CMS Closed the Appeals Loophole. The Senate Wants the Algorithm.
A rule from the Centers for Medicare & Medicaid Services (CMS) that took effect July 6 extends Medicare Advantage appeals to concurrent coverage decisions. The same rulemaking record explicitly declined to regulate the AI systems making those decisions. Nine days later, a bipartisan Senate panel opened its own inquiry into exactly that gap.
On July 6, 2026, CMS updated the Parts C and D Enrollee Grievances, Organization/Coverage Determinations, and Appeals Guidance. The update operationalizes final rule CMS-4208-F, finalized April 4, 2025 and applicable for contract year 2026.
The guidance clarifies that an “organization determination,” the decision category that carries full Medicare Advantage appeal and notice rights, now explicitly includes plan decisions made concurrent with an enrollee’s receipt of care, not only decisions made before or after service. It also restricts plans from reopening an already-approved inpatient admission except for obvious error or fraud, and it codifies a requirement that plans notify the treating provider of a coverage decision, not just the enrollee.
“A mid-service adverse decision, the kind that happens while a member is still in a skilled nursing facility or inpatient rehabilitation stay, now carries the same appeal rights as a pre-service denial.”
Read on its own, this is a procedural fix to a real gap in how Medicare Advantage appeal rights applied to concurrent care decisions. Read against the rest of CMS’s own rulemaking record, it is only half the story.
The same contract year 2026 final rule record shows CMS explicitly declined to finalize a proposed AI guardrails provision for utilization management. Nine days after the July 6 guidance took effect, a bipartisan pair of senators moved directly into that space.
Between CMS’s Medicare Advantage appeals guidance taking effect (July 6, 2026) and the Senate’s AI-disclosure letters landing at UnitedHealthcare, Humana, and CVS Health (July 14, 2026).
CMS strengthened appeal rights and explicitly walked away from AI guardrails, in the same rule.
The contract year 2026 final rule fact sheet lists three proposals CMS considered and declined to finalize: a Part D anti-obesity medication coverage expansion, an annual health equity analysis requirement for utilization management, and a provision titled “Ensuring Equitable Access to Medicare Advantage Services, Guardrails for Artificial Intelligence.”
CMS did not rule the subject out. It named AI guardrails as a proposal it considered and chose not to adopt in this rulemaking cycle, distinct from a rule that never contemplated the question at all.
That distinction matters because Congress had already been asking a version of this question. In October 2024, the Senate Permanent Subcommittee on Investigations released a 54-page majority staff report on UnitedHealthcare, Humana, and CVS Health, built from more than 280,000 pages of company documents, finding that predictive technology was used to flag and deny post-acute coverage requests at rates far higher than for other care types.
The July 2026 letters are not a fresh inquiry. They are the same bipartisan investigation, 21 months later, walking directly into the space CMS’s own rulemaking record shows it chose not to fill.
Nine days after CMS’s guidance took effect, the Senate asked the question CMS didn’t answer.
On July 14, 2026, Senators Richard Blumenthal (D-CT) and Josh Hawley (R-MO), working through the Senate Homeland Security and Governmental Affairs Committee (HSGAC), sent letters to UnitedHealthcare, Humana, and CVS Health. The senators grounded the letters directly in two HHS Office of Inspector General evaluations published June 8, 2026, which found that Medicare Advantage organizations overturned 95 percent of appealed skilled nursing facility denials, with contractor naviHealth processing half of all such requests and being overturned 97 percent of the time on appeal.
PCOOB Weekly covered those OIG findings in depth on August 6, 2026. The senators’ letters treat the overturn data as evidence that insurer claims of reduced prior authorization burden do not hold up, and they set a hard deadline for a response.
A complete inventory of algorithms, software, and AI tools
Used to determine medical necessity, payment, or authorization for post-acute care.
Confirmation of company policy on AI and final denials
Whether it remains policy that a final Medicare Advantage denial cannot be issued by AI alone.
Records on how post-acute coverage decisions are made
Documentation of the decision process, not just the outcome data already public via OIG.
A response by July 28, 2026
A hard deadline. Public responses were not confirmed as of this writing; PCOOB Weekly is tracking for a follow-on.
Two branches, one open gap
The regulatory and legislative story here are usually told separately, because they come from different institutions moving on different clocks. Read together, they describe one seam. CMS strengthened the enrollee’s right to appeal a coverage decision made during an active episode of care. In the same rulemaking cycle, it explicitly declined to set a federal standard for the AI and predictive tools that increasingly produce those decisions in the first place. The appeal right got wider. The technology behind the decision it protects got no clearer federal definition.
Congress did not wait for CMS to revisit that provision. Nine days after the July 6 guidance took effect, the Senate Homeland Security and Governmental Affairs Committee sent a document and inventory request to the three largest Medicare Advantage insurers, asking for exactly the kind of disclosure a finalized AI guardrails rule might eventually have required. The senators used OIG’s June 2026 post-acute denial data as their evidentiary anchor, not a fresh set of findings. That choice signals a committee working from a fact base CMS itself has already validated through its own program integrity apparatus, not a speculative inquiry.
For compliance, appeals, and IT governance leaders, the practical consequence is that two accountability channels are now open on the same underlying question, and they carry different obligations. CMS’s channel is procedural: appeal rights, notice requirements, and reopening restrictions, enforceable through program audits and Organization Determinations, Appeals, and Grievances (ODAG) fieldwork over time. Congress’s channel is immediate and disclosure-based: a specific inventory request with a hard deadline. A plan that has updated its appeals workflows for CMS-4208-F has satisfied the first channel. It has not necessarily satisfied the second, and the second channel is currently the more active one.
This also reframes what “compliance” means for AI in Medicare Advantage today. In the absence of a finalized federal rule, the practical standard a plan is being measured against is whatever a congressional committee decides to ask, grounded in whatever OIG has already published. That is an unstable basis for a permanent compliance program, but it is the real one until CMS’s next rulemaking cycle revisits the guardrails provision it named and declined.
Key Insight
CMS did not fail to consider AI guardrails. It considered them and chose not to finalize them, in the same rule that expanded appeal rights around AI-influenced decisions. That is a specific, documented choice, not an oversight.
The Continuity Rule
The July 2026 Senate letters are not a new investigation. They extend an October 2024 Senate Permanent Subcommittee on Investigations report on the same three insurers. Treat this as an ongoing bipartisan inquiry, not a one-time event.
The Practical Standard
Until CMS finalizes an AI guardrails rule, the working federal standard for Medicare Advantage AI governance is effectively whatever a congressional oversight committee asks, grounded in whatever OIG has already published.
“CMS closed the loophole it was willing to close and left open the one it was not. Congress did not wait to see whether that second gap would stay open on its own.”
Why this matters
CMS-4208-F’s appeals provisions and the Senate’s AI oversight letters are not a single-function compliance issue. They move across six areas of plan governance with distinct implications for each.
CMS will not finish this rule soon. Congress is not waiting.
The practical implication for Medicare Advantage compliance, appeals, and IT governance teams is that a federal AI standard for utilization management is not imminent, while congressional scrutiny of exactly that question is active and immediate. Plans cannot treat CMS-4208-F compliance as the finish line on this issue.
That is not a reason to wait for clarity. It is a reason to build now, using the Senate’s own three questions as the working specification for what a defensible internal standard should already answer.
Who owns the response
| Function | Required response | Evidence to retain |
|---|---|---|
| Appeals & Grievances / ODAG | Map every UM decision point that occurs concurrent with service and confirm organization-determination and appeal-rights triggers fire correctly | Updated appeals workflow documentation, notice templates |
| Compliance | Confirm the July 6, 2026 guidance has been operationalized in policy and staff training; monitor for CMS’s next AI-related rulemaking cycle | Policy revision log, training records, CMS guidance tracking log |
| IT / Data Governance | Build and maintain a complete inventory of predictive and AI-assisted tools used in coverage determinations, internal and delegated | AI/algorithm inventory, vendor technology attestations |
| Legal / Regulatory Affairs | Prepare a current, defensible answer to whether AI issues final MA denials, and confirm it matches system configuration | Legal policy memo, system configuration documentation |
| Delegation Oversight / Vendor Management | Extend the AI inventory requirement to every FDR performing utilization management functions | FDR contract addenda, vendor AI disclosures |
What health plans should do now
Within 7 days
- Confirm your compliance and appeals teams have reviewed the July 6, 2026 Parts C & D guidance update and identified every workflow change required by CMS-4208-F’s concurrent-decision and provider-notice provisions.
- Identify whether your organization, or any FDR you delegate post-acute or concurrent UM to, could currently answer the Senate’s three core questions if asked.
Within 30 days
- Build or update a single, audit-ready inventory of every predictive or AI-assisted tool involved in coverage determinations, across internal systems and delegated vendors, mapped to which decision type each tool informs versus finally determines.
- Confirm dual notice, to both the enrollee and the treating provider, is actually firing in system testing for concurrent organization determinations, not just documented in policy.
Within 60 to 90 days
- Document a current, compliance-committee-reviewed position on whether AI can issue a final adverse Medicare Advantage determination, and reconcile that position with actual system configuration.
- Prepare for the likelihood that CMS revisits the AI guardrails provision it declined to finalize in CMS-4208-F, given the congressional attention now focused on the same question.
Questions leaders should ask now
- 1. CMS — Contract Year 2026 Policy and Technical Changes to the Medicare Advantage Program (CMS-4208-F) Final Rule Fact Sheet
- 2. CMS — Parts C & D Enrollee Grievances, Organization/Coverage Determinations, and Appeals Guidance
- 3. U.S. Senate HSGAC — Letter to Humana President and CEO Jim Rechtin, July 14, 2026
- 4. Sen. Richard Blumenthal — Blumenthal and Hawley Press Medicare Advantage Insurers About Refusal of Care for Vulnerable Seniors
- 5. HHS OIG — Medicare Advantage Organizations Overturned Nearly All Appealed Prior Authorization Denials for SNF Admission (OEI-09-24-00331), June 8, 2026
- 6. HHS OIG — The Three Largest Medicare Advantage Organizations Denied Requests for LTACH and IRF at Some of the Highest Rates (OEI-09-24-00330), June 8, 2026
- 7. Sen. Richard Blumenthal — Senate Permanent Subcommittee on Investigations Releases Majority Staff Report Exposing Medicare Advantage Insurers’ Refusal of Care for Vulnerable Seniors, October 2024
- 8. Becker’s Payer Issues — Senators Press UnitedHealth, Humana, CVS on AI-Driven Medicare Advantage Coverage Decisions
Common questions about this edition
What did CMS’s July 6, 2026 guidance change for Medicare Advantage appeals?
It operationalized CMS-4208-F’s provisions extending the definition of organization determination to plan decisions made concurrent with an enrollee’s receipt of care, meaning appeal and notice rights now apply regardless of whether a coverage decision happens before, during, or after service. It also restricts MA plans from reopening an approved inpatient admission except for obvious error or fraud.
Did CMS regulate AI use in Medicare Advantage coverage decisions in this rule?
No. CMS explicitly declined to finalize a proposed AI guardrails provision, Ensuring Equitable Access to Medicare Advantage Services, Guardrails for Artificial Intelligence, in the same CY2026 final rule that strengthened appeal rights, leaving algorithmic utilization management without a dedicated federal standard.
What did the Senate letters to UnitedHealthcare, Humana, and CVS Health ask for?
Senators Richard Blumenthal and Josh Hawley requested records on how each insurer makes post-acute care coverage decisions, including any use of algorithms or AI, confirmation of whether company policy still bars AI from issuing final denials, and a full inventory of predictive technologies used, with responses due July 28, 2026.
Is this the first congressional inquiry into AI use in Medicare Advantage denials?
No. The Senate Permanent Subcommittee on Investigations released a 54-page majority staff report in October 2024, based on more than 280,000 pages of company documents, finding that the same three insurers used predictive technology to flag and deny post-acute coverage requests at elevated rates.
Does this affect plans that delegate utilization management to a contractor?
Yes. The organization-determination and appeal-rights obligations in CMS-4208-F apply regardless of which entity makes the underlying decision, and the AI-inventory question extends logically to any first-tier, downstream, or related entity performing utilization management on the plan’s behalf.