Medicare's AI pilot lets software approve requests alone. A refusal needs a clinician, on the path where vendors can earn.
Since January, prior authorization for some services in traditional Medicare in six states has run through a pilot called WISeR. Prior authorization means asking permission before certain treatments, so a provider knows in advance that Medicare will pay. Private companies review the requests with the help of AI, and CMS, the agency that runs Medicare, set one asymmetric rule for how they may do it. Before a company issues a non-affirmation, it must have a clinician carry out a medical review. CMS's own application document says the requirement does not apply to affirmations.
A non-affirmation is not a refusal of treatment. CMS says it does not stop the provider delivering the service, the request can be resubmitted as often as needed, and a claim can still be filed. If the Medicare Administrative Contractor then denies that claim, the denial is an initial payment determination that carries the usual appeal rights. What a non-affirmation can bring is delay and financial uncertainty for patient and provider. A provisional affirmation lets the provider expect payment, so long as coverage and documentation requirements are met and the claim is billed correctly.
The rule decides which mistakes get a person in front of them. A wrongful non-affirmation can delay care or shift cost onto a patient, so every one passes a clinician first. A wrongful affirmation can also do harm, through unnecessary treatment as well as spending, and CMS does not require a clinician on each of those. That is a choice about which protection comes per decision.
The money runs along the same split. CMS's payment methodology pays a participant for qualifying non-affirmations, valued against a regional benchmark of Medicare spending, and for qualifying denials in pre-payment review, valued against the spending averted. A non-affirmation qualifies only if the request failed coverage criteria and was not overturned by appeal or by a resubmission within 120 days, and a successful appeal brings withholding or recoupment. An affirmation earns nothing.
Payment is multiplied by a quality score, which the current Participant Guide sets at 100, 95 or 90 per cent depending on how the participant scored. CMS can also impose a corrective action plan, withhold payment, refuse it, or remove a participant from the model. None of that makes a vendor's motives visible, and I am not claiming to see them. What the design does is put the one review required on every decision onto the path that can generate revenue.
Affirmations are not left unchecked. A specification CMS published in August describes an accuracy audit that samples affirmations, non-affirmations, pre-payment approvals and pre-payment denials as separate categories, up to 30 cases in each, covering about a quarter of the services each period. So approvals get a periodic sample where refusals get a review every time. Through the third performance period accuracy was scored on a pay-for-reporting basis, meaning participants were credited for reporting it. From the fourth it counts toward payment.
The Electronic Frontier Foundation obtained about a thousand pages of CMS records through a freedom-of-information lawsuit and published them on 8 September. Two vendors issued 5,944 non-affirmations in the first three months, and one of them, Virtix, issued more non-affirmations than affirmations. CMS separately put Virtix on a corrective action plan. The grounds a member of Congress published in June were missed 72-hour turnaround times, portal problems and poor responsiveness, rather than the accuracy of its decisions.
A month before launch, another vendor, Innovaccer, told CMS it planned to affirm every request automatically until its software was ready, because CMS would not delay the start. That records a plan. The documents I have read do not show whether it was carried out or for how long.
The material here does not establish what the clinician review contributes. An override rate cannot settle it, since a low rate fits accurate recommendations and rubber-stamping equally, as When the checkpoint stops carrying information argued. Settling it needs three things kept for every sampled case. The AI's initial recommendation, the clinician's final decision, and an independent judgement of the right answer, across upheld and overturned recommendations alike. Set side by side, they count the errors the review corrects and the errors it introduces, because a review can fix some mistakes while creating others.
The Netherlands ran a similar split during the pandemic. In its fixed-costs grant scheme a risk model approved low-risk applications automatically, while higher-risk ones went to officials who could approve or refuse, and adjustments to the model went to the ministry. Nobody in that arrangement was paid out of refusals. The Algemene Rekenkamer found in 2022 that its IT management fell short. As a comparison it cannot isolate the effect of money, because the population, the eligibility rules and what a refusal cost the applicant were all different. It shows the same authority split can exist without payment on the refusing side.
The payment design is why that evidence matters more here than in most places. When a required review sits on the side that can earn, a clinician's signature still shows accountability and that someone took part. It cannot show that the review improved the decision. CMS's audits of final determinations across every decision type are a real starting point. Keeping the AI's initial recommendation, linking it to the reviewer's decision and arranging an independent assessment would be further capabilities on top of them, and the Participant Guide I read does not say the first of those exists.
CMS requires a clinician to review every refusal and surrounds that review with audits, resubmissions, appeals and payment penalties. What would let anyone outside judge the design is a published measure of what the review adds on the path that pays, and nothing I found publishes one.
Sources
- Centers for Medicare & Medicaid Services, WISeR Model Request for Applications, section 6.
- Centers for Medicare & Medicaid Services, WISeR Model Frequently Asked Questions.
- Centers for Medicare & Medicaid Services, WISeR Model Payment Methodology.
- Centers for Medicare & Medicaid Services, WISeR Participant Guide, version 4.0, 1 May 2026, pages 6, 15, 17 and Table 3.
- Centers for Medicare & Medicaid Services, WISeR performance measure technical specifications, 13 August 2026.
- Electronic Frontier Foundation, New Records Reveal Problems with Medicare's AI Prior Authorization Experiment, 8 September 2026, and the records released in EFF v. CMS.
- Office of Representative Suzan DelBene, release on the Virtix Health corrective action plan, 25 June 2026.
- Algemene Rekenkamer, Algoritmes getoetst, 18 May 2022, pages 15 to 17 and 21 to 22.
The CMS documents are primary and describe the design as written, not how it operated. The figures on non-affirmations come from EFF's reading of CMS status reports, and the Virtix grounds come from a congressional release summarising CMS's letter, not the letter itself. Nothing here establishes how WISeR's clinicians conducted their reviews or whether the AI's recommendations are recorded separately in practice. The Dutch scheme is a 2022 audit of a rules-based model in a programme that has ended. The prose was drafted with AI assistance. The research, verification and editorial decisions are the author's.