Video Preview
🎧 Part I Podcast free on Apple Podcasts and Spotify.
🎧 Part II Podcast episode for paid subscribers only. Also available on Apple Podcasts and Spotify.
To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).
Table of Contents
The vibes are bad and the data is worse
Medical necessity is a contract term, not a clinical one
The denial machine: criteria sets, delegated reviewers, and the algorithm era
Peer to peer, sort of
The math that makes it all rational
Appeals, or the most effective attrition funnel ever built
The federal rulebook is finally moving
Gold cards, pledges, and the states
What would actually fix it
The build and buy map for people with capital
Abstract
Public fury over insurers overriding physician judgment is not new, but the engagement numbers and the political temperature are, and the underlying mechanics deserve a real teardown
Medical necessity is a defined contractual term interpreted by the payer, applied through licensed criteria sets like InterQual and MCG, and increasingly pre-screened by software that can process large batches of denials in seconds
The system is economically rational for payers because appeal rates are microscopic, overturn rates on the rare appeal are enormous, and delay itself has cash value
Federal machinery is actually moving: CMS-4201-F tightened Medicare Advantage coverage rules, CMS-0057-F imposes decision timelines, denial reasons, APIs, and public reporting, and the WISeR pilot brings algorithmic prior auth into traditional Medicare with a vendor incentive design that has people rightly squinting
The fix is not banning utilization management, it is forcing symmetry: specialty-matched review, penalties with teeth, transparency on denial and overturn rates, and automation on the provider and patient side to match the automation on the payer side
The vibes are bad and the data is worse
Every few months a screenshot goes viral where a patient recounts the same circular conversation. The claim was denied. Why? Not medically necessary. But the treating physician ordered it. Yes. And a specialist agreed. Yes. So who exactly decided it was not necessary? At this point the call usually gets transferred. Millions of impressions later, a senator tweets something, a trade association issues a statement about protecting patients from low value care, and everyone goes back to their corners until the next screenshot.
The frustrating part for anyone who works in this industry is that the outrage is directionally correct even when the individual anecdotes are messy. The structural facts are not in dispute. In Medicare Advantage alone, plans process roughly fifty million prior authorization determinations a year. A meaningful slice gets denied in full or in part. Of those denials, only around one in ten gets appealed. Of the appeals, plans overturn their own decisions more than eighty percent of the time. Sit with that for a second. When someone bothers to push back, the payer agrees with the pushback the overwhelming majority of the time. Either the appeals process is a pushover, which nobody who has filed one believes, or the initial denial layer is calibrated to something other than clinical accuracy.
On the commercial side the picture is blurrier because reporting is worse, which is itself a finding. Marketplace plans deny in network claims at rates that average in the high teens but range from low single digits to nearly half depending on the issuer, and consumers appeal a fraction of one percent of those denials. Employer sponsored coverage, where most working Americans actually live, has essentially no standardized public denial reporting at all. The largest segment of American health insurance operates as a black box on the single metric patients care most about, which is whether the thing their doctor ordered gets paid for.
Medical necessity is a contract term, not a clinical one
Here is the part that surprises people outside the industry and bores people inside it, and both reactions are a problem. Medical necessity is not a medical concept. It is a defined term in an insurance contract, usually a paragraph buried in the evidence of coverage that says something like services which are appropriate, consistent with generally accepted standards of care, not primarily for convenience, and provided in the most cost effective setting. Every load bearing word in that sentence is interpreted by the payer. Appropriate according to whom. Generally accepted according to what literature, as of when, reviewed by whom. Most cost effective setting according to whose site of care analysis.
The treating physician thinks they are making a clinical determination. The plan is making a coverage determination. These sound like the same thing and are legally completely different things, and the entire fight lives in that gap. A physician can be one hundred percent right that a treatment is the standard of care and the plan can be contractually within its rights to deny it, because the contract says the plan decides what the contract means, subject to appeal processes the plan also administers, subject eventually to external review that almost nobody reaches.
Courts have mostly blessed this arrangement. For the roughly two thirds of covered workers in self funded employer plans, ERISA preempts most state insurance law, remedies are limited to the value of the denied benefit, and there are no punitive damages for even egregious denials. A plan that wrongly denies a hundred thousand dollar treatment faces, at absolute worst after years of litigation, paying the hundred thousand dollars. The expected value calculation writes itself, and it has been writing itself since 1974.
The denial machine: criteria sets, delegated reviewers, and the algorithm era
Now to the actual machinery, because how does not medically necessary get operationalized fifty million times a year is a genuinely interesting industrial engineering question.
Layer one is the criteria sets. The two dominant products are InterQual and MCG, licensed clinical guidelines that translate medicine into decision trees a reviewer can walk through. A nurse reviewer pulls up the criteria for, say, inpatient admission for chest pain, checks whether the documentation hits the required elements, and approves or escalates. Worth noting for the conspiracy minded, and honestly just for the org chart minded: InterQual is owned by Optum, meaning the most widely used arbiter of medical necessity in America is a subsidiary of the largest payer in America, which also happens to employ or affiliate with tens of thousands of the physicians whose orders are being reviewed. Nobody planned this as a villain arc, it just accreted through M and A, but the structure is what it is.
Layer two is delegation. Payers carve out high cost categories, imaging, oncology, musculoskeletal, cardiology, genetic testing, to specialty utilization management vendors. The biggest, EviCore, touches coverage decisions for something like a hundred million Americans. Investigative reporting in 2024 documented that its screening algorithm had an adjustable sensitivity, described internally as a dial, that could be tuned to route more or fewer cases to physician review, and that clients could effectively purchase savings levels. When your medical necessity screen has a dial, the necessity part is doing less work than the medical marketing suggests.
Layer three is straight automation. The famous data point remains the reporting on Cigna’s PXDX system, where medical directors bulk denied claims that failed a diagnosis to procedure crosswalk, roughly three hundred thousand claims over two months, averaging around one to two seconds of physician attention per denial. The signatures were real. The review, in any sense a patient would recognize the word, was not. On the post acute side, litigation against the nH Predict model alleged that an algorithm predicting skilled nursing length of stay was used to cut off coverage on a schedule, with plaintiffs citing a roughly ninety percent reversal rate when families fought the terminations. The company disputes the characterization. The overturn rate does not really care who characterizes it.
Peer to peer, sort of
The system’s answer to the who overruled my doctor question is the peer to peer call, which deserves its own section because it is where the theory of the model meets the actual phone call. In theory, the treating physician discusses the case with a plan medical director of similar training and they reason together like colleagues. In practice, the attending oncologist gets fifteen minutes on a Tuesday with a physician who may not have practiced in a decade and may have trained in an entirely unrelated specialty. State laws requiring same specialty review exist but are patchy, and again, ERISA plans wave at most of them from across the preemption moat.
The most cited artifact here is the deposition of a former Aetna medical director who testified that he never looked at patient medical records when deciding appeals, relying instead on nurse summaries, which triggered a California regulatory investigation and a national round of nervous laughter from everyone who knew this was not an outlier workflow. The economics of the medical director role explain a lot. A plan physician reviewing dozens of cases a day is not being paid to find reasons to approve. Denial rates are tracked. Productivity is tracked. The dial exists at the human layer too, it is just called a performance review.
None of this means utilization management is illegitimate. Low value care is real, supplier induced demand is real, there are documented cases of imaging centers and skin substitute vendors and certain infusion suites doing things that would make a rational person beg for prior authorization. The steelman for UM is strong in aggregate. The problem is that the current implementation applies population level friction to individual patients through a process with asymmetric information, asymmetric automation, and asymmetric consequences for being wrong.
The math that makes it all rational
Follow the incentives and everything snaps into focus. A denial has three possible outcomes for a payer. The patient abandons care, which converts the claim cost to zero. The provider eats it or the patient pays cash, same result. Or the denial gets appealed and overturned, in which case the payer pays what it would have paid anyway, months later, having earned float in the interim, with essentially no penalty attached. There is no fourth outcome where the payer pays more for having denied wrongly. Heads the plan wins, tails the plan ties.
People sometimes argue the medical loss ratio rules blunt this, since plans must spend eighty or eighty five percent of premium on claims and rebate the difference. Cute in theory. In practice MLR pressure gets managed through pricing and through vertical integration, where claim dollars paid to owned providers, owned PBMs, and owned UM vendors stay in the family. Denials are less about hitting an MLR number and more about trend management, which flows into next year’s premium competitiveness, which flows into membership growth, which is what the street actually pays for. A plan that runs looser UM than its competitors prices itself out of employer RFPs. This is a race with no bottom until regulation installs one.
Meanwhile the cost of the friction lands on everyone else. Physician surveys consistently show practices burning double digit hours per physician per week on prior auth, overwhelming majorities reporting care delays, and roughly a quarter to a third reporting that a prior auth process led to a serious adverse event for a patient. Hospitals staff entire departments for this. The administrative arms race between payers and providers is one of the largest pure deadweight sectors in the American economy, and both sides are now buying AI to fight it faster, which is either progress or an arms dealer’s dream depending on the quarter.
Appeals, or the most effective attrition funnel ever built
Consumer product people would study health insurance appeals with religious awe if it were a funnel they were allowed to admire out loud. Start with millions of denials. Require the patient or provider to understand that appeal is possible, find the correct form, gather records, write a letter, and submit within a deadline, while sick. Fewer than one percent of denied marketplace claims get appealed. In Medicare Advantage it is better but still around one in ten. Each subsequent level, internal reconsideration, external review, administrative law judge, sheds another order of magnitude of participants.
And the punchline, already mentioned but worth repeating because it is the whole ballgame: when cases do reach review, denials get overturned at rates that would end careers in any other quality controlled industry. Eighty plus percent overturn on appealed MA prior auth denials. External medical reviews flipping payer decisions around forty to fifty percent of the time in many states. Imagine a manufacturing line where eighty percent of rejected parts turned out to be fine whenever anyone bothered to reinspect them. The rejection station would be recalibrated by Friday. Here the rejection station is the business model, and the reinspection rate is low enough that recalibration would be value destructive.
This is why the emerging patient side appeal automation companies are interesting beyond their revenue potential. If appeal volume went from one percent to forty percent with AI generated, clinically literate, deadline compliant appeals, the entire actuarial basis of aggressive front end denial collapses. The funnel only works if people fall out of it.
The federal rulebook is finally moving
Credit where due, the last three years produced more real federal movement on this than the prior twenty, and the details matter for anyone modeling the space.
CMS-4201-F, effective 2024, told Medicare Advantage plans they must follow traditional Medicare coverage criteria, including national and local coverage determinations and general coverage and benefit conditions in traditional Medicare regulations, and may use prior authorization only to confirm diagnoses or other medical criteria or ensure that an item or service is medically necessary. The rule also requires coordinated care plans to provide a minimum 90-day transition period when an enrollee currently undergoing treatment switches to a new MA plan, during which the new MA plan may not require prior authorization for the active course of treatment, and requires all MA plans to establish a Utilization Management Committee to review policies annually and ensure consistency with traditional Medicare’s coverage decisions and guidelines. The two-midnight benchmark is part of the traditional Medicare framework referenced by the rule. Enforcement energy has fluctuated, audits are slow, and plans have gotten creative with concurrent review as a workaround for restricted prior auth, but the legal foundation shifted.
CMS-0057-F, finalized in 2024, is the plumbing rule and arguably the bigger deal. Impacted payers, which include MA, Medicaid, CHIP, and marketplace plans but notably not most employer sponsored coverage, must answer expedited prior auth requests within seventy two hours and standard requests within seven calendar days starting in 2026, must provide specific denial reasons, must publicly report prior auth metrics including approval, denial, and appeal overturn rates, and must stand up FHIR based prior authorization APIs by January 1, 2027 so the request can move machine to machine instead of by fax, an actual fax, in the year of our lord 2026. Public reporting is quietly the most dangerous provision for payers. Denial rate league tables change broker conversations, employer procurement, and journalism in ways that timeline mandates do not.
Then there is WISeR, the CMMI model that launches January 1, 2026, in six states, applying technology assisted prior authorization to selected services in traditional Medicare, things like skin and tissue substitutes, electrical nerve stimulator implants, and knee arthroscopy for knee osteoarthritis where fraud and overuse are genuinely rampant. Defensible target list. The design choice that raised every eyebrow in the building is that participating vendors can share in the savings they generate. Paying the reviewing entity a percentage of averted expenditures is the exact incentive structure everyone spent the last five years criticizing in the commercial delegated UM world, now installed in the fee for service program with federal branding. CMS says licensed clinicians make the final adverse determinations and that the model targets only waste. The commercial UM vendors said the same words. The next two years of WISeR data will settle whether this is smart procurement or a category error, and given that the same administration is simultaneously demanding insurers cut prior auth in MA while expanding it in FFS, coherence is not the operative frame. Leverage is.
Gold cards, pledges, and the states
The industry, reading the room after a very dark December 2024 and a bruising eighteen months of coverage, made its move in mid 2025: a public pledge from around fifty plans covering the large majority of insured Americans to standardize electronic prior auth by 2027, shrink the list of services requiring it during 2026, honor existing authorizations for ninety days when patients switch plans, deliver real time decisions on most requests by 2027, and ensure clinician review of clinical denials. Some of this is real work. Some of it is promising to comply with CMS-0057 on the timeline CMS-0057 already requires, presented as magnanimity. Voluntary pledges in this industry have a shelf life inversely proportional to the news cycle that produced them, so the correct posture is trust but verify, minus the trust, plus a public dashboard.
States keep experimenting. Texas pioneered gold carding, exempting physicians with high historical approval rates from prior auth, and the results are instructive mainly as a cautionary tale, since the qualification thresholds and category level measurement meant only a tiny percentage of physicians actually earned cards. Dozens of states have since passed some flavor of PA reform, response deadlines, same specialty review requirements, continuity protections, AI disclosure rules. All of it stops at the ERISA border. A state can pass the most beautiful prior auth law ever drafted and it will not touch the self funded plan covering the school district, the hospital system’s own employees, or the tech company down the road. Until Congress touches ERISA remedies or extends the CMS-0057 framework to employer coverage, state reform is landscaping around a locked building.
What would actually fix it
The honest version of reform is boring and structural. Symmetric timelines with automatic approval when payers blow deadlines, already partially in place in some states and coming federally, but needing real teeth, meaning claims deemed approved and interest owed rather than a strongly worded letter. Specialty matched physician review for any clinical denial, with the reviewer’s name, specialty, and time spent on the record. Mandatory public reporting of denial and overturn rates at the plan and service line level across all lines of business, employer plans included, because sunlight on an eighty percent overturn rate is a more effective regulator than any audit team. Penalties that scale with wrongful denial, so the expected value of a bad denial goes negative for the first time in fifty years. And a rule that any algorithm used in coverage determination is subject to the same validation and adverse decision documentation standards as the humans it replaced, since a dial with a compliance certificate is still a dial.
None of that eliminates utilization management, nor should it. It converts UM from an attrition game into an accuracy game. Plans that are actually good at identifying low value care would thrive under those rules. Plans whose margin depends on the one percent appeal rate would have a very uncomfortable couple of years, which is rather the point.
The build and buy map for people with capital
For the operators and investors in the room, the map draws itself. The payer side automation wave is mature and consolidating, with the delegated UM incumbents bolting on AI and the platforms racing to be the pipes for the 2027 API mandates. The provider side is the hot zone, ambient tools that assemble prior auth packets from the chart, predict criteria hits before submission, auto file appeals with the clinical citations attached, and track payer behavior at the CPT level to route requests intelligently. The patient side is earliest and most asymmetric, appeal generation tools that could move the funnel math discussed above, with business models still finding themselves because sick people are a terrible customer segment to monetize and a wonderful one to arm.
The second order trade is data. CMS-0057 public reporting plus state AI disclosure laws will create, for the first time, comparable denial behavior datasets. Whoever normalizes that exhaust into a payer conduct score sold to employers, brokers, health systems, and plaintiff firms is building the FICO of coverage behavior, and every constituency listed above would pay for it, some of them gleefully.
The screenshot conversations will keep going viral either way. So who decided it was not necessary remains the best question in American healthcare, and for the first time in a long time, the answer is being renegotiated in rulemaking, in courtrooms, in state houses, and in a whole lot of pitch decks. Worth watching closely. Worth building toward. Preferably in under 1.2 seconds
.