Payers are already using algorithms and AI to review prior authorization requests and claims at scale. What rules constrain them? A KFF issue brief published May 6 surveys the landscape and finds it thinner than most providers assume: a patchwork of state laws - several states now require physician review of AI-based adverse determinations, and a handful restrict AI denials outright - sitting alongside federal requirements that predate modern AI. Into that gap, the brief notes, the administration's new AI policy framework proposes federal preemption of many state AI laws, which could nullify exactly the state-level consumer protections that currently exist.
The brief's core observation deserves attention from every billing leader: automation now runs on both sides of the claims review cycle. Insurers use algorithms to adjudicate millions of claims; providers increasingly use automation for prior auth and appeal workflows. But the two sides are not regulated symmetrically - and the asymmetry runs against the provider.
The stakes are practical, not academic. A denial generated by an algorithm in seconds carries the same legal weight as one produced by a clinician after review - unless your state says otherwise, and unless anyone checks. Providers who ask which rules applied to their denial usually discover nobody at the payer can answer. Building the habit of asking, and documenting the answer, is costless; it also builds the record that state regulators and litigants increasingly rely on.
What the current rules actually require
The protections that exist cluster in a few buckets:
- State AI-specific laws. A growing number of states require that adverse determinations be made or reviewed by a licensed clinician, and some bar AI tools from being the sole basis of a denial. Enforcement is complaint-driven and rare.
- Utilization review statutes. Most states have long required timely decisions and physician involvement in medical-necessity denials, whatever tool produced the draft.
- Federal transparency requirements. Newer federal rules force payers to publish prior auth metrics - denial rates, turnaround times - creating, for the first time, a public dataset of payer behavior.
What almost nowhere requires: that the algorithm be accurate, that its training data be disclosed, or that the payer prove the denial was clinically reviewed before it landed in your queue.
The audit trail cuts both ways
Here is the practical consequence for providers. Payer algorithms generate denials faster than humans can contest them, and the regulatory floor beneath those denials is low and shifting. Meanwhile, the documentation demands on providers keep rising: prove medical necessity, prove authorization, prove timeliness, prove the records were attached.
The rational response is not to wait for regulation to converge. It is to hold your own side to a standard the payers are not yet held to:
- Log every denial with its stated reason and timestamp. Patterns that look like systematic algorithmic rejection - identical rationale, sub-decision speed, bulk denial runs - are evidence in escalation and, increasingly, in state complaints.
- Demand the human behind the denial. Where state law requires clinician review, ask for it. Payers count on providers not asking.
- Keep your own AI auditable. If your organization uses automation for appeals or submissions, keep a human decision on every outbound action. It is the same standard the states are writing for payers, and it is where the regulatory direction points.
Watch two developments through the rest of the year: whether Congress picks up the AI framework's preemption recommendations, and whether more states extend clinician-review requirements from prior auth to retrospective claims review - where most algorithmic denials actually happen today. Both would reshape the compliance picture quickly. Either way, the organizations with clean logs and documented escalation will adapt faster than those starting from a shoebox of PDFs.
The takeaway
The rules governing payer AI are a patchwork, and the federal preemption debate KFF maps could make them thinner before they get thicker. Providers should plan for a world where algorithmic denials are the default and the burden of contesting them falls entirely on their side. That means evidence discipline - logged reasons, timestamps, patterns - and appeal machinery that works at machine speed. Both are built into how QHB's agents operate, because in an unregulated adjudication environment, the best consumer protection is a provider that never lets a denial expire unworked.