Medicare Advantage's 13%

For one week in June 2019 — June 1 through June 7 — every prior-authorization denial issued by the fifteen largest Medicare Advantage organizations became potential audit material. The Office of Inspector General at HHS pulled a stratified random sample of those denials, 250 prior-authorization refusals and 250 payment refusals, and did something no dashboard or disclosure form can do: it had physicians and coding experts re-read the actual case files.¹

The report, published in April 2022 under the number OEI-09-18-00260, found that 13 percent of the denied prior-authorization requests met Medicare coverage rules — services that would likely have been approved under original Medicare. Among denied payment requests, 18 percent met both Medicare coverage rules and the plans’ own billing rules.¹

Medicare Advantage plans are paid a capitated rate to administer Medicare’s benefit — the coverage rules are Medicare’s, not theirs to narrow. The OIG’s case-file review identified two recurring mechanisms behind the denials that should not have happened. First, plans applied clinical criteria that are not contained in Medicare coverage rules — internal thresholds stricter than the program they administer. Second, plans denied requests for insufficient documentationin cases where the OIG’s reviewers found the existing medical records were already sufficient to support coverage.¹ The report recommended that CMS issue guidance on the use of clinical criteria, update its audit protocols, and direct plans to fix the manual and system errors driving wrongful payment denials.¹

The 2022 audit did not arrive out of nowhere. Four years earlier, the same office had looked at the appeals side of the same system and found a pattern that pointed to the front end.

The same 2018 report found that beneficiaries and providers appealed only 1 percent of denials to the first level.² A 75 percent overturn rate on a 1 percent appeal rate is what prompted the question the 2022 audit answered: if the plans reverse themselves that often when challenged, what fraction of the unchallenged denials were wrong to begin with? The case files said 13 percent.

The October 2024 report from the Senate Permanent Subcommittee on Investigations is the closest thing to a sequel the OIG audit has: instead of sampling case files, the subcommittee subpoenaed the companies’ own data and internal documents. Its figures are the insurers’ own numbers. UnitedHealthcare’s prior-authorization denial rate for post-acute care rose from 8.7 percent in 2019 to 22.7 percent in 2022.³ Humana’s denial rate for long-term acute-care hospitals rose 54 percent between 2020 and 2022.³ By 2022, UnitedHealthcare and CVS were denying post-acute prior-authorization requests at roughly three times their overall denial rates, and Humana at more than sixteen times its overall rate.⁴

The report names the tools involved — naviHealth’s nH Predict at UnitedHealthcare, and a CVS initiative called Post-Acute Analytics, whose projected savings the company revised from an initial $10–15 million over three years to $77.3 million for the same period.³The subcommittee’s majority concluded the companies were using prior authorization to restrict access to post-acute care; the companies dispute that characterization. The denial-rate figures themselves, produced from the companies’ own records, are not in dispute in the report.³

CMS-4201-F, finalized in April 2023, wrote the OIG’s first finding into regulation: a Medicare Advantage plan may not deny a basic benefit using clinical criteria of its own invention. Where Medicare’s coverage criteria are fully established — in statute, regulation, an NCD or an LCD — the plan must follow them. Internal criteria are permitted only where Medicare’s criteria are not fully established, and must then be based on current evidence in widely used treatment guidelines or clinical literature, and made publicly accessible.⁵ When plans asked whether the rule barred algorithms and AI outright, CMS answered in a February 2024 memo to every MA organization:

The memo goes further than the length-of-stay example: an algorithm that decides coverage from a larger data set rather than the individual patient’s medical history, physician recommendations and clinical notes does not comply with the medical-necessity rules at 42 CFR § 422.101(c), and predictive tools cannot apply internal criteria that were never made public.⁶

What began as one sampled week in June 2019 is now a documented arc: an audit, a Pulitzer-finalist investigation, a federal class action, a Senate report, and two final rules. None of it changed the underlying arithmetic for a practice holding a denial: the OIG’s 13 percent were only ever found because someone re-read the file. The documents above are what re-reading the file looks like at national scale — and every one of them is public.