Inside the Approval Machine: Who Is Actually Deciding Whether Your Treatment Gets Authorized — and Why They May Not Be Who You Think

Every year, American physicians submit hundreds of millions of prior authorization requests to health insurers — requests for approval to provide a treatment, fill a prescription, or order a diagnostic test that the insurer requires pre-approval before covering. Patients waiting for these decisions often imagine a physician on the other end of the process: someone who has reviewed their file, considered their history, and made a reasoned clinical judgment.

That image is increasingly disconnected from reality.

The prior authorization system is staffed, in significant part, by clinical reviewers who are not physicians, operating under criteria they did not write, evaluated by metrics that reward speed and denial rates, and in some cases replaced or supplemented entirely by automated decision systems that have never encountered a human patient. Understanding who these decision-makers are — and what governs their choices — is essential for any patient seeking to navigate a denial effectively.

The Reviewer Behind the Denial Letter

At most large commercial insurers, the first human being to assess a prior authorization request is a utilization review nurse. These are licensed registered nurses or, in some cases, licensed practical nurses, employed by the insurer or by a third-party utilization management company contracted to handle review volume.

Their role is not to exercise independent clinical judgment. It is to apply InterQual, MCG (formerly Milliman Care Guidelines), or a proprietary equivalent — commercial criteria sets that translate clinical evidence into decision trees. A reviewer working from these tools assesses whether the submitted documentation meets the specific criteria for approval. If it does, the request is approved. If it does not, the request is flagged for physician review or issued a denial.

This is not inherently problematic. Standardized clinical criteria, when evidence-based and properly applied, can support consistent, defensible coverage decisions. The concern arises in how these criteria are maintained, who updates them, and what happens when a patient's clinical reality does not fit neatly into a decision tree.

Criteria sets are updated periodically, but the update cycles do not always track the pace of clinical evidence. A treatment that has become standard of care in a particular specialty may not yet appear as an approved indication in the criteria set an insurer has licensed. The reviewer has no authority to deviate from the criteria, regardless of what the submitted documentation says. The denial that results is technically criteria-compliant — and clinically wrong.

The Algorithm That Never Sees Your Chart

Beyond human reviewers, a growing share of prior authorization decisions — particularly for high-volume, lower-complexity request categories — are processed by automated systems with minimal or no human involvement at any stage.

These systems ingest structured data from the authorization request: diagnosis codes, procedure codes, prescribing provider credentials, and patient demographic information. They compare that data against rule sets and, in more sophisticated implementations, machine learning models trained on historical approval and denial patterns. A decision is generated in seconds.

A 2023 investigation by the U.S. Senate Permanent Subcommittee on Investigations found that UnitedHealth Group's subsidiary NaviHealth used an AI tool called nH Predict to generate post-acute care discharge recommendations for Medicare Advantage patients at a denial rate far exceeding what physicians and care teams considered clinically appropriate. The insurer maintained that the tool was advisory rather than determinative. Internal communications reviewed by investigators suggested the relationship between the tool's output and actual coverage decisions was considerably less advisory than represented.

This case is not an isolated example. It reflects a broader industry trend toward automation in utilization management — a trend driven by cost reduction imperatives and enabled by the absence of federal standards governing how AI tools may be used in coverage determinations.

The Financial Architecture of Denial

Prior authorization reviewers, whether human or algorithmic, do not operate in a values vacuum. They operate within an organizational structure that has financial incentives — and in some cases, explicit performance metrics — tied to authorization outcomes.

Utilization management departments at commercial insurers are cost centers whose performance is measured, in part, by their ability to reduce unnecessary care expenditures. Reviewers are aware of this context. Whether or not they are explicitly evaluated on denial rates — and some former reviewers who have spoken to journalists and congressional investigators have indicated they were — the organizational culture around utilization management communicates clear expectations about what "appropriate" review looks like.

Physician reviewers, who are required by most state laws to conduct any denial based on medical necessity, face their own structural pressures. Employed by the insurer or contracted through a physician review organization, they are not independent practitioners. Their continued engagement depends on their alignment with the insurer's utilization management objectives. The physician who consistently overturns nurse reviewer denials on appeal is not a valued asset in this system.

This does not mean every denial is financially motivated, or that every reviewer acts in bad faith. Many utilization management professionals believe they are providing a legitimate clinical function. The problem is structural: a system in which the entity making coverage decisions has a direct financial interest in the outcome of those decisions cannot be described as neutral, regardless of the good intentions of individual participants.

What Legal Protections Exist — and Where They Fall Short

Federal law requires that prior authorization denials based on medical necessity be reviewed by a physician or other appropriate clinical peer. The Employee Retirement Income Security Act governs most employer-sponsored plans and establishes minimum standards for adverse benefit determinations, including the right to appeal and the right to an external review.

The No Surprises Act, enacted in 2022, added requirements for continuity of care protections when a provider leaves a network mid-treatment. The Consolidated Appropriations Act of 2021 imposed new transparency requirements on pharmacy benefit managers. Legislative proposals including the Improving Seniors' Timely Access to Care Act, which passed the House in 2022 but has not advanced through the Senate as of this writing, would impose real-time prior authorization requirements and increased transparency obligations on Medicare Advantage plans.

Despite this regulatory framework, enforcement is uneven. ERISA's preemption of state insurance law limits the ability of state regulators to impose additional requirements on self-funded employer plans, which cover the majority of privately insured Americans. Patients whose claims are denied often lack the legal and clinical expertise to navigate the appeals process effectively, and the system does not supply that expertise.

How to Fight Back Effectively

Patients who receive a prior authorization denial are not without recourse. The following steps reflect the most effective approaches available under current law.

Request the specific criteria used to deny your request. Insurers are required to provide the clinical criteria underlying a denial. Obtaining this document allows your physician to address the precise gap between your documentation and the insurer's requirements — rather than submitting a general appeal that does not engage the denial's actual basis.

Ensure a physician peer review is conducted. If your denial was issued by a nurse reviewer or automated system, you have the right to request review by a physician with relevant specialty expertise. Make this request explicitly and in writing.

Invoke the external review process. If your internal appeal is unsuccessful, you have the right under federal law to an independent external review by an organization with no financial relationship with your insurer. External reviewers overturn insurer denials at a meaningful rate — in some studies, exceeding 40 percent for certain claim types.

Document everything in writing. Phone calls with insurer representatives are rarely recorded in a way that benefits the patient. Submit appeals, requests, and follow-up communications in writing, and retain copies with timestamps.

Engage your state insurance commissioner. State regulators have enforcement authority over fully insured plans and, in some cases, over Medicare Advantage plans. A formal complaint creates a regulatory record and, in many states, triggers a required response from the insurer.

The Human Cost of an Invisible System

The prior authorization apparatus — its nurses, its algorithms, its physician reviewers, its criteria sets — is designed to be invisible to the patients it affects. Denial letters arrive on insurer letterhead with no indication of who reviewed the request, what criteria were applied, or whether any human being with relevant clinical expertise was involved.

This invisibility is not an administrative oversight. It is a feature of a system that functions most efficiently when patients do not know enough to contest its decisions. CFH Info believes that every American has a right to understand who is making decisions about their medical care — and to hold those decision-makers accountable when those decisions are wrong.