When a carrier or its contracted third party uses AI to make utilization review or medical review determinations, those determinations must be based on the individual enrollee's medical history and clinical circumstances as presented by the requesting provider and contained in the enrollee's medical record. AI tools may not supplant provider decision-making — the treating provider's clinical judgment must remain central. This effectively prohibits AI systems from making coverage determinations based solely on aggregate or group-level data without considering individualized clinical information.

Any adverse coverage determination — denial, delay, modification, or adjustment — based on medical necessity must be made by a clinical peer who is competent in the specific clinical area at issue. The clinical peer must consider the treating provider's recommendation and the enrollee's individual medical history and clinical circumstances. This effectively prohibits AI from serving as the sole or final decision-maker for adverse medical necessity determinations — a qualified human clinical professional must make or affirm every such decision.

AI-derived utilization review and medical review determinations must not directly or indirectly discriminate against enrollees on an extensive list of protected characteristics, including race, color, religion, national origin, ancestry, age, sex, gender, gender identity, gender expression, sexual orientation, present or predicted disability, expected length of life, degree of medical dependency, quality of life, or other health conditions. Determinations must also be fairly and equitably applied across all enrollees. The inclusion of 'indirectly' discriminate suggests proxy discrimination and disparate impact are covered, not only intentional discrimination. The protected class list is notably broader than typical employment or civil rights statutes — it includes predicted disability, expected length of life, degree of medical dependency, and quality of life.

AI tools used in utilization review or medical review determinations must be open to inspection — implying regulatory audit access to the AI systems and their decision logic. Additionally, carriers must disclose the use of AI in their written policies and procedures provided to enrollees. This creates two distinct obligations: a transparency-to-regulators obligation (open to inspection) and a transparency-to-enrollees obligation (written disclosure in policies and procedures).

Carriers must establish governance policies for AI used in utilization and medical review that create accountability for the AI's performance, use, and outcomes. These policies must be periodically reviewed and revised to ensure accuracy and reliability — this is an ongoing obligation, not a one-time setup. Additionally, data used in AI-derived determinations may not be repurposed beyond its intended and stated purpose, and must be protected from risks that could directly or indirectly harm the enrollee. This creates three distinct requirements: (1) governance policies with accountability, (2) periodic review and revision for accuracy, and (3) data use limitations and data protection.