Federal rules now ask a lot of Medicare Advantage UM committees. Every Medicare Advantage plan must have a utilization management (UM) committee whose job is to check its prior authorization policies against Traditional Medicare once a year. The requirement took effect in 2024. Since then, CMS has written guidance on algorithms and limited when a plan can reopen an approved hospital admission. It also added a health equity member and an equity analysis, then said in June 2025 that it would not enforce them. In November it proposed to remove them.
Most of these requirements land in the same room. The UM committee is where a plan decides which services need prior authorization and which criteria apply when Medicare’s own rules run out. It is also where the plan should check that the tools reviewers use stay inside those criteria. That makes the committee the place where a plan’s compliance with 3 years of Medicare Advantage (MA) rulemaking either holds together or does not.
This analysis maps what the regulations and CMS guidance now require of MA UM committees and of the policies they review. It starts with the 2024 coverage criteria rule and ends with the proposal for 2027, which is open for comment until January 26.
Key takeaways
- The baseline is Traditional Medicare. MA plans must follow national and local coverage determinations. They may write internal criteria only where Medicare’s criteria are not fully established, and those criteria must be public and supported by evidence.
- The committee reviews prior authorization policies every year. It is led by the plan’s medical director and must check each policy for consistency with Traditional Medicare coverage rules.
- Algorithms can assist but cannot decide. CMS guidance says a determination based on a larger data set instead of the individual patient’s own record does not comply.
- Delegation moves the work, not the accountability. An MA organization keeps ultimate responsibility for delegated review, and its delegation agreements must provide for ongoing monitoring.
- Approved care has to stay approved. A prior authorization for a course of treatment must remain valid as long as medically reasonable and necessary. Since 2026, an approved inpatient admission can be reopened only for obvious error or fraud.
- The equity requirements are already unenforced. CMS said in June 2025 it would not enforce the health equity member or the annual equity analysis, and the 2027 proposed rule would remove both.
Coverage criteria start with Traditional Medicare
The 2024 MA final rule, CMS-4201-F, settled a long-running question about how far MA plans may depart from Traditional Medicare when deciding what is medically necessary. According to the CMS fact sheet released in April 2023, MA plans must comply with Traditional Medicare’s coverage rules, including national coverage determinations (NCDs) and local coverage determinations (LCDs).
Plans may create internal coverage criteria only when Medicare’s criteria are “not fully established,” a phrase the rule defines narrowly. Under 42 CFR § 422.101(b)(6), any internal criteria must be based on current evidence in widely used treatment guidelines or clinical literature, and they must be publicly accessible.
CMS’s February 2024 answers to plan questions filled in what “publicly accessible” means in practice. The criteria must be on a website open to the general public, without a paywall or a login limited to enrollees. A plan may host criteria on a vendor’s site if that site is reachable from the plan’s own website, but CMS warned that scattering criteria across several vendor links could undermine access. Citing a third-party criteria set without the primary sources behind it does not comply.
The same guidance sets a substantive test as well as a procedural one. Under 42 CFR § 422.101(b)(6)(i)(A), a plan must show publicly that the clinical benefits of its internal criteria are highly likely to outweigh the clinical harms, including harms from delayed or decreased access to care. CMS said generic justifications are not enough and that criteria should be narrowly tailored.
For a UM committee, these provisions define the first question to ask about any policy, which is whether an NCD or LCD already governs the service. If one does, the plan’s criteria cannot be stricter. If none does, the committee needs a written evidence summary that a reader outside the plan could check.
Prior authorization has a limited purpose
The 2024 rule also limited what prior authorization in coordinated care plans can be used for. The fact sheet says these policies may only be used to confirm the presence of diagnoses or other medical criteria and to ensure that an item or service is medically necessary. Prior authorization is a check on whether a specific request meets coverage rules, not a separate gate with its own standards.
The committee reviews every prior authorization policy every year
Under 42 CFR § 422.137, every MA organization must have a UM committee that reviews its prior authorization policies at least once a year and confirms they are consistent with Traditional Medicare’s national and local coverage decisions and guidelines. The requirement applies beginning in 2024.
CMS’s February 2024 guidance answers 4 structural questions.
- Leadership. The committee is led by the plan’s medical director, the official responsible for clinical decisions under 42 CFR § 422.562(a)(4).
- Level. Committees may be set up for an MA organization or a plan, but not once at the parent organization level for all its subsidiaries. A parent may use substantially the same members across its subsidiaries’ committees if each one meets the requirements.
- Existing committees. A plan may adapt an existing body, such as a pharmacy and therapeutics committee or a committee formed for accreditation, to meet the requirement.
- Size. The guidance says there is no requirement on how many people serve.
The rule’s focus is the annual review. In practice that means a committee needs an inventory of every service the plan subjects to prior authorization, with the governing NCD or LCD for each. Where no Medicare policy exists, the inventory should hold the internal criteria and their evidence summary. The public prior authorization metrics required under the federal rule that took effect January 1, which include a list of every item and service that requires authorization, will make that inventory visible to anyone who looks.
Delegated programs are still the plan’s programs
Many MA plans delegate parts of utilization management, such as advanced imaging or musculoskeletal review, to specialty vendors. Delegation moves the work, not the accountability. Under 42 CFR § 422.504(i)(1), an MA organization maintains ultimate responsibility for complying with all terms of its contract with CMS, whatever its relationships with “first tier, downstream, and related entities.”
Paragraph (i)(4) of the same section sets what every delegation agreement must contain. The agreement has to identify the delegated activities and allow the plan to revoke the delegation if the delegate performs unsatisfactorily. It must also state that the plan monitors the delegate’s performance on an ongoing basis. If the delegate’s medical professionals are credentialed, the plan must either review their credentials or review and approve the delegate’s credentialing process and audit it on an ongoing basis. The delegate must comply with Medicare rules and CMS instructions.
For the UM committee, the practical meaning is that a vendor’s criteria are the plan’s criteria. If a specialty benefit manager applies its own guideline set, the committee’s annual review has to cover that guideline set against NCDs and LCDs, and the public posting requirement for internal criteria applies to it. CMS’s 2024 guidance on hosting criteria on a vendor’s website, reachable from the plan’s own site, assumes exactly this arrangement. The same logic extends to the vendor’s software. A committee that reviews the written policy but not the tool that applies it has reviewed half of the program.
Algorithms can assist but cannot decide
The question that drew the most attention in CMS’s 2024 guidance was how plans may use algorithms and AI in coverage decisions. CMS’s answer allows assistance and rules out substitution.
A plan may use an algorithm or software tool to help make coverage determinations, but the MA organization remains responsible for complying with every applicable rule. Under 42 CFR § 422.101(c), medical necessity determinations must be based on the individual enrollee’s circumstances, including the enrollee’s own medical record and the treating physician’s recommendations. The guidance says a tool that makes a determination from a larger data set instead of the individual patient’s information does not comply.
CMS applied the principle to 2 specific situations.
- Post-acute care. A predicted length of stay cannot by itself justify ending services in a skilled nursing facility or similar setting. The plan must reassess the patient’s condition before issuing a termination notice.
- Inpatient admissions. An algorithm or AI cannot by itself justify denying an inpatient admission or downgrading it to observation.
The guidance also bars a tool from changing the coverage criteria over time or applying criteria that have not been published. A tool may be used only to ensure fidelity to publicly posted internal criteria. CMS added that plans should make sure tools do not perpetuate or introduce bias, citing the nondiscrimination requirements of Section 1557 of the Affordable Care Act.
For the committee, this means the review cannot stop at the written policy. If a vendor tool scores requests or suggests determinations, the committee needs to know which published criteria the tool applies and whether its logic has changed since the last review. A policy that is consistent with an LCD on paper but implemented through a tool that applies a stricter threshold is not consistent in practice.
CMS considered going further. In its proposed rule for 2026, it proposed guardrails for AI meant to ensure equitable access to MA services. The final rule did not adopt them. According to Akin Gump’s summary, CMS acknowledged broad interest in regulating AI and said it would keep considering future rulemaking. The 2024 guidance remains the operative federal statement for MA plans.
A policy that matches the local coverage determination on paper but runs through a tool with a stricter threshold is not consistent with Medicare in practice.
Physician review comes before an adverse decision
Under 42 CFR § 422.566(d), a physician or other appropriate health care professional with expertise in the relevant field, including knowledge of Medicare coverage criteria, must review any partially or fully adverse medical necessity decision before it is issued. CMS’s 2024 guidance added that the agency will use physician reviewers in its audits to assess denied requests.
The requirement interacts with the algorithm guidance. If software recommends a denial, a qualified reviewer still has to make the decision. The guidance does not specify how independent that review must be from the tool’s recommendation, which is where operational design matters. A reviewer who sees only a summary prepared to support the recommendation is reviewing the tool’s reasoning, not the case.
Approved care has to stay approved
The rules include 2 sets of provisions on what happens after an approval, and both affect how a committee writes policy.
Course of treatment and transitions. The 2024 rule requires that an approved prior authorization for a course of treatment remain valid for as long as medically reasonable and necessary to avoid disruptions in care, based on the coverage criteria and the treating provider’s recommendation. Coordinated care plans must also give enrollees who switch to a new MA plan during active treatment a transition period of at least 90 days, during which the new plan may not require prior authorization for that course of treatment.
Reopening inpatient approvals. The 2026 MA final rule, issued in April 2025, narrowed when a plan can revisit an approved hospital stay. According to Rise Health’s summary, MA plans may reopen an approved inpatient admission only for obvious error or fraud. The same rule clarified that decisions made while an enrollee is receiving services count as organization determinations, so the appeal rules apply to them. It also requires plans to notify providers of decisions on requests they submit for enrollees.
The reopening limit changes the economics of concurrent review. A plan that approves an admission and later concludes it was unnecessary can no longer deny payment on that basis alone. Decisions have to be right when they are made, which places more weight on the criteria and documentation available at the start of the stay.
The health equity requirements are on the books but not enforced
The 2025 MA final rule, CMS-4205-F, added 2 equity requirements to the UM committee. According to the CMS fact sheet released in April 2024, at least one committee member must have expertise in health equity. The committee must also conduct an annual, plan-level health equity analysis of the plan’s prior authorization policies and procedures, aimed at identifying disproportionate effects on enrollees with social risk factors, such as dual eligibility for Medicare and Medicaid or a disability. The results must be posted on the plan’s website.
CMS’s proposed rule for 2026 included changes to that analysis, which the agency did not finalize. HFMA’s summary lists the annual health equity analysis provision among the proposals CMS declined to adopt, alongside the AI guardrails.
Then CMS stepped back from the requirements themselves. On June 16, 2025, it said it would not enforce either the health equity member or the plan-level equity reporting, according to an analysis by Georgetown University’s Medicare Policy Initiative. The requirements were suspended rather than repealed. In the proposed rule for contract year 2027, published in the Federal Register in late November 2025, CMS proposed to remove them, according to summaries by the American Society for Radiation Oncology and the law firm Hooper Lundy. Hooper Lundy describes the proposal as eliminating both the publicly posted analyses and the health equity expert. Comments are due by January 26, 2026.
Some plans posted analyses anyway, creating a public record that will remain whatever the final rule says. What those analyses measured, and what they could and could not show, is the subject of a separate Rounds analysis.
What an annual review has to show
The regulations do not prescribe a format for the committee’s annual review. Taken from the requirements above, the evidence a committee would need to show compliance falls into a short list.
| Requirement | Regulatory source | Evidence a committee would need |
|---|---|---|
| Policies consistent with Traditional Medicare | 42 CFR § 422.137, § 422.101(b) | For each service subject to prior authorization, the governing NCD or LCD, or a finding that none fully applies |
| Internal criteria limited and public | 42 CFR § 422.101(b)(6) | A public link to each internal criterion, with its evidence citations and benefits-versus-harms summary |
| Determinations based on the individual patient | 42 CFR § 422.101(c) | A description of how any tool uses patient-specific records and which published criteria it applies |
| Qualified review of adverse decisions | 42 CFR § 422.566(d) | Reviewer credentials matched to the services they review |
| Delegated programs held to the same standards | 42 CFR § 422.504(i) | Delegation agreements and monitoring reports, with each delegate’s criteria and tools in the review |
| Course-of-treatment validity and 90-day transition | 2024 MA final rule | Authorization duration rules and transition-period handling for new enrollees |
| Limits on reopening approved admissions | 2026 MA final rule | Reopening criteria limited to obvious error or fraud |
| Health equity analysis and health equity member | 2025 MA final rule | Not enforced since June 2025, and proposed for removal |
Compiled from the CMS documents and summaries cited in this analysis. The right-hand column is this analysis’s reading of the requirements, not CMS guidance.
The table also shows what is missing from the federal requirements. Nothing in them requires a committee to look at outcomes, such as how often its denials are overturned on appeal or how long decisions take. Those measures are where the committee would learn whether a policy that is compliant on paper works in practice. The overturn rate is the clearest example. When most appealed denials for a service are reversed, the criteria or their application deserve scrutiny, whatever the written policy says.
A committee does not need a new system to see this. For each service on its prior authorization list, a short set of numbers would do.
- Requests received, and the share approved on first submission
- Denials, and how many of them were appealed and reversed
- Median time to decision
- The share of requests handled by a delegate
A service approved nearly every time is a candidate to remove from the list. A service whose denials are mostly reversed is a candidate for new criteria or retraining. Both findings are decisions the committee is already empowered to make.
What to watch in 2026
The 2027 final rule. CMS typically issues the MA final rule in the spring. Whether it removes the equity analysis and the health equity member as proposed will settle the shape of the committee for 2027.
Public metrics on March 31. The first prior authorization metrics, due by March 31 under the federal interoperability and prior authorization rule, will list every service each plan subjects to authorization. Comparing those lists with NCDs and LCDs will be possible for anyone, including CMS auditors and researchers.
AI policy outside MA rulemaking. CMS declined to finalize AI guardrails for MA, but federal and state policy on AI in coverage decisions continues to move. Several states have passed laws requiring clinician review of adverse decisions in coverage settings they regulate, which affects plans with commercial and Medicaid lines alongside MA.
Audits. CMS’s statement that it will use physician reviewers to assess denied requests in audits means the committee’s evidence summaries may be read by someone outside the plan. The annual review is the plan’s chance to see its policies the way an auditor will.
About this analysis
Basis. This analysis relies on CMS fact sheets for the 2024 and 2025 MA final rules and on CMS’s February 2024 answers to plan questions on coverage criteria and UM requirements. For later changes, we used secondary summaries of the 2026 final rule and Georgetown’s analysis of the June 2025 non-enforcement, along with the 2027 proposed rule as published in the Federal Register. Of 42 CFR part 422, only § 422.504 was reviewed directly, as published by the Legal Information Institute. Provisions are described as stated in the CMS documents and summaries cited.
Data notes.
- CFR citations other than § 422.504 are those used in CMS’s 2024 guidance.
- CMS’s June 2025 non-enforcement is described from Georgetown’s analysis. The CMS memo itself was not reviewed.
- The 2027 proposed rule is a proposal. Its provisions are not in effect and may change in a final rule.
- The “evidence a committee would need” column and the suggested service-level measures reflect this analysis’s interpretation of the requirements.
Sources
- CMS, 2024 Medicare Advantage and Part D final rule (CMS-4201-F) fact sheet, April 2023
- CMS, Frequently asked questions related to coverage criteria and utilization management requirements in CMS final rule (CMS-4201-F), February 2024, as posted by the American Hospital Association
- CMS, Contract year 2025 Medicare Advantage and Part D final rule (CMS-4205-F) fact sheet, April 2024
- Legal Information Institute, 42 CFR § 422.504, Contract provisions
- Rise Health, First look at the 2026 Medicare Advantage final rule, April 2025
- HFMA, 2026 Medicare Advantage and Part D final rule summary, April 21, 2025
- Akin Gump, CMS declines to finalize rule for equitable use of AI by Medicare Advantage plans
- Georgetown Medicare Policy Initiative, CMS suspends new Medicare Advantage prior authorization transparency rules, November 19, 2025
- Federal Register, Contract year 2027 policy and technical changes to the Medicare Advantage program, proposed rule, November 28, 2025
- ASTRO, CY 2027 proposed rule rescinds utilization management analysis, December 17, 2025
- Hooper Lundy, Health equity at risk in latest Medicare rulemaking
Frequently asked questions
What does a Medicare Advantage UM committee have to do?
Under 42 CFR § 422.137, it must review the plan’s prior authorization policies at least once a year and confirm they are consistent with Traditional Medicare’s national and local coverage determinations. It is led by the plan’s medical director.
Can Medicare Advantage plans use AI to deny coverage?
CMS guidance allows algorithms to assist coverage decisions, but a determination must rest on the individual patient’s own record. A qualified professional must also review any adverse medical necessity decision before it is issued.
Is a Medicare Advantage plan responsible for a delegated UM vendor?
Yes. Under 42 CFR § 422.504(i), the MA organization keeps ultimate responsibility for complying with its CMS contract, and its delegation agreements must provide for ongoing monitoring and remedies.
Is the Medicare Advantage health equity analysis still required?
It remains in the 2025 MA final rule, but CMS said in June 2025 that it would not enforce it. The 2027 proposed rule, open for comment until January 26, 2026, would remove it.