United States (federal) · regulation
CMS: what it requires, and the records to keep
CMS-4201-F requires Medicare Advantage plans to base medical necessity decisions on the individual enrollee's medical history, physician recommendations and clinical notes, follow Traditional Medicare coverage rules, and have a qualified clinician review any adverse decision. CMS's February 2024 FAQ applies this to AI: plans may use algorithms to assist, but not as the sole basis for denying or ending care.
01 / What it requires
What CMS requires
Medicare Advantage organizations and the vendors whose algorithms or AI tools they use for coverage, prior authorization and utilization management decisions.
- 01Base each medical necessity decision on the enrollee's own medical history, physician recommendations and clinical notes (42 CFR 422.101(c)(1)).
- 02Follow Traditional Medicare NCDs and LCDs; use internal criteria only when coverage is not fully established, publicly posted and evidence-based.
- 03Have a physician or appropriate professional with relevant expertise review any expected adverse medical necessity decision before issuing it.
- 04Have a physician-led utilization management committee approve and annually review all UM and prior authorization policies.
- 05Do not use an algorithm's population-level prediction alone to deny admission or end post-acute care.
02 / AI work
Where it touches AI work
CMS's Feb 6, 2024 FAQ says an algorithm or AI tool can assist coverage decisions only if the decision still reflects the individual patient's circumstances, and that predicted length of stay alone cannot justify ending services. Separately, CMS's WISeR model (from Jan 1, 2026) uses AI-assisted prior authorization in Traditional Medicare in six states, with licensed clinicians making non-payment recommendations.
03 / Dates
The dates that matter
CMS-4201-F final rule published (88 FR 22120)
Coverage criteria and UM committee rules apply
CMS FAQ on algorithms and AI in MA coverage decisions
CY2026 final rule declines to finalize proposed AI guardrails
WISeR AI-assisted prior authorization model starts in six states
CY2027 MA final rule adds no AI coverage rules
04 / Enforcement
Who enforces it
CMS through program audits, civil money penalties, intermediate sanctions such as enrollment and marketing suspensions, and contract termination under 42 CFR part 422 subpart O.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01Case files showing individual records reviewed for each adverse decision
- 02Clinician person reviewing it credentials and sign-off on denials
- 03UM committee minutes approving algorithm-supported policies
- 04Published internal coverage criteria with supporting evidence
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
Can a Medicare Advantage plan use AI to deny coverage?+
A Medicare Advantage plan may use an algorithm or AI tool to help make coverage decisions, but the tool cannot be the basis for a denial on its own. Under rules that apply from January 1, 2024, medical necessity decisions must rest on the enrollee's own medical history, physician recommendations and clinical notes, plus Medicare coverage criteria (42 CFR 422.101(c)). CMS's February 6, 2024 FAQ memo says the plan stays responsible for making sure any AI tool follows these rules. A physician or other qualified professional must review any expected medical necessity denial before it is issued. Read the full answer
How do I show my utilization-management algorithm assessed the individual patient?+
Keep a case record showing that each decision turned on the patient's own facts, not only a model score. For each determination, record the medical history, physician recommendations and clinical notes considered; the coverage criteria applied, whether Medicare NCDs and LCDs or publicly posted internal criteria; the tool's limited role; and the name and expertise of the physician or professional who reviewed any denial. Your UM committee must also approve every UM policy, review them at least annually and document its reasons in writing for CMS on request (42 CFR 422.137). Read the full answer
SOURCES
Go back to the source
Federal Register (CMS)
CMS Innovation Center
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: CMS for medicine AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4