Prior Authorization and Utilization Review by Machine · Hanh D. Brown

One state has settled the question everyone else is still arguing about. The answer sits in its insurance code, in one short line.

A utilization review agent may not use an automated decision system to make, wholly or partly, an adverse determination.

That is Texas. Read the phrase “wholly or partly” again. It is doing an enormous amount of work.

Everywhere else the answer runs longer. The federal rules never mention machines at all.

They name a person. Then they go quiet about how that person got there.

Artificial intelligence (AI) is the phrase everyone reaches for here. It means software trained to find patterns rather than software following a fixed list of steps. The rules below were written before that distinction mattered.

What is prior authorization, in plain English?#

Permission in advance. Your doctor orders something. Before it happens, somebody at the plan has to agree to pay.

A no at that point is not a medical opinion about you. It is a decision about money, made by a stranger, using criteria you have never read.

Utilization review is the wider name for that checking. It runs at three moments.

Before the care. During it. And after the bill arrives.

It works like a turnstile at a station. Somebody sits in a booth and decides who goes through. The person in the booth is not your doctor and has never seen your face.

That turnstile is the natural home for software. The work repeats. It runs on documents. The criteria sit written down somewhere.

Sorting and routing at that desk has been automated for years. Nobody objects to that part.

The argument is not about sorting. It is about who may say no.

That is a narrow question. It is also the only one that changes what happens to you.

Can an automated system issue a denial by itself?#

In Texas, no. The rule is at section 4201.156 of the Texas Insurance Code. It took effect on September 1, 2025.

That is a real ban, not a disclosure requirement. Some state laws ask companies to disclose that they use such systems. Texas went further and told them what they may not use it for.

Three things about that section deserve a slow read.

• It bans the use, not just the outcome.
• The words “wholly or partly” close the obvious workaround.
• Administrative support and fraud detection are expressly carved out.

The second is the interesting one. A rule that only banned a fully automated refusal would leave a wide door open, where software decides and a person clicks approve. Adding “partly” shuts that door in advance.

The carve out matters too, and it is honest drafting. Nobody is arguing that software should not sort the post.

The chapter also lets the state insurance commissioner audit and inspect a review agent’s use of an automated decision system at any time. A ban nobody can inspect is a ban on paper.

Which states restrict AI in utilization review?#

More than one, and the count needs care.

Federal advisers reviewing this area found that six of seven states they examined had passed laws requiring that a human review all adverse decisions issued by health plans. The states named are Arizona, California, Illinois, Maryland, Nebraska and Texas.

Read the object of that sentence closely. Put a hand on the page and cover everything after the word “by”.

Those laws bind health plans. That is not the same as binding Medicaid.

The difference is easy to miss. A person reading a state press release could easily walk away believing their mother’s home care is covered by a rule that was never aimed at it.

Texas is the one state where the route into Medicaid has been walked all the way through, and it takes four steps.

The chapter switches itself off for the state Medicaid program. It does that except as provided by section 4201.057.

That section defines a health maintenance organization to include one contracting with the state health commission, or with an agency running part of the Medicaid managed care program.

The chapter then applies to such an organization except as expressly provided. And the short list of sections excluded for Medicaid managed care plans does not include the automated decision ban.

Four steps. Every one of them had to hold for the answer to be yes.

So in Texas the ban reaches a Medicaid managed care organization doing utilization review.

In the other five states the law addresses health plans. Whether it reaches Medicaid is a separate question. I have not traced it, and nothing here implies otherwise.

So be wary of any sentence naming a handful of states together. It flattens a yes, a maybe and an unknown into one line.

That is the kind of line that gets copied for years. Somebody eventually relies on it on the worst day of their week.

How is Medicare Advantage different from Original Medicare here?#

The difference is who is on the other end of the phone.

In Original Medicare the government pays the bill and its contractors process the claims. In Medicare Advantage a private insurer takes a fixed payment per member and runs the coverage decisions itself.

That shapes everything about prior authorization. Original Medicare has used it sparingly.

A private plan managing a fixed budget uses that gate far more often. It writes its own rules for doing so, within federal limits.

Neither arrangement is sinister. They are different machines, and they behave differently at the turnstile.

Medicare Advantage is also where the strongest federal language about the reviewer lives. That rule, and the pilot now testing software inside Original Medicare, are in AI is deciding Medicare coverage.

The practical point is small and useful. Look at your card first.

It tells you which rules the person in the booth is working under. That one glance saves an hour of reading the wrong thing.

Who is the human that has to review a denial?#

Three programs, three different answers, and the differences are larger than anyone would guess.

Under Medicare Advantage, an adverse decision on medical necessity must be reviewed by a physician or other appropriate health care professional. That person must hold a current and unrestricted licence to practise.

Under Medicaid managed care the bar drops. A decision to deny a service, or to approve less than was asked for, must be made by an individual with appropriate expertise in the person’s needs.

No licence. No clinician. No named profession at all.

Picture two people at two desks in two different rooms, each holding the same request. One of them must be licensed. The other must be an expert, and nobody has written down what that means.

At the appeal stage, Medicaid managed care adds something. The person deciding the appeal must not have been involved in the original decision, and must have clinical expertise where the issue is medical necessity.

Notice what that admits. The rule accepts that the first decision might have been made by somebody without clinical training, and it fixes the problem one level up rather than at the start.

For a reader that has a practical edge. If your first refusal came from a Medicaid managed care plan, the appeal is not a repeat of the same conversation. It is the first point where the rules guarantee clinical expertise and a fresh pair of eyes.

A rule that names a person but never names a method is like a sign saying a human must drive, written before anyone imagined cruise control. It still means something. It just does not mean what a reader in this decade assumes it means.

Federal advisers have asked the agency to close that gap. Those recommendations are taken apart in Medicaid managed care denials.

What does the appeal path look like, step by step?#

Five levels. People stop at the first.

For Medicare Advantage the ladder runs like this. The plan reconsiders its own decision. If it still says no, an independent review entity looks at it. After that come hearings before an administrative law judge, review by the Medicare Appeals Council, and finally judicial review.

Each rung is somebody further from the company that said no. That is the design.

It is also the reason a first refusal is worth less than it feels like. The people who stop at level one are not wrong about the odds. They may simply never have been told that levels two through five exist.

The step people miss is the second one. Under Medicare Advantage, a plan that affirms its own denial does not get to close the file. It has to send your case to that outside entity, and it has to do it whether or not you know the rule exists.

Two practical notes before you start.

Deadlines run from the date on the notice. Put that date where you will see it every morning.

An expedited route exists when waiting would harm you. Ask for it by name.

None of this is comfortable reading for a family caregiver who is already tired.

It is still better than the alternative. The alternative is assuming a no from a plan is the end of the matter.

All of this is a lot of trouble over one letter. That is a fair thing to feel.

Go and get the letter anyway. That is the whole trick. Find the letter. Find the date. Ask who signed.

For the wider map, start at who decides what Medicare pays.

The Texas rule reads quickly. It sits in the Texas Insurance Code.

The federal review of automation is set out in automation in Medicaid prior authorization.