CMS Medicare Advantage Final Rule (CMS-4201-F) — algorithmic prior authorization limits
United States · 42 C.F.R. § 422.101(c); 88 Fed. Reg. 22120 (Apr. 12, 2023)
Medicare Advantage plans cannot use algorithms or AI to deny medically necessary care. Any algorithm-driven coverage decision must comply with traditional Medicare coverage criteria and consider the individual patient's circumstances — not just generic model output.
Technical detail
42 C.F.R. § 422.101(c) (CMS-4201-F, 88 Fed. Reg. 22120) requires MA organizations to base coverage decisions on individual patient circumstances and applicable Medicare coverage criteria; algorithm or AI tools may not be used to deny care that would be covered under traditional Medicare. CMS reiterated in FAQ (Feb. 2024) that AI tools cannot override the requirement for individualized assessment.
Who is protected: Medicare Advantage enrollees facing prior-authorization or coverage decisions made or aided by AI
Who must comply: Medicare Advantage organizations and their delegated utilization-management vendors (including AI/algorithmic prior-authorization platforms such as those at issue in current MA UM litigation)
Key facts
| Jurisdiction | United States |
|---|---|
| Level | Federal |
| Status | In effect |
| Protection strength | Moderate protection |
| Effective date | 2024-01-01 |
| Enacted | 2023-04-12 |
| Citation | 42 C.F.R. § 422.101(c); 88 Fed. Reg. 22120 (Apr. 12, 2023) |
| Enforced by | Centers for Medicare & Medicaid Services |
| Private right of action | No — agency enforcement only |
| Penalties | Plan compliance actions; civil money penalties; suspension or termination of MA contracts |
| Topics | healthcare AI · automated decision-making · consumer protection |
| Last verified | 2026-06-17 |
| Official source | CMS FAQ on Medicare Advantage Coverage Criteria and Utilization Management (CMS-4201-F) ↗ |
More AI rules in United States
- FTC Act Section 5 (unfair/deceptive AI) · In effect
- TAKE IT DOWN Act · In effect
- FCRA (AI in credit & background checks) · In effect
- ECOA / Regulation B (AI credit discrimination) · In effect
- Title VII / ADA (AI hiring) · In effect
- COPPA + 2025 Rule (childrens data) · In effect
Related healthcare AI rules elsewhere
- Colorado AI Act (repealed) · Repealed / replaced
- SB 26-189 (Colorado ADMT Law) · Enacted (not yet in effect)
- AI Companion Safeguards Law · In effect
- Utah AI Policy Act · In effect
- HB 452 (Mental Health Chatbots) · In effect
- My Health My Data Act · In effect
See something wrong or out of date? Submit a correction — every entry must carry a verifiable official source.