AI for Healthcare Payers: Prior Authorization, Claims Review, Appeals and Member Service Under the 2026 Rules

Where AI fits in a health plan’s operations

Health plans run on documents and rules. A single prior authorization request can carry clinical notes, imaging reports and a letter of medical necessity that must be read against a medical policy. Claims arrive with codes that must match payment policy. Appeals bring long clinical histories and require dated, regulated letters. All of this suits language models, provided the plan keeps the clinical judgement with clinicians.

Payers were early adopters. The NAIC’s survey of health insurers, published in May 2025, found 92% of 93 respondents using, planning to use or planning to explore AI or machine learning, the highest share of any line it surveyed.

The healthcare AI use case hub lists related workflows for providers and life sciences as well.

Prior authorization review support

Prior authorization is the most scrutinised use of AI in health insurance and the one with the clearest rules.

What AI does well. Reading a request and its attachments, identifying the service and diagnosis codes, retrieving the applicable medical policy or coverage criteria, and setting out which criteria the records appear to meet, which they do not and which are missing. The output is a review packet: a summary, a criteria checklist with each finding tied to a page of the clinical record, and a list of questions for the provider if information is missing. A nurse reviewer can approve straightforward requests faster, and complex ones arrive organised.

What stays with people. A denial for lack of medical necessity is a clinical decision. Medicare Advantage rules at 42 CFR 422.566(d) require a physician or other appropriate health care professional to review an adverse medical necessity organisation determination before it is issued. The prior authorization use case describes an approval-only automation pattern with clinician review for anything else.

Timeframes now in force. Under CMS-0057-F, impacted payers have had to decide expedited requests within 72 hours and standard requests within 7 calendar days since 1 January 2026, and give a specific reason for every denial. That second requirement is where drafting support helps: a reviewer who has decided to deny can ask the model to draft the reason from the criteria checklist, then edit and sign it.

Claims, coding and payment integrity review

Claims volume is high and most claims pay automatically through rules engines. AI adds value around the edges:

• Coding review. Comparing submitted codes with documentation and payment policy, and flagging likely mismatches for a certified coder. For a worked example of the coder-in-the-loop pattern, see the use case on validating medical codes.
• Clinical record summaries. When a claim pends for medical review, summarising the attached records so the clinical reviewer starts from a structured view.
• Payment integrity. Explaining why a provider’s pattern was flagged by existing analytics, and drafting the records request or education letter for the analyst to send.
• Policy consistency. Answering staff questions about which payment policy applies, with the clause quoted.

Keep denials human. California’s SB 1120, in force since 1 January 2025, requires that a denial, delay or modification of care based on medical necessity be made by a licensed physician or other competent health care provider, and that AI tools used in utilisation review base their determinations on information specific to the patient and do not supplant the provider’s decision-making.

Appeals and grievances correspondence

Appeals units manage strict timelines and long files. Useful tasks include building a dated chronology of the case, summarising the original decision and the new evidence, listing the criteria in dispute and drafting acknowledgement, extension and resolution letters in the required format. Grievance handling benefits in the same way: classifying the complaint, pulling the related claims and calls, and drafting the response for a coordinator.

The decision on a clinical appeal stays with an appropriately qualified clinician. The model’s job is to make that clinician’s review faster and better documented, and to make sure the letter accurately reflects what was decided.

Member service and provider data

Member service. Representatives answer benefit, cost-sharing, claim status and network questions all day. Retrieval over the evidence of coverage, summary of benefits, formulary and claim records lets a model draft an answer that quotes the plan document, for the representative to give or adjust. A member-facing assistant is possible too, but it needs firm limits: no clinical advice, no coverage decisions and a clear route to a person.

Provider data. Directory accuracy is a perennial problem. Models can compare directory entries with contracts, credentialing files and provider-submitted updates, flag mismatches in addresses, specialties and panel status, and draft outreach to confirm details. The provider data team approves every change.

Risk adjustment documentation

Medicare Advantage risk adjustment depends on diagnoses supported by medical records. CMS announced in May 2025 that it would audit all eligible Medicare Advantage contracts for each payment year in newly initiated risk adjustment data validation audits, aimed to finish outstanding audits for payment years 2018 to 2024 by early 2026, and said it would use technology to flag unsupported diagnoses for human coders to verify.

For a plan, the matching use of AI is the same idea in reverse: reading the record behind each submitted diagnosis, confirming the documentation supports it, and flagging diagnoses that lack support for a certified coder to review and, where needed, delete. A tool that only hunts for additional codes to add, without checking support for those already submitted, invites exactly the findings the audits are designed to catch.

Medical policy Q&A

Medical policies, clinical criteria sets, payment policies and operating procedures run to thousands of pages. A retrieval assistant that answers a reviewer’s question with the relevant clause, its effective date and a link to the source document saves time and reduces inconsistency between reviewers.

There is a regulatory reason to keep this tightly tied to the published text. CMS’s February 2024 Medicare Advantage FAQ says internal coverage criteria must be publicly accessible and that, because posted criteria are fixed, AI cannot be used to shift coverage criteria over time. A tool should apply the policy as published, not a version inferred from past decisions. The health insurance rule checker playbook walks through building a rules-grounded checker on-premises.

The 2026 rules for AI in health insurance coverage decisions

CMS-0057-F. The Interoperability and Prior Authorization final rule, released on 17 January 2024, applies to Medicare Advantage organisations, Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities and, for some provisions, qualified health plan issuers on the federally facilitated exchanges. Decision timeframes and specific denial reasons apply from 1 January 2026, though the timeframes do not apply to exchange plans. Public reporting of prior authorization metrics began with a first set due by 31 March 2026. The Patient Access, Provider Access, Payer-to-Payer and Prior Authorization APIs are generally due from 1 January 2027.

CMS guidance on algorithms in Medicare Advantage. CMS’s FAQ of 6 February 2024 says an algorithm or software tool can assist coverage determinations, but the plan must ensure it complies with the rules for medical necessity decisions, including basing the decision on the individual patient’s circumstances. A prediction of post-acute length of stay cannot by itself justify ending services, and algorithms alone cannot be the basis for denying an inpatient admission. The FAQ also reminds plans of the nondiscrimination requirements of Section 1557 of the Affordable Care Act and asks them to check tools for bias before use.

Medicare Advantage rules for 2026 and 2027. The contract year 2026 final rule, released on 4 April 2025, did not finalise the proposed guardrails for artificial intelligence, and CMS said it might return to them in future rulemaking. It did finalise a limit on reopening approved inpatient admissions to obvious error or fraud. CMS’s fact sheet for the contract year 2027 final rule, released on 2 April 2026, lists no AI provisions, so the 2024 FAQ remains the main federal statement for Medicare Advantage.

WISeR in traditional Medicare. CMS’s Wasteful and Inappropriate Service Reduction model, which began on 1 January 2026 in six states, uses technology including AI to review selected services. CMS states that all recommendations for non-payment are determined by appropriately licensed clinicians, the same standard plans are expected to meet.

State physician-review laws. California’s SB 1120 took effect on 1 January 2025. Maryland’s HB 820, effective 1 October 2025, sets requirements for how carriers, pharmacy benefit managers and private review agents use AI in utilisation review. Arizona’s HB 2175, effective from 1 July 2026, requires a medical director to review medical necessity denials individually and not rely solely on recommendations from any other source. Other states have passed or are considering similar laws, so check each state where you write business.

HIPAA. An AI vendor that handles protected health information on the plan’s behalf is a business associate, and the contract must meet 45 CFR 164.504(e). The guide to HIPAA compliant LLM options compares vendor agreements with self-hosted models.

Litigation. Class actions filed since 2023 allege that large insurers used algorithms to cut off or deny care. In the case against UnitedHealth over the nH Predict tool, a federal court in Minnesota dismissed most claims in February 2025 but allowed breach of contract and good faith claims to proceed. In the case against Cigna over its PxDx process, a California federal court allowed some fiduciary duty claims to continue in March 2025. The insurers deny the allegations, and none of the rulings above decided whether they are true. The cases show how statements in plan documents about who makes decisions can become evidence.

Agentic AI for healthcare payers: what an agent may do

Agents are the natural fit for payer work because most tasks span several systems. A useful boundary:

An agent may read requests and records, query eligibility, claims history and provider data through approved tools, retrieve medical policy, compare evidence with criteria, draft packets, summaries and letters, and route work to the right queue.

An agent may not issue an adverse determination, change a member’s coverage, send a clinical decision to a member or provider without human approval, or apply criteria that are not in the published policy.

Each permission should be a tool grant tied to the agent’s role, and every step should be logged, so a compliance reviewer can see which records the agent read, which policy it used and which person approved the outcome.

Buying AI for a health plan

Questions to ask any vendor, whether it sells a utilisation management product, a claims add-on or a platform:

1. Does the tool ever issue a denial without a clinician’s decision, and can that be switched off entirely?
2. Does it apply only the plan’s published criteria, and does it show which criterion each finding relates to?
3. Can every output be traced to the source pages, model version and user who approved it?
4. Where are PHI, prompts, outputs and logs stored, for how long, and is any of it used for training?
5. Will the vendor sign a business associate agreement, and can the plan audit compliance?
6. Has the tool been tested for disparate impact across member groups, and will the vendor share the results?

The enterprise AI procurement guide for RFPs turns these into a scorecard.

How VDF AI fits a health plan

VDF AI is enterprise AI software that a health plan installs in its own data centre, private cloud or an air-gapped network. Set to local models only, it keeps clinical records, claims, member communications, indexes and logs inside the plan’s environment, so PHI is never sent to an outside model provider. VDF AI is not a medical device, makes no claims or coverage decisions and holds no certification of its own; the plan’s HIPAA program, utilisation management policies and state filings govern how it is used.

Governed agents and multi-agent workflows fit the review-support pattern described above. A prior authorization agent can assemble a criteria checklist from the record and the medical policy, then stop at an approval step for a nurse or physician. Tool grants are set per role, so the agent that reads clinical notes cannot send letters, and the agent that drafts letters can only send what a person approved. Retrieval honours collection-level permissions, which keeps behavioural health records or special investigations files away from users without access. The audit trail captures the requester, model, sources and tool calls for each step.

The VDF AI Router registers open-weight models served through Ollama, vLLM or other OpenAI-compatible endpoints, can add an approved cloud model under policy for non-PHI work, and logs each call with its budget. Users sign in with Microsoft Entra ID single sign-on on-premises, or through an SSO-aware reverse proxy for Okta, Keycloak and other SAML or OIDC providers, with RBAC on every plan. Health plans can start with a three-month platform trial on whichever seat bundle fits the first team.

The healthcare and life sciences solution and the healthcare executive brief describe the wider setup. To see whether data access, governance or skills will hold back a first pilot, take the free AI readiness assessment. This guide is general information, not legal advice on federal or state requirements.