Regulon.AI — IA-SSB-3118 · IA SSB 3118 (Utilization Review AI & Prior Authorization)

Summary

This bill regulates utilization review organizations (UROs) and health carriers in Iowa across three divisions. Division I prohibits UROs from using AI-based algorithms as the sole basis for denying, delaying, or downgrading prior authorization requests based on medical necessity, and requires that all denial or downgrade decisions be made by a qualified reviewer (physician) or clinical peer who practices in the same or similar specialty as the requesting provider. Division II prohibits health carriers from requiring prior authorization for cancer-related screenings or preventative services recommended under NCCN clinical practice guidelines. Division III establishes procedural requirements for prepayment audits conducted by UROs, including notification deadlines, completion timelines, and appeal rights, with automatic claim approval as a remedy for noncompliance. The Commissioner of Insurance has enforcement authority. All three divisions apply to requests or audits initiated on or after January 1, 2027.

Enforcement & Penalties

Enforcement Authority

Commissioner of Insurance has enforcement authority. Division I and Division II grant permissive rulemaking authority to the commissioner; Division III mandates the commissioner to adopt rules to administer and enforce its provisions. No private right of action is created. Enforcement is agency-initiated through the Iowa Insurance Division.

Penalties

Division III provides that if a utilization review organization violates the prepayment audit requirements, the claim shall be automatically approved and promptly paid pursuant to section 507B.4A, subsection 2 (Iowa's prompt payment of claims statute, which includes interest). No other monetary penalties or damages are specified in the bill text.

Who Is Covered

Compliance Obligations 6 obligations · click obligation ID to open requirement page

HC-01 Healthcare AI Decision Restrictions · HC-01.1 · Deployer · Healthcare

Iowa Code § 514F.8, subsection 2A (new)

Plain Language

Utilization review organizations may use AI-based algorithms for initial review of prior authorization requests. However, when a prior authorization request is based on medical necessity, the URO may not rely on an AI algorithm as the sole basis for denying, delaying, or downgrading the request. This means a human reviewer must be involved in any adverse determination on medical necessity grounds — the AI can screen and triage, but cannot make the final adverse call alone.

Statutory Text

2A. A utilization review organization may use an artificial intelligence-based algorithm to provide an initial review of a request for prior authorization, except that, for a prior authorization request for a health care service based on medical necessity, a utilization review organization shall not use an artificial intelligence-based algorithm as the sole basis for the utilization review organization's decision to deny, delay, or downgrade the prior authorization request.

HC-01 Healthcare AI Decision Restrictions · HC-01.1 HC-01.2 · Deployer · Healthcare

Iowa Code § 514F.8A(2) (new)

Plain Language

A URO may not deny or downgrade a prior authorization request unless all of the following occur: (1) the decision is made by a qualified reviewer (if the requesting provider is a physician) or a clinical peer (if the requesting provider is not a physician) — both must practice in the same or similar specialty; (2) the URO provides the requesting provider a signed written statement citing the specific reasons for the denial or downgrade, including the coverage or clinical criteria relied upon; (3) the URO provides both the requesting provider and the covered person a written explanation of the appeals process; and (4) the URO provides a written attestation identifying the reviewer by name, NPI, board certifications, specialty expertise, and educational background, and attesting to their qualifications to review the specific medical condition at issue. The reviewer type is keyed to the requesting provider type — physician requests require physician reviewers, non-physician requests require clinical peers.

Statutory Text

2. A utilization review organization shall not deny or downgrade a request for prior authorization unless all of the following requirements are met: a. The decision to deny or downgrade the request is made by either of the following: (1) A qualified reviewer, if the health care provider requesting prior authorization is a physician. (2) A clinical peer, if the health care provider requesting prior authorization is not a physician. b. The utilization review organization provides the health care provider that requested the prior authorization all of the following: (1) A written statement that cites the specific reasons for the denial or downgrade, including any coverage criteria or limits, or clinical criteria, that the utilization review organization considered or that was the basis for the denial or downgrade. The written statement shall be signed by either of the following: (a) The qualified reviewer that made the denial or downgrade determination, if the health care provider that requested prior authorization is a physician. (b) The clinical peer that made the denial or downgrade determination, if the health care provider that requested prior authorization is not a physician. (2) A written explanation of the utilization review organization's appeals process. The utilization review organization shall also provide the written explanation to the covered person for whom prior authorization was requested. (3) A written attestation that is either of the following: (a) If the health care provider that requested prior authorization is a physician, a written attestation that the qualified reviewer who made the denial or downgrade determination practices in the same or a similar specialty as the health care provider, and has the requisite training and expertise to treat the medical condition that is the subject of the request for prior authorization, including sufficient knowledge to determine whether the health care service is medically necessary or clinically appropriate. The attestation shall include the qualified reviewer's name, national provider identifier, board certifications, specialty expertise, and educational background. (b) If the health care provider that requested prior authorization is not a physician, a written attestation that the clinical peer who made the denial or downgrade determination practices in the same or a similar specialty as the health care provider, and the clinical peer has experience managing the specific medical condition or administering the health care service that is the subject of the request for prior authorization. The attestation shall include the clinical peer's name, national provider identifier, board certifications, specialty expertise, and educational background.

HC-01 Healthcare AI Decision Restrictions · HC-01.2 · Deployer · Healthcare

Iowa Code § 514F.8A(3) (new)

Plain Language

When a URO denies a prior authorization request, it must arrange a consultation — in person or remote — between the requesting provider and the appropriate reviewer (qualified reviewer for physician requestors, clinical peer for non-physician requestors) within seven business days of notifying the provider of the denial. This is a mandatory post-denial peer-to-peer review opportunity that allows the requesting provider to discuss the clinical basis for the denial directly with the reviewer.

Statutory Text

3. A utilization review organization that denies a request for prior authorization shall, no later than seven business days after the date that the utilization review organization notifies the requesting health care provider of the denial, conduct a consultation either in person or remotely, as follows: a. Between the health care provider and a qualified reviewer, if the health care provider requesting prior authorization is a physician. b. Between the health care provider and a clinical peer, if the health care provider requesting prior authorization is not a physician.

H-01 Human Oversight of Automated Decisions · H-01.4 H-01.5 · Deployer · Healthcare

Iowa Code § 514F.8A(4) (new)

Plain Language

When a provider or covered person appeals a prior authorization denial or downgrade, the appeal must be conducted by a qualified reviewer or clinical peer (matched to the requesting provider type) who was not involved in the initial adverse determination. The appeal reviewer must consider the known clinical aspects of the services under review, including the covered person's relevant medical records and any medical literature the provider submits. This creates a substantive, individualized review obligation — not merely a procedural rubber stamp — and ensures independence from the initial decision-maker.

Statutory Text

4. a. If a utilization review organization's decision to deny or downgrade a request for prior authorization is appealed by the requesting health care provider or covered person, the appeal shall be conducted by either of the following: (1) A qualified reviewer, if the health care provider requesting prior authorization is a physician. (2) A clinical peer, if the health care provider requesting prior authorization is not a physician. b. A qualified reviewer or clinical peer involved in the initial denial or downgrade determination of a request for prior authorization that is the subject of an appeal shall not conduct the appeal. c. When conducting an appeal of a request for prior authorization, the qualified reviewer or clinical peer shall consider the known clinical aspects of the health care services under review, including but not limited to medical records relevant to the covered person's medical condition that is the subject of the health care services for which prior authorization is requested, and any relevant medical literature submitted by the health care provider as part of the appeal.

Other · Healthcare

Iowa Code § 514F.8B(2) (new)

Plain Language

Health carriers are prohibited from requiring prior authorization — or imposing any additional utilization review requirements — for cancer-related screenings or cancer-related preventative health care services when the service is recommended by the covered person's health care professional in accordance with the most recently updated NCCN clinical practice guidelines in oncology. This is a categorical exemption from prior authorization for guideline-concordant cancer screening and prevention, not an AI-specific obligation.

Statutory Text

2. A health carrier shall not require prior authorization for, or impose additional utilization review requirements on, a covered person for a cancer-related screening or cancer-related preventative health care service if the screening or service is recommended by the covered person's health care professional based on the most recently updated national comprehensive cancer network clinical practice guidelines in oncology.

Other · Healthcare

Iowa Code § 514F.10(2)-(6) (new)

Plain Language

UROs conducting prepayment audits must: (1) notify the provider within 15 calendar days of the carrier selecting the claim for audit; (2) complete the audit and issue a determination within 45 calendar days of receiving all requested documentation; (3) allow the provider to appeal an adverse determination within 30 calendar days; and (4) issue a final determination on appeal within 14 calendar days. If the URO violates any of these requirements, the claim is automatically approved and must be promptly paid with interest under Iowa's prompt payment statute. These are insurance claims processing requirements, not AI-specific obligations.

Statutory Text

2. A utilization review organization that conducts a prepayment audit shall notify the health care provider that submitted the claim of the initiation of the prepayment audit no later than fifteen calendar days after the date the health carrier selects the claim for prepayment audit. 3. A utilization review organization shall complete a prepayment audit of a claim and issue a determination on the claim to the health care provider that submitted the claim no later than forty-five calendar days after the date that the utilization review organization receives all requested documentation regarding the claim from the health care provider. 4. A health care provider that submitted a claim that is the subject of a prepayment audit by a utilization review organization, and that receives an adverse determination regarding the claim, may appeal the adverse determination no later than thirty calendar days after the date the health care provider receives the prepayment audit determination. 5. A utilization review organization shall consider an appeal under subsection 4, and issue a final determination on the claim that is the subject of the appeal, no later than fourteen calendar days after that date the utilization review organization receives notice of the appeal. 6. If a utilization review organization violates this section, the claim shall be automatically approved by the utilization review organization and promptly paid pursuant to section 507B.4A, subsection 2.