Do Medicaid managed care rules cover automated denials?
Medicaid managed care already has a rule: a denial must be made by an individual with appropriate expertise. It does not mention automation. Regular Medicaid has no equivalent rule on who decides. Federal advisers asked for guidance on one and a rule change on the other.
I assumed the private half of Medicaid was the unprotected half. It is the other way around.
The half run by private plans has a federal rule about who must sign a denial. The half run directly by the state has no equivalent rule on who decides.
Neither of them mentions software. That is not an oversight anyone is hiding. Both were written before the question came up.
The gap I expected to find was where the companies are. It is where the state is.
Two names appear throughout, so here they are once. Artificial intelligence (AI) means software trained to find patterns rather than software following a fixed list of steps. The Medicaid and Children’s Health Insurance Program (CHIP) Payment and Access Commission (MACPAC) advises Congress and cannot change any rule itself.
Contents
What does managed care change about who decides?#
Your state has two ways of running Medicaid.
It can pay each bill itself as it comes in. That is the fee for service half. I call it regular Medicaid.
Or it can pay a private company a set amount for each member, on a regular schedule, and let that company run the coverage. That is managed care, and many states now run their programme this way.
The difference lands in one place that matters. Under managed care, the organisation deciding what you get is the organisation keeping what it does not spend.
That is not an accusation. It is the design.
It works like paying a builder a fixed price for a job. Whatever is not spent on materials stays with the builder. Nobody thinks that arrangement is criminal. Everybody understands it changes the incentives in the room.
That is why the federal rules attach conditions to those companies. A state paying its own bills does not carry the same conditions.
One of those conditions is about who signs a refusal. It is the difference between a letter from the state office and a letter from a company paid to keep the money it does not spend.
What a plan changes about the decision, in more detail, is in what managed care changes.
That is the shape of it. Now the rules.
They are shorter than you think.
Do federal Medicaid rules address AI in denials?#
No, and the federal advisers who studied this said so in writing.
Their finding is that existing Medicaid statutes and regulation do not explicitly contemplate or address the use of automation tools in Medicaid prior authorization. Artificial intelligence (AI) is not named. Automation is not named.
What the rules do say is who must act. A decision to deny a service, or to authorise less than was requested, must be made by an individual who has appropriate expertise in the enrollee’s medical, behavioural health, or long term services and supports needs.
An individual. Not a physician. Not a licensed clinician.
That wording is doing a lot of quiet work. Think of it as a rule saying a person must sign the cheque, written back when a cheque was the only way to pay. It still binds. It just never anticipated the question you are asking.
Picture the desk where that happens. A screen with a queue on it, a phone that rings, and a person with minutes rather than hours for each file.
Now the part that cuts the other way, and it belongs high up rather than buried. When those advisers interviewed states and managed care plans, all of them reported using automation tools, most often rules based algorithms that use clinical criteria to determine medical necessity.
So the honest picture has three pieces at once. Automation is already everywhere. The rule still puts a person at the moment of refusal. And the advisers warned that risks may persist under human in the loop policies if reviewers do not conduct thorough reviews, or if requests are presented in a way that biases them toward agreeing.
A human in the loop is only a safeguard if the human is actually reading. That is the whole argument, and it is not resolved by anyone’s press release.
The federal text itself, read line by line, is in federal rules on automated denials.
Read it if you want the words rather than a summary of them.
What has MACPAC recommended, and is it binding?#
The commission advises Congress. It cannot change a rule.
In its June 2026 report to Congress it made four recommendations about automation in Medicaid prior authorization. Two of them matter most here.
The first asks the agency to issue guidance saying the existing expertise requirement already covers denials proposed by automated systems. It asks that guidance to state plainly that adverse determinations may not be made by automation tools alone.
Notice what that is. It is not a request for a new rule. It is a request to say out loud what the current words already mean.
The second is different in kind. It asks that the regulation for the fee for service half be amended, so that the same expertise requirement applies there too. That half has nothing today.
The other two recommendations are about visibility. One asks the agency to show states how existing oversight processes can be used to watch how plans use automation. The other asks states to change their contracts so plans have to disclose it.
All four are recommendations. None is law.
A recommendation is a letter to the people who could change the rule. It sits in a report until somebody acts on it, and nothing about being written down makes that more likely.
What a recommendation does give you is a name for the gap. A gap that a federal commission has described in writing is easier to raise with a plan than a feeling that something is wrong.
The commission’s own chapter records the date: it voted on all four on May 7, 2026.
Which states have acted on their own?#
Some have, and the count needs handling with care.
The same federal review found that six of the seven states it examined had passed laws requiring that a human review all adverse decisions issued by health plans. Those states are Arizona, California, Illinois, Maryland, Nebraska and Texas.
Read the last three words again. Health plans.
Put a hand over the rest of the page and look at just those two words. A press release will say the state acted. It will not say who the law reaches.
That is not automatically the same thing as Medicaid. A law aimed at commercial insurance may or may not reach a Medicaid managed care organisation, and the answer sits in each state’s own definitions.
Texas is the one state where the chain from the insurance code into Medicaid managed care has been traced end to end, in four steps across three sections. Those four statutory steps are set out in prior authorization by machine.
For the other five, treat the reach into Medicaid as an open question.
It is a good question to ask your own state. It is a bad one to assume. People in those five states may well be protected. Nobody in this article has shown that they are.
What is the difference between a grievance and an appeal?#
This trips people up, and filing the wrong one costs weeks.
An appeal is a review by the plan of an adverse benefit determination. A grievance is an expression of dissatisfaction about any matter other than an adverse benefit determination.
So the question is simply whether a decision was made about your benefit.
It works like the difference between appealing a parking ticket and complaining about the warden. One challenges a decision. The other reports an experience.
An adverse benefit determination covers seven situations. Four of them are the ones to know.
- A service was denied or limited.
- A service you had was cut or ended.
- Payment was refused.
- The plan missed its own deadline.
That last one deserves a second look. A plan that simply does not answer has made an adverse benefit determination by running out of time, and you can appeal it.
Rudeness, a long wait on the phone, a receptionist who lost your paperwork: those are grievances. Real, worth filing, and a different track with a different outcome.
If a decision about care or money is involved, it is an appeal. Say the word appeal in writing, and say it early.
All seven situations, and what to file first, are set out in grievances versus appeals.
Four of the seven are above. The other three still count.
Where do managed care rules actually live?#
One place, and knowing the address turns a vague argument into a specific one.
Everything above sits in part 438 of title 42 of the Code of Federal Regulations (CFR), the book of final federal rules.
Who must sign a denial is at 438.210. The definitions of appeal and grievance are at 438.400. The requirement that your appeal be decided by somebody not previously involved, with clinical expertise where medical necessity is at issue, is at 438.406.
Those clocks matter too. A standard authorisation decision now runs on a seven day limit rather than fourteen. An expedited one runs on seventy two hours.
Write the date you asked. Write the date the clock runs out. Two dates on one page is most of what an appeal needs from you.
Quoting an address does more than quoting an argument. A letter that says “under 42 CFR 438.406, the person deciding my appeal must not have been involved in the original decision” is a different letter from one that says this feels unfair.
A full walk through the part, section by section, is in where managed care rules live.
Keep that one open beside your notice. Both at once.
None of this is interesting until the day it is the only interesting thing in the house. That is how this material works. It sits inert for years, then a family needs it in an afternoon.
The wider map of who decides is at who decides what Medicare pays. If your fight is about hours of help at home rather than a single service, start with algorithms decide home care hours.
The commission’s own report is public, in the June 2026 report.
The rule at the centre of all this is 42 CFR 438.210. It prints its own currency date at the top of the page.