Regulon — IA-SSB-3118 · IA SSB 3118 (Utilization Review AI & Prior Authorization)

Summary

Iowa SSB 3118 regulates the use of artificial intelligence by utilization review organizations (UROs) in prior authorization decisions and establishes new peer review requirements. Division I prohibits UROs from using AI-based algorithms as the sole basis for denying, delaying, or downgrading prior authorization requests based on medical necessity, and requires that denial or downgrade decisions be made by a qualified reviewer (physician) or clinical peer with matching specialty expertise. Division II exempts cancer-related screenings and preventative services from prior authorization requirements when recommended by a health care professional based on NCCN clinical practice guidelines. Division III establishes procedural requirements for prepayment audits, including notification timelines, completion deadlines, appeal rights, and automatic claim approval for violations. The Commissioner of Insurance has rulemaking authority to administer and enforce all three divisions. The bill applies to requests and audits on or after January 1, 2027.

Enforcement & Penalties

Enforcement Authority

The Commissioner of Insurance has authority to adopt rules to administer and enforce the provisions. Division I and Division II grant permissive rulemaking authority; Division III mandates rulemaking. No private right of action is created. Enforcement is agency-initiated through the Commissioner of Insurance's existing regulatory authority over utilization review organizations and health carriers.

Penalties

No specific monetary penalties or damages provisions are specified in the bill. Division III provides that if a utilization review organization violates the prepayment audit requirements, the claim shall be automatically approved and promptly paid pursuant to section 507B.4A, subsection 2 (which governs prompt payment of claims including interest). This automatic claim approval serves as the primary enforcement remedy.

Who Is Covered

Compliance Obligations 6 obligations · click obligation ID to open requirement page

HC-01 Healthcare AI Decision Restrictions · HC-01.1 · Deployer · Healthcare

Iowa Code § 514F.8, subsection 2A (new)

Plain Language

Utilization review organizations may use AI-based algorithms for initial review of prior authorization requests. However, when the request involves a health care service based on medical necessity, the URO may not rely on an AI algorithm as the sole basis for denying, delaying, or downgrading the request. This means a human reviewer must independently evaluate and make or affirm any adverse determination on medical necessity grounds — the AI output alone is insufficient. This effectively permits AI as a triage or screening tool but requires human decision-making for adverse outcomes.

Statutory Text

2A. A utilization review organization may use an artificial intelligence-based algorithm to provide an initial review of a request for prior authorization, except that, for a prior authorization request for a health care service based on medical necessity, a utilization review organization shall not use an artificial intelligence-based algorithm as the sole basis for the utilization review organization's decision to deny, delay, or downgrade the prior authorization request.

HC-01 Healthcare AI Decision Restrictions · HC-01.1 HC-01.2 · Deployer · Healthcare

Iowa Code § 514F.8A(2) (new)

Plain Language

A URO may not deny or downgrade a prior authorization request unless: (1) the decision is made by a qualified reviewer (if the requesting provider is a physician) or a clinical peer (if the requesting provider is not a physician) — both of whom must practice in the same or similar specialty; (2) the URO provides the requesting provider a signed written statement citing the specific reasons for the denial or downgrade, a written explanation of the appeals process (which must also be provided to the covered person), and a written attestation confirming the reviewer's specialty match, credentials, and qualifications including name, NPI, board certifications, specialty expertise, and educational background. This creates a comprehensive peer review and documentation requirement that ensures all adverse prior authorization decisions are made by appropriately credentialed human professionals and fully explained to providers and patients.

Statutory Text

2. A utilization review organization shall not deny or downgrade a request for prior authorization unless all of the following requirements are met: a. The decision to deny or downgrade the request is made by either of the following: (1) A qualified reviewer, if the health care provider requesting prior authorization is a physician. (2) A clinical peer, if the health care provider requesting prior authorization is not a physician. b. The utilization review organization provides the health care provider that requested the prior authorization all of the following: (1) A written statement that cites the specific reasons for the denial or downgrade, including any coverage criteria or limits, or clinical criteria, that the utilization review organization considered or that was the basis for the denial or downgrade. The written statement shall be signed by either of the following: (a) The qualified reviewer that made the denial or downgrade determination, if the health care provider that requested prior authorization is a physician. (b) The clinical peer that made the denial or downgrade determination, if the health care provider that requested prior authorization is not a physician. (2) A written explanation of the utilization review organization's appeals process. The utilization review organization shall also provide the written explanation to the covered person for whom prior authorization was requested. (3) A written attestation that is either of the following: (a) If the health care provider that requested prior authorization is a physician, a written attestation that the qualified reviewer who made the denial or downgrade determination practices in the same or a similar specialty as the health care provider, and has the requisite training and expertise to treat the medical condition that is the subject of the request for prior authorization, including sufficient knowledge to determine whether the health care service is medically necessary or clinically appropriate. The attestation shall include the qualified reviewer's name, national provider identifier, board certifications, specialty expertise, and educational background. (b) If the health care provider that requested prior authorization is not a physician, a written attestation that the clinical peer who made the denial or downgrade determination practices in the same or a similar specialty as the health care provider, and the clinical peer has experience managing the specific medical condition or administering the health care service that is the subject of the request for prior authorization. The attestation shall include the clinical peer's name, national provider identifier, board certifications, specialty expertise, and educational background.

HC-01 Healthcare AI Decision Restrictions · HC-01.1 HC-01.6 · Deployer · Healthcare

Iowa Code § 514F.8A(3) (new)

Plain Language

When a URO denies a prior authorization request, it must arrange a consultation between the requesting health care provider and the appropriate reviewer (qualified reviewer for physician providers, clinical peer for non-physician providers) within seven business days of notifying the provider of the denial. The consultation may be in person or remote. This creates a mandatory post-denial peer-to-peer review opportunity — unlike the initial decision requirements in subsection 2, this is a follow-up consultation that must occur after every denial, giving the requesting provider a direct opportunity to discuss the case with the reviewer.

Statutory Text

3. A utilization review organization that denies a request for prior authorization shall, no later than seven business days after the date that the utilization review organization notifies the requesting health care provider of the denial, conduct a consultation either in person or remotely, as follows: a. Between the health care provider and a qualified reviewer, if the health care provider requesting prior authorization is a physician. b. Between the health care provider and a clinical peer, if the health care provider requesting prior authorization is not a physician.

HC-01 Healthcare AI Decision Restrictions · HC-01.2 · Deployer · Healthcare

Iowa Code § 514F.8A(4) (new)

Plain Language

When a prior authorization denial or downgrade is appealed by the requesting provider or covered person, the appeal must be conducted by a qualified reviewer (for physician providers) or clinical peer (for non-physician providers) who was not involved in the initial determination. The appellate reviewer must consider the known clinical aspects of the services under review, including medical records relevant to the patient's condition and any medical literature submitted by the provider. This creates a de novo clinical review on appeal with an independent reviewer, ensuring that the appeal is not a rubber stamp of the initial denial.

Statutory Text

4. a. If a utilization review organization's decision to deny or downgrade a request for prior authorization is appealed by the requesting health care provider or covered person, the appeal shall be conducted by either of the following: (1) A qualified reviewer, if the health care provider requesting prior authorization is a physician. (2) A clinical peer, if the health care provider requesting prior authorization is not a physician. b. A qualified reviewer or clinical peer involved in the initial denial or downgrade determination of a request for prior authorization that is the subject of an appeal shall not conduct the appeal. c. When conducting an appeal of a request for prior authorization, the qualified reviewer or clinical peer shall consider the known clinical aspects of the health care services under review, including but not limited to medical records relevant to the covered person's medical condition that is the subject of the health care services for which prior authorization is requested, and any relevant medical literature submitted by the health care provider as part of the appeal.

Other · Healthcare

Iowa Code § 514F.8B(2) (new)

Plain Language

Health carriers may not require prior authorization or impose additional utilization review requirements for cancer-related screenings or preventative health care services that are recommended by the patient's health care professional based on the most recently updated NCCN clinical practice guidelines in oncology. This is a blanket exemption from prior authorization for guideline-concordant cancer screening and prevention — it creates no AI-specific compliance obligation but limits the scope of utilization review that can be applied to these services.

Statutory Text

2. A health carrier shall not require prior authorization for, or impose additional utilization review requirements on, a covered person for a cancer-related screening or cancer-related preventative health care service if the screening or service is recommended by the covered person's health care professional based on the most recently updated national comprehensive cancer network clinical practice guidelines in oncology.

Other · Healthcare

Iowa Code § 514F.10 (new)

Plain Language

UROs conducting prepayment audits must: (1) notify the provider within 15 calendar days of the carrier selecting the claim for audit; (2) complete the audit and issue a determination within 45 calendar days of receiving all requested documentation; (3) allow the provider 30 calendar days to appeal an adverse determination; and (4) issue a final appeal determination within 14 calendar days of receiving notice of appeal. If the URO violates any of these requirements, the claim is automatically approved and must be promptly paid with interest under existing prompt payment law. These are healthcare claims processing procedural requirements that do not create AI-specific compliance obligations.

Statutory Text

2. A utilization review organization that conducts a prepayment audit shall notify the health care provider that submitted the claim of the initiation of the prepayment audit no later than fifteen calendar days after the date the health carrier selects the claim for prepayment audit. 3. A utilization review organization shall complete a prepayment audit of a claim and issue a determination on the claim to the health care provider that submitted the claim no later than forty-five calendar days after the date that the utilization review organization receives all requested documentation regarding the claim from the health care provider. 4. A health care provider that submitted a claim that is the subject of a prepayment audit by a utilization review organization, and that receives an adverse determination regarding the claim, may appeal the adverse determination no later than thirty calendar days after the date the health care provider receives the prepayment audit determination. 5. A utilization review organization shall consider an appeal under subsection 4, and issue a final determination on the claim that is the subject of the appeal, no later than fourteen calendar days after that date the utilization review organization receives notice of the appeal. 6. If a utilization review organization violates this section, the claim shall be automatically approved by the utilization review organization and promptly paid pursuant to section 507B.4A, subsection 2.