Do federal Medicaid rules address automated denials?
Federal Medicaid managed care rules require that a denial be made by an individual with appropriate expertise. They do not mention automation at all. The rule exists and binds the decision to a person, and the silence is about the software that may have helped reach it.
Go looking for the rule that bans machines from denying care. A phone in one hand, a coffee going cold, a screen full of pages about the rule. The passage itself is not what anyone promises. The rule is real. It is also silent on the one word everybody uses.
Contents
Does any federal rule mention automated denials?#
No federal Medicaid rule on prior authorization uses the word. A regulation binds the denial to a person with appropriate expertise. Nothing in that passage addresses algorithms, software or automation of any kind. The commission that advises Congress puts the same finding in plain words on the page.
Existing Medicaid statutes and regulation do not explicitly contemplate or address the use of automation tools in prior authorization. Those words come from the June 2026 report to Congress. Not a complaint. A description of where the paper stops.
Look at where the hole actually is. Congress passed a statute. An agency issued regulations under it. Guidance would normally sit on top, explaining how the regulation applies to a new thing.
Little sits in the guidance layer. The commission’s finding is that federal guidance on how states and plans may use automation here is limited.
Think of it as a house with a floor missing between the ground and the roof. The building stands. Nobody can climb it.
Who must make the decision to deny?#
An individual with appropriate expertise in the enrollee’s medical, behavioral health or long term supports needs. That phrase is the whole requirement, word for word. No licence is named. No doctor is named. The passage runs one sentence long and carries more silence than I expected.
Read what the words do not do. They never say clinician. They never say physician. They never say the decision has to come from someone who has met you, or seen your file for longer than a minute.
Individual is the operative word, and it is doing real work. A company cannot be an individual. A queue cannot. A model cannot. Somebody has to be the one who decides.
What the word does not settle is how much of the thinking happened before that person arrived. A recommendation can land on a screen fully formed, with a reason already written. A hand moves.
How fast must a coverage decision arrive?#
Faster than it used to. A standard decision must come back within 7 calendar days of the request, down from 14, and that change took effect on 1 January 2026. Where waiting could seriously harm someone, the limit drops to 72 hours. Both clocks are live today.
Halving a deadline is the kind of change that never makes the news and reshapes the work anyway. Seven days is one week of desk time to gather records, read them and answer.
Seven days is one reason automation arrived in this room. A tool that drafts the decision looks like relief when the clock runs that tight.
Federal rules set the clock and the standard. They never say which tools may be used to meet them. Speed and silence sit in the same rulebook.
What did the commission ask for in 2026?#
Guidance, not a new rule. In recommendation 2.1 of its June 2026 report to Congress, the advisory commission asked the agency to state clearly that the existing requirement already covers denials proposed by automated systems. A recommendation carries no force. It is a request in writing.
The commission’s own chapter records the date it voted: May 7, 2026. The request has three parts, and each one closes a specific gap:
- Adverse determinations may not be made by automation tools alone.
- Determinations must rest on individualised medical necessity.
- All existing requirements apply whether or not automation is used.
Read those three and the worry behind them shows on the page. Not one creates a new right. Each says a right already printed in the book still applies, whatever put the recommendation on the screen.
A clarification exists for exactly this. Somebody at a desk read how the rule is being applied and decided the reading had drifted.
Why does regular Medicaid have no such rule?#
History rather than logic. The person requirement sits in the managed care regulations, which govern plans the state pays to run the program. Medicaid paid directly by the state carries no equivalent line on the page, and the same commission asked for one.
Recommendation 2.2 asks that the fee for service regulation be amended to add the same standard. Amended, not clarified. One word is already in the book. The other has to be written into it.
One half of the program has the rule and needs it explained. The other half has nothing and needs it written. It is easy to reverse the two. Worth knowing before you read anything else.
Is a machine deciding your case right now?#
Automation is in the room. Every state and managed care respondent in the commission’s interviews reported using automation tools, most often rules based algorithms that apply clinical criteria. Whether software makes the final call is a separate question, and nobody has measured it.
The honest position takes two sentences. Tools are everywhere in the process. What the tools decide, as against what they prepare for a person to decide, has never been counted.
Plans, vendors and states told the commission they already have human review policies for adverse decisions. Reported is the operative word there. The commission did not audit them.
The same report carries a caution worth more than the reassurance. Risks may persist under human in the loop policies where reviewers do not conduct thorough reviews, or where requests are presented in a way that pushes them toward agreeing with the machine.
A person clicking approve on a screen satisfies the word individual. Whether it satisfies the purpose behind the word is the question nobody has answered with a number.
What does the silence mean for you?#
Less than it sounds. A denial that a machine helped produce is still a denial, and every right attached to one still applies. The rule binds the decision to a person, and the appeal route, the deadlines and the reviewer requirements do not change because software was in the room.
Do not read the silence as permission and do not read it as prohibition. It is neither. The paper simply stops before the question you are asking.
One state has gone further. Texas bars a utilization review agent from using an automated decision system to make an adverse determination, wholly or partly, and that reaches Medicaid managed care plans there. Administrative and fraud work is carved out.
The way a smoke alarm does not care what started the fire, the appeal rules do not care what drafted the denial. What happened to you is the trigger.
That matters most for a family reading a letter at a kitchen table on a Tuesday night. Nobody there has to prove what software was involved in order to push back.
How a decision was made and whether it was right are two questions. Only the second one drives an appeal.
So keep the habit you can actually perform yourself, rather than the one waiting on a rule nobody has written. It is the same problem as governing an unseen agent. In both, the blind spot is the summary over the source.
The wider picture this sits inside is in Medicaid managed care denials.
The regulation sits in the Code of Federal Regulations (CFR) and is free to read at 42 CFR section 438.210, and the commission’s report sits on its own site.