Prior authorization is the requirement that a health care provider seek approval of a drug, procedure, or test before receiving reimbursement from a health carrier, health plan, or managed care organization.  Requested drugs, procedures, or tests may be evaluated based on medical necessity, clinical appropriateness, level of care, and effectiveness.  Health plans offered by health carriers and health plans offered to public or school employees, retirees, and their dependents are subject to certain requirements regarding the prior authorization process.

Health carriers and health plans must follow specified timing requirements when making and communicating prior authorization determinations.  They must also describe their prior authorization requirements in detailed, easily understandable language.  The prior authorization requirements must be based on peer-reviewed, evidence-based clinical review criteria which are evaluated and updated at least annually. 

Health carriers and health plans must build and maintain a prior authorization application programming interface (API) that automates the process for determining the necessity for a prior authorization, identifying information and documentation requirements, and facilitating the exchange of prior authorization requests and determinations.  The API must automate the prior authorization determination process, allow providers to query prior authorization documentation requirements, and support automated compiling and exchange of necessary data elements to populate the prior authorization requirements, among other requirements.

Health carriers that offer health plans may not retrospectively deny coverage for care that had prior authorization under the plan's written policies at the time the care was rendered.

Health carriers are required to report certain information relating to prior authorization to the Office of the Insurance Commissioner (Commissioner) on an annual basis. The Commissioner must aggregate and deidentify the data collected into a standard report and make the report available to interested parties.

Prior Authorization Determinations and Policy Changes.

When denying a prior authorization determination, a carrier or health plan is required to include the credentials, board certifications, and areas of specialty of the provider who had clinical oversight over the determination in the denial notification.

Carriers and health plans must post any adjustments to policies and procedures that impact the applicability of their prior authorization requirements in a single location on the carrier's or health plan's website.

After December 30, 2030, a new application of prior authorization for health care services must be available to providers on the electronic prior authorization system or prior authorization API.

Use of Artificial Intelligence.

Only a licensed physician or health professional working within their scope of practice may deny a prior authorization request based on medical necessity.  The licensed physician or health professional must evaluate the specific clinical issues involved in the health care services requested by the requesting provider.  Artificial intelligence (AI) may not be the sole means used to deny, delay, or modify health care services.  Algorithms may be used to process and approve prior authorization requests, but may not be used without human review to deny care based on a determination of medical necessity.

A carrier or health plan that uses, or contracts for the use of, AI for the purpose of prior authorization, based in whole or in part on medical necessity, must ensure that:

• the AI bases its determination, as applicable, on an enrollee's medical or other clinical history, including demographic data, and individual clinical circumstances;
• the AI does not base its determination solely on a group data set;
• the AI's criteria and guidelines comply with these requirements and applicable state and federal law;
• the use of AI does not discriminate against an enrollee in violation of state or federal law;
• the AI is fairly and equitably applied, including in accordance with any applicable regulations and guidance issued by the federal Department of Health and Human Services;
• the policies and procedures for using AI are open to audit by the Commissioner;
• the AI's performance, use, and outcomes are periodically reviewed to maximize accuracy and reliability; and
• patient data is not used beyond its intended and stated purpose, consistent with state and federal privacy laws.

Requirements regarding prior authorization APIs are modified to require that such APIs are consistent with final rules issued by the federal Centers for Medicare and Medicaid Services.

Requirements regarding prior authorization determinations and functions apply to contracted health care benefit managers.

Carrier Retrospective Denials.

A carrier may not retrospectively deny coverage, or modify to a service less intensive than that included in the original request, for care that had prior authorization, including for medical necessity, unless the prior authorization was based on a material representation or the underlying health plan coverage is lawfully rescinded, canceled, or terminated retrospectively through the date of service.

Retrospective denials or modifications to a less intensive service due to a change in a carrier's determination of medical necessity are prohibited, may not be considered adverse benefit determinations, and are not required to follow standard appeal processes or carrier policies related to their own grievance and appeals process.  If an enrollee or the provider requesting the original authorization demonstrates the authorization was valid per the plan's written policies, then the carrier must deem the authorization approved and payable.  Interest must be assessed on the associated claim at the rate of 1 percent per month, retroactive to the date of service.

Reporting.

Beginning January 1, 2027, carriers that are required to report to the Commissioner annually must also provide information regarding the total number of prior authorization requests, approvals, and denials.  Carriers must report these totals separately for approvals or denials made by the carrier directly and for approvals or denials made by a health care benefit manager.  Carriers must also indicate the percentage of total denials that were aided by AI tools, the percent of prior authorization determinations made after the required turnaround times, and the total number of nonelectronic standard and nonelectronic expedited prior authorization requests.

Annual reports by the Commissioner regarding carrier data must contain trend data for total authorization requests, approvals, and denials by carriers and health care benefit managers.