes this authority to require MA plans to submit formularies, provider networks, and benefit designs for review; extending it to insurance AI tools is an incremental expansion of existing contracting authority rather than a novel regulatory power. Furthermore, a formal premarket notification requirement would necessitate notice-and-comment rulemaking under 42 U.S.C. § 1395hh(a)(2), given that it would establish a substantive legal standard governing the scope of benefits. 40 However, it would not require new Congressional authorization.
To illustrate what such a process might look like in practice, Table 2 provides a mock timeline for CMS premarket review. The process proceeds in four steps: the insurer develops or acquires the tool (Day 0), notifies CMS at least 180 days before intended deployment with detailed validation documentation (Day 1), receives CMS review and any conditions on deployment within 180 days (Days 1–180), and finally, deploys the tools subject to those conditions (Day 181). The 180-day notification window is modelled on the FDA’s existing 510(k) premarket notification process and exceeds CMS’s current notification periods for formulatory and network changes, reflecting the greater complexity of algorithmic validation.
Mock timeline for CMS premarket review.
Note: Gray boxes indicate action on the part of the insurer, white boxes indicate action on the part of CMS, and approval takes up to 180 days from initial notification
Table 2. Long description
From left to right, the timeline consists of four sequential boxes. Step 1, labeled Development, is a gray box indicating the tool is developed or acquired by the MA insurer. Step 2, Notification requirement, is a gray box at Day 1, where the MA insurer notifies CMS at least 180 days before deploying any tool for prior authorization or medical necessity. Required notification details include intended use, training data characteristics, validation results, analysis of discriminatory impact, use in coverage decisions, and monitoring plans. Step 3, Review and response, is a white box spanning Day 1 to Day 180, where CMS reviews the notification and may impose conditions such as further validation, scope limitations, enhanced appeals monitoring, mandatory human review, and periodic reporting. Step 4, Deployment, is a gray box at Day 181, indicating the tool is approved for deployment by the MA insurer, subject to CMS conditions. The timeline visually distinguishes insurer actions in gray and CMS actions in white, with the entire process taking up to 180 days from initial notification.
* The 180-day premarket notification period is modelled on the 21 C.F.R. §807.81; FDA, Premarket Notification 510(k) process, which requires manufacturers to notify FDA at least 90 days before marketing a device, with FDA’s review goal of 90 days and up to 180 additional days for information requests. The 180-day window also exceeds CMS’s existing notification periods for formulary changes (30 days) and transition requirements (90 days), reflecting the greater complexity of algorithmic validation.
This approach mirrors CMS’s authority over other MA oversight requirements. CMS already requires MA plans to submit and receive approval for several aspects of plan operation, including formularies, provider networks, and benefit designs.
II. Mandatory Individualization Standards
CMS should codify in regulation what the February 2024 guidance articulated: MA plans must base coverage determinations on individualized patient assessment, not population-level algorithmic predictions. 41 CMS possesses sufficient regulatory authority to codify this standard through notice-and-comment rulemaking under 42 U.S.C. § 1395hh(a)(1), which grants the Secretary power to “prescribe such regulations as may be necessary to carry out the administration” of the Medicare program, and again under 42 U.S.C. § 1395hh(a)(2), which governs rules establishing substantial legal standards for the scope of benefits. 42 The February 2024 CMS-4201-F guidance’s individualization principle signals that CMS already considers this action as within its regulatory domain; the present proposal would shift interpretive guidance into binding regulation through the standard notice-and-comment process under 42 U.S.C. § 1395hh(e)(1), which requires a minimum of 60 days for public comment. 43
Thus, the substantive content of this standard should codify what the February 2024 guidance defined in principle. In particular, while algorithms may predict population-average outcomes, they must not override the treating physician’s assessment of individual patient needs. Coverage decisions must reference patient-specific clinical information (including medical records, physician notes, functional assessments, and response to treatment), and when algorithmic predictions conflict with physician recommendations, the plan must document why the physician’s assessment is incorrect based on individual patient factors, not merely that the prediction differs.
Additionally, CMS should establish clear guidelines for when denial or appeal overturn rates trigger mandatory audits. Drawing on KFF data showing that MA prior authorization denial rates average 6–7.7% across all service categories, CMS should conduct focused review when an MA plan’s denial rate for a specific category of care exceeds 150% of the MA industry average for that category. 44 This threshold would have flagged both CVS Health’s 13% denial rate and UnitedHealth’s post-acute care denial rate, which more than doubled from 10.9% in 2020 to 22.7% in 2022 following NaviHealth deployment. Furthermore, when appeal overturn rates exceed 75% (i.e., the threshold identified in the OIG’s 2018 report as indicative of systemic first-pass denial errors),Reference Levinson 45 CMS should conduct focused review of the plan’s algorithmic tools and decision-making processes. Both thresholds should be calculated at the service-category level rather than in aggregate, given that plan-wide averages can mask problematic patterns in specific areas like post-acute care.
III. Transparency Requirements
Insurers must provide clear, specific explanations for denials that involve algorithmic predictions. Generic language like “not medically necessary” is insufficient. Denials must specify what algorithmic tool, if any, informed the determination; what specific factors the tool identified as relevant; how the tool’s output influenced the coverage decision; and what patient-specific information was considered beyond algorithmic output. Transparency enables meaningful appeals, facilitates CMS oversight, and creates accountability for decision-making.
IV. Post-Market Surveillance
CMS should require MA insurers using insurance AI tools to submit quarterly reports. CMS’s authority to mandate reporting again arises directly from 42 U.S.C. § 1395w-27, which grants the Secretary broad discretion to include additional informational requirements. 46 Additionally, CMS already exercises the authority to mandate extensive data reporting from MA plans under 42 CFR Part 422. 47
Reports should include: total prior authorization requests and denial rates, broken down by type of care; appeal rates and outcomes for algorithmically-informed denials; comparisons of denial rates for similar services in Medicare; any recalibration or modification of algorithmic tools; and formal complaints received regarding algorithmic decision-making outcomes. When post-market surveillance identifies concerning patterns, such as disproportionately high denial rates, high appeal overturn rates, or disparities across demographic groups, CMS can prompt corrective action, ranging from algorithm modification to suspension of the tool’s use. These corrective actions would operate within CMS’s existing intermediate sanctions framework under 42 C.F.R. Part 422, Subpart O. At the first tier, CMS issues a Notice of Noncompliance requiring a written corrective action plan within 60 days. At the second tier, where a plan fails to submit a compliant plan, fails to remediate identified concerns within two consecutive reporting quarters, or deploys an algorithmic tool without required premarket notification, CMS may impose civil monetary penalties under 42 U.S.C. § 1395w-27(g) and require suspension of the implicated tool pending independent revalidation. At the third tier, where violations are willful or persistent, CMS may pursue contract termination under 42 U.S.C. § 1395w-27(c)(2) and 42 C.F.R. § 422.510. This tiered structure mirrors the enforcement architecture CMS already applies to MA contract compliance generally and requires no new statutory authority.
4.3. OCR as Secondary Enforcement: Discrimination Prevention and Detection
Section 1557 of the ACA grants the OCR authority that complements existing CMS oversight by addressing discriminatory impact that may not violate coverage rules but nonetheless harms protected classes. OCR’s enforcement toolkit includes compliance reviews, voluntary resolution agreements, referral of pattern-or-practice cases to the Department of Justice, and the authority under 42 U.S.C. § 2000d-1 to suspend or terminate federal financial assistance to covered entities found in violation of Section 1557. This latter authority is especially relevant, given that MA insurers are recipients of federal funding through CMS contracts. Within its own jurisdiction, OCR oversight can be expanded to encompass insurance AI in two ways. First, OCR should issue guidance requiring covered entities using insurance AI tools to conduct regular bias testing, and develop technical resources to help covered entities conduct appropriate bias testing, recognizing that many insurers lack in-house expertise in algorithmic fairness assessment. Such guidance may direct covered entities to analyze denial rates and appeal outcomes across protected characteristics, test algorithmic predictions for differential accuracy across demographic groups evaluate whether training data adequately represents protected populations, and document steps taken to mitigate identified disparities.
Second, OCR should treat complaints about AI-driven denials as potential indicators of systemic discrimination requiring investigation beyond individual cases. When patterns begin to arise in complaints — for example, multiple beneficiaries with similar characteristics denied coverage by the same insurer — OCR should investigate whether the tool propagates or embeds discriminatory treatment.
Information-sharing between OCR and CMS holds structural precedent within the Medicare regulatory apparatus. CMS requires OCR civil rights clearance as a condition of Medicare Part A provider certification, establishing a formal channel through which civil rights enforcement and coverage administration intersect. 48 Specifically, the May 2024 Section 1557 final rule was jointly issued by OCR and CMS, explicitly extending nondiscrimination requirements to “patient care decision support tools” under 45 C.F.R. § 92.210, and simultaneously amending both OCR and CMS regulations in a single rulemaking. 49 This precedent demonstrates not only that OCR-CMS joint action is legally feasible, but that it has already been exercised in the precise regulatory context this framework addresses. Importantly, the AI-specific provisions of the 2024 rule — unlike the sex discrimination provisions, which are subject to ongoing injunctions — took effect May 1, 2025 and remain operative. 50 Nevertheless, the rule’s enforcement trajectory under the current administration remains uncertain, emphasizing the importance of codifying these protections in binding regulation rather than relying on OCR enforcement alone. Thus, the coordination proposed here — with CMS establishing coverage standards and OCR addressing discriminatory impact — extends and formalizes a model of joint oversight that the two agencies have already, to some extent, adopted, and which existing law already supports.
4.4. ONC as Tertiary Enforcement: Developer Protocols
ONC should extend HTI-1 final rule requirements to explicitly cover insurance AI, closing the loophole for in-house developed algorithms. ONC can address this gap by expanding the scope of HTI-1 final rule to explicitly include insurance AI under “patient care decision support tools,” and enforcing additional disclosures for insurance AI developers.
First, by explicitly clarifying that “patient care decision support tools” subject to HTI-1 transparency requirements include algorithms used by insurers to inform coverage determinations and prior authorization decisions, ONC can extend oversight to insurance AI tools that intersect with health IT. 51 This classification is justified because these tools may directly affect patient care by determining cost of access. As such, ONC (in collaboration with CMS and OCR) can enforce regulation based on what tools do (i.e., informs coverage decisions), not whether they are brought to market.
Second, health IT developers — including insurers developing in-house tools — should make disclosures publicly available in machine-readable format to enable external review and research. Requiring disclosure of in-house tools makes them visible to regulators and external scrutiny, even if not subject to premarket approval. Disclosures should include training data sources, size, and demographic composition; validation methods and results; known limitations and failure modes; instructions for appropriate use (including circumstances where human judgment should override algorithmic output); and update history and version control. Nonetheless, ONC’s direct enforcement authority operates primarily through certification consequences for health IT developers and information-blocking penalties referred to HHS OIG. This comparatively narrow scope justifies ONC’s role as a tertiary, rather than primary, enforcement authority in this framework.
4.5. State Insurance Commissioners for Commercial Insurance Oversight
Federal agencies maintain authority over federally regulated programs, like Medicare Advantage, while state insurance commissioners oversee commercial insurance and certain aspects of MA insurers’ business practices. Although MA plans are delivered by private insurers subject to state insurance regulation, federal Medicare law and CMS regulations govern MA coverage decisions and benefits, limiting state authority in these areas. 52 Nevertheless, interstate authority is fragmented and should adopt consistent standards. For example, states should establish information-sharing mechanisms to identify insurers with concerning patterns across multiple jurisdictions (this information should, in turn, be centralized through ONC). Furthermore, consistent state-level standards can be advanced through the NAIC, which should revise its Model Bulletin to incorporate lessons from the federal oversight of MA. Specifically, the Model Bulletin should require premarket notification to state regulators before deploying insurance AI in prior authorization, validation requirements similar to those CMS imposes, transparency in denials and appeals processes, regular reporting on denial and appeal rates, and bias testing and disparate impact analysis.
Below, Table 3 summarizes the coordinated framework as a whole, mapping each agency to its role and primary mechanism of action. CMS serves as the primary regulatory authority, responsible for premarket review, individualization standards, transparency requirements, and post-market surveillance. OCR functions as secondary enforcement, addressing discriminatory impact through proactive bias testing and complaint investigation. ONC provides tertiary oversight of developer protocols through expanded HTI-1 disclosure requirements. State insurance commissioners, coordinated through the NAIC, extend consistent standards to commercial insurance outside the federal Medicare program.
Summary of proposed coordinated framework for insurance AI oversight
Table 3: Long description
The table has three columns: Agency, Role in Coordinated Framework, and Mechanism of Action. From top to bottom: First row, CMS is listed as primary regulatory authority with mechanisms including premarket review, individualization standards, transparency requirements, and post-market surveillance. Second row, OCR is secondary enforcement authority, responsible for proactive bias testing, complaint investigation, and identifying discriminatory patterns. Third row, ONC is tertiary enforcement authority, overseeing developer protocols by expanding the HTI dash 1 final rule to include insurance AI and enforcing additional disclosures. Fourth row, State Insurance Commissioners plus NAIC are responsible for commercial insurance oversight, establishing interstate information-sharing and revising the NAIC Model Bulletin to incorporate federal oversight lessons from M A.
This framework harmonizes existing authorities, assigns clear responsibilities, establishes accountability, and creates mechanisms for continuous improvement. It respects agency expertise — CMS on coverage policy, OCR on discrimination, ONC on health IT, states on insurance regulation — while ensuring coordination. Most importantly, it shifts the regulatory paradigm from reactive enforcement after harm to proactive oversight that prevents deployment of flawed tools.
5. Addressing Objections
Several objections may arise from this proposed framework. In this section, I briefly address the strongest concerns.
5.1. Stifling Innovation and Producing Competitive Harm
Critics may assert that premarket notification requirements and validation standards will stifle innovation in healthcare AI, delay beneficial technologies, and impose excessive compliance costs on insurers. This objection fails on three grounds.
First, innovation is not inherently valuable. Technologies that systematically deny appropriate care, embed discriminatory biases, or lack adequate validation cause harm regardless of their novelty. History offers cautionary examples: thalidomide was innovative, as were prefrontal lobotomies. The relevant question is not whether insurance AI is a form of technological advancement, but whether unvalidated algorithms should determine access to medically necessary care for millions of vulnerable patients.
Second, the proposed framework does not prohibit insurance AI development or deployment — it requires transparency and validation. Insurers already conduct internal testing of their tools; this framework merely requires documentation and external review. If an algorithm cannot demonstrate reasonable accuracy and freedom from discriminatory bias, it should not be deployed at scale to make coverage decisions. Appropriate oversight is a floor, not a ceiling.
Third, the efficiency argument falls short when “efficiency” comes from denying appropriate care. The Senate investigation documented that UnitedHealth’s algorithmic denials generated substantial cost savings for the insurer while forcing elderly patients to deplete life savings or forgo rehabilitation. When CVS projected that its AI tool would “save $77 million by reducing post-acute care spending,” those “savings” arose from care being denied to beneficiaries who had paid premiums precisely to access such care.Reference Blumenthal 53 A system that efficiently denies appropriate care is not a success.
5.2. Insufficient Administrative Capacity
A second objection may question whether CMS, OCR, and state regulators possess the technical capacity to review complex algorithmic tools. This concern, while legitimate, is manageable; agencies need not develop expertise in house. CMS can contract with academic institutions, consulting firms, and independent experts in machine learning, biostatistics, and health services research. The FDA employs similar approaches for specialized device reviews. 54 Moreover, the quantity of major insurance AI tools is still limited, making comprehensive review financially feasible with targeted resource allocation.
Furthermore, the framework emphasizes outcome-based accountability alongside technical review. When denial rates spike following algorithm deployment, when appeal overturn rates reach 90% (e.g., well above the 75% threshold that would trigger formal review), or when denials disproportionately affect protected classes, these patterns signal broader concerns, independent of algorithmic complexity. Agencies need not fully audit each line of code to identify tools causing systematic harm.
Ultimately, resource constraints cannot justify regulatory abdication. If agencies lack capacity for adequate oversight, the solution is appropriating necessary resources, not leaving millions of beneficiaries unprotected. The costs of oversight pale in comparison to the costs of inaction. This is true in both human terms (i.e., patients being denied necessary care) and in financial terms (i.e., appeals processing, litigation, and corrective action after harm occurs).
5.3. Inappropriate State Versus Federal Authority
A third objection may argue that extending federal oversight intrudes on traditional state authority over insurance regulation. This objection misconceives the proposal. I do not advocate federal preemption of all insurance regulation. States retain authority over commercial insurance and can establish standards exceeding federal minimums. My framework addresses federally regulated programs (i.e., Medicare Advantage, Medicare Part D) where federal oversight is unquestionably appropriate. CMS already regulates numerous aspects of MA operations; extending oversight to algorithmic tools used in coverage decisions is, at best, an incremental expansion, not a shift towards federalism.
Moreover, federal minimum standards need not conflict with state innovation. The NAIC Model Bulletin provides a template for state action, and states can coordinate through information-sharing mechanisms while maintaining flexibility for local implementation. The alternative is fragmented oversight where insurers can deploy inadequately validated tools affecting millions.
5.4. Fix Appeals Instead
A fourth objection may suggest that, rather than regulating algorithms, we should strengthen the appeals process, making it easier for patients to challenge inappropriate denials. This approach, while superficially appealing, fails as a primary solution.
First, while Medicare does provide expedited appeal pathways for urgent cases, these pathways are the exception rather than the rule, and are not available to many patients facing algorithmic denials. For most beneficiaries, appeals are inherently reactive: by the time a denial is appealed and resolved through standard multilevel review, the patient may have already been harmed, either through delayed or foregone treatment, or through out-of-pocket expenditures incurred while awaiting a decision. For elderly, seriously ill patients, delays of weeks or months while navigating multi-level appeals can mean the difference between recovery and permanent disability. Gene Lokken, the 91-year-old stroke patient in litigation with UnitedHealth who was forced to spend $150,000 out-of-pocket while appealing denials did not need a better appeals process — he needed coverage decisions based on his actual medical needs rather than algorithmic predictions. 55
Moreover, appeals systems suffer from selection bias. Few patients (<10% in MA plans) appeal, creating the illusion that most denials are appropriate when in fact most patients simply cannot navigate the appeals process. 56 When appeals do occur and succeed at rates exceeding 80%, this demonstrates not that the system works, but that initial denials were unjustified.Reference Levinson 57 While appeals serve a necessary role as a safety mechanism, they cannot serve as a substitute for ensuring that coverage decisions are appropriate in the first place. Proactive oversight preventing deployment of flawed algorithms is more effective, less burdensome, and more equitable than reactive correction through appeals that only the most resourceful patients can successfully navigate.
5.5. What About Antidiscrimination Law?
One final objection may identify issues of insurance AI oversight as better suited to handling by antidiscrimination law. 58 Antidiscrimination law traditionally includes robust private enforcement alongside agency action. Extending this model to insurance AI would certainly strengthen accountability. Congress should indeed consider creating an explicit private right of action for beneficiaries harmed by inappropriate algorithmic denials. Currently, patients must navigate the Medicare appeals process or bring state-law claims that may be preempted by federal law. A federal cause of action would provide several benefits, including: deterring insurers by creating liability incentives to validate and deploy tools properly; compelling disclosure of proprietary algorithmic details through discovery, enabling external evaluation; allowing patients who incur costs due to inappropriate denials to recover damages; and enabling class actions to aggregate individual harms, making systemic problems visible and forcing structural reforms. However, a private right of action is not prerequisite to implementing the regulatory framework described above; agencies can act immediately using existing authorities. Congressional action would enhance, not enable, oversight.
6. Conclusion
The outlined objections, while relevant, do not undermine the case for coordinated regulatory oversight. The framework I propose is a measured response to documented harms. It balances competing interests, respects existing legal structures, and can be implemented using available authorities. The question is not whether oversight imposes costs or requires resources, but whether we will permit algorithmic tools to continue operating without accountability in a domain directly affecting access to medically necessary care.
The regulatory architecture necessary to oversee insurance AI already exists. CMS possesses the authority to establish premarket notification requirements for tools used in the prior authorization pathway. OCR can enforce antidiscrimination standards for “patient care decision support technologies,” which can and should include insurance AI tools. ONC can extend transparency requirements to in-house developed algorithms. State insurance commissioners can adopt uniform standards through the NAIC framework. What remains absent is not statutory authority, technical capacity, or regulatory precedent; rather, it is coordinated action and political will. The UnitedHealth investigation has laid bare the consequences of regulatory fragmentation: elderly patients forced to exhaust life savings for medically necessary rehabilitation, denial rates doubling as algorithms replace physician judgment, and insurers reaping billions in “savings” from beneficiary care. The question before policymakers is not whether algorithmic tools warrant oversight, but whether we will continue permitting their deployment without accountability while vulnerable patients bear the costs of inaction. The framework I propose harmonizes existing authorities, assigns clear responsibilities, and can be implemented immediately using the regulatory building blocks already at our disposal.
Acknowledgements
The author gratefully acknowledges Dr. Jessica Morley and Dr. Luciano Floridi for their contributions to early discussions that informed the development of this work, as well as their significant contribution to the first concept of this manuscript.
Contributorship statement
Ms. Renée A. Sirbu conceived, drafted, and revised this manuscript in its entirety, incorporating feedback from peer review. The author takes full responsibility for the final content and any errors or omissions.
Funding declaration
This research received no specific grant from any funding agency in the public, commercial or not-for-profit sectors.
Conflicts of interests
The author has no competing interests to declare.
Open access
