CMS Releases Guidance on Coverage Criteria, Utilization Management and Use of AI

USE OF AI IN COVERAGE DETERMINATIONS

Stakeholders have raised questions concerning the role of artificial intelligence (AI), algorithms and similar tools in making coverage determinations. This discussion has attracted more attention as new technologies emerge and expand across the industry. In addition, several health insurers are now facing class action litigation regarding their alleged use of AI models or algorithms in the review and denial of medical claims.

In the preamble to the final rule, CMS stated that Medicare Advantage Organizations (MAOs) must make medical necessity determinations based on the circumstances of specific individuals, as opposed to relying on an algorithm or software that does not consider individual circumstances. In the FAQs, CMS clarifies that an algorithm or software tool can be used to assist MAOs in making coverage determinations, provided that such tools comply with all applicable coverage determination rules. CMS reasons that “an algorithm that determines coverage based on a larger data set instead of the individual patient’s medical history, the physician’s recommendations, or clinical notes would not [emphasis added] be compliant[.]” CMS specifically notes that algorithms and AI cannot be used to solely deny certain care; in particular:

• An algorithm or software tool predicting the length of a patient’s post-acute care stay cannot be the sole grounds for terminating services.
• An algorithm or AI cannot be used to solely deny an inpatient admission or downgrade to an observation stay.

In each case, the patient’s unique circumstances and present condition must be considered.

CMS also cautions that algorithms and software tools used to deny coverage for basic benefits cannot incorporate coverage criteria beyond that allowed by CMS regulations. Finally, CMS expresses concerns that algorithms and AI technologies can “exacerbate discrimination and bias,” suggesting that MAOs must take care to ensure that their use does not violate the nondiscrimination provisions of Section 1557 of the Affordable Care Act.

INTERNAL COVERAGE CRITERIA: PUBLIC ACCESSIBILITY, CURRENT EVIDENCE AND MORE

The final rule provided that when Medicare coverage criteria are not fully established, MAOs may develop internal coverage criteria for making determinations; however, that criteria must be based on current evidence in “widely used treatment guidelines” or “clinical literature” and must be made “publicly accessible.” (See 42 CFR 422.101(b)(6).) The FAQs elaborate on these requirements for internal coverage criteria, as follows:

• Publicly accessible. Per the FAQs, “publicly accessible” means that:
  • The criteria must be accessible via a website (including the MAO’s website or a delegated vendor’s website) and not behind a paywall or subscription.
  • The criteria must be accessible to all members of the public and not limited to enrollees and contracted providers.
  • The MAO can require an individual to provide one or two pieces of basic information to access the criteria.
  • Providing multiple links to vendor’s websites may present such a large burden as to render the criteria not publicly accessible.

• Clinical benefits outweighing clinical harms. The final rule states that when additional criteria are needed to interpret general provisions, MAOs must demonstrate how the additional criteria provide clinical benefits that are highly likely to outweigh any clinical harms. In the FAQs, CMS adds that it expects MAOs to publicly and systematically explain the clinical benefits of the criteria compared to the harms patients may experience. An explanation that merely assumes that coverage criteria generally offer clinical benefits is insufficient. “[A]ll internal coverage criteria should clearly and explicitly support patient safety before the criteria are used[.]” CMS will monitor the rationales that are made public.

• Local coverage determinations. The FAQs explain that if the Local Coverage Determination (LCD) is not from the applicable service area, reliance on the LCD is considered use of internal coverage criteria. The MAO may use such criteria but must ensure that is it still based on current evidence in widely used treatment guidelines or clinical literature.

OTHER ISSUES

Beyond internal coverage criteria, CMS’s FAQs provide guidance on other topics related to the final rule, including:

• Post-service reviews: CMS reiterates its position that post-service reviews that result in a denial of coverage, in whole or in part, are organization determinations – not “payment” reviews. This means that such reviews must be consistent with the reopening rules and CMS regulations prohibiting MAOs from denying coverage for services already subject to a prior authorization on the basis of lack of medical necessity. Notably, CMS concludes the discussion by focusing on adverse decisions “about whether the services are or were medically necessary,” thus suggesting a potential distinction between post-service reviews that result in organization determinations and those that can be classified as payment reviews.

• Prior authorization and skilled nursing facilities (SNFs): CMS clarifies in one FAQ that the new rules requiring that an approval of a prior authorization request for a course of treatment be valid for as long as medically necessary extend to an interrupted stay in an SNF. CMS notes that a new prior authorization approval is not required for admission when the patient returns no more than three consecutive days after being discharged.

CMS ENFORCEMENT IN 2024

CMS announced previously that it would conduct routine and focused program audits in 2024 to assess organizations’ compliance with the new coverage criteria and UM rules. For those who have routine program audits scheduled for 2024, CMS will assess the new requirements during the Part C Organization Determinations, Appeals, and Grievances (ODAG) review and Compliance Program Effectiveness (CPE) review. For those who do not have audits scheduled, CMS will add focused audits specifically targeting the final rule requirements. These focused audits will be limited to ODAG and CPE.

CMS expects to evaluate the UM practices of plans serving nearly 90% of enrollees with MA. CMS may address noncompliance through a variety of compliance and enforcement actions, including issuing notices of noncompliance, warning letters, corrective action plans, and/or imposing civil money penalties and enrollment or marketing sanctions.