Utilization review agents are categorically prohibited from using any automated decision system — including AI-based algorithms — to make adverse determinations in whole or in part. This means no algorithm or AI tool may serve as even a partial basis for denying, delaying, modifying, or concluding that health care services are not medically necessary, not appropriate, or experimental/investigational. The prohibition goes beyond HC-01.1's typical requirement that a human must independently affirm adverse determinations; here, automated systems may not participate in the adverse determination at all. Automated systems remain permissible for administrative support and fraud-detection functions. Applies only to utilization review conducted for health benefit plans delivered, issued, or renewed on or after January 1, 2026.

The Commissioner of Insurance has unrestricted authority to audit and inspect a utilization review agent's use of any automated decision system in the utilization review process at any time — no advance notice, scheduled cadence, or triggering event is required. This means utilization review agents must maintain their automated decision systems and associated documentation in a state of audit readiness at all times. Note that while § 4201.156(a) prohibits automated systems from making adverse determinations, this audit provision covers the use of automated systems in utilization review generally, including permissible uses such as administrative support and fraud detection.

When issuing an adverse determination, the utilization review agent must provide notice to the enrollee that includes: (1) the principal reasons for the adverse determination, (2) the clinical basis, (3) both a description of and the source of the screening criteria and review procedures used (the amendment changes 'or' to 'and,' requiring both elements), and (4) the complaint and appeal process including the right to independent review. The bill's amendment to subdivision (3) requires that adverse determination notices now include both a description and the source of screening criteria and review procedures — previously, either a description or the source was sufficient. The addition of 'review procedures' alongside 'screening criteria' means that if any automated tools or processes were used in the review (for permissible purposes), those procedures must be described.