Out of Order: Disclosure Arrived Before the Denominators, Automation Before the Oversight Rules
The US prior-authorisation accountability instruments are landing in the wrong order: disclosure without denominators, automation ahead of human-review rules, contingency-paid review ahead of both. Exposed: payers, hospital revenue cycle, utilisation-review vendors, employers, regulators.
The argument about prior authorisation has been about denial rates. The first year of mandatory US disclosures gave everyone numbers to argue with: 12% of standard requests denied in Medicare Advantage, 14% in Medicaid managed care, 18% in the ACA Marketplace (KFF, 13/08/2026), and 52.6% of appealed denials overturned at the median plan against a 7.3% appeal rate (Forvis Mazars, 18/08/2026). The decision-relevant point is not what those numbers prove about decision quality, which the publishers themselves say they cannot settle. It is the order in which the accountability instruments are arriving, and it is the wrong one.
Signal Identification
A sequencing failure rather than a discovery. Disclosure landed first and incomplete, without denominators or service-level breakdown. Human-accountability rules for automated review are still only recommended to Congress. Contingency-paid review is already operating. Each instrument is defensible on its own; the order they arrive in is what decides who gets to use them.
What's Changing
The disclosures arrived on 31 March 2026, when payers had to publish approval and denial rates, appeal outcomes and turnaround times for calendar 2025; by 21 July, 92% of the plans required to publish had done so (Forvis Mazars, 18/08/2026). KFF's read of the largest insurers put overturn rates on appeal at 67% in Medicare Advantage, 47% in Medicaid managed care and 43% in the Marketplace (KFF, 13/08/2026). Within segments the spread is wide: standard-request denials in the Marketplace ran from 3% at GuideWell to 25% at Centene.
Trade coverage read the first-year figures as variation between insurers rather than as a verdict on any one of them (Healthcare Dive, 14/08/2026). The sequencing shows in what comes next. From 1 January 2027 the CMS-0057-F prior-authorisation API obligations take effect, putting request and decision data into machine-readable form (Forvis Mazars, 18/08/2026). MACPAC, meanwhile, has had to recommend to Congress that CMS clarify who must sign an adverse determination and force disclosure of how managed care plans automate these decisions, which is a rule that would normally precede the automation it governs (MACPAC, 07/05/2026).
Third in logic, first in operation: a public payer has already put review on contingency. Under the WISeR model, participants receive a percentage of the expenditures associated with averted care, across six performance years to December 2031 in six states (Centers for Medicare & Medicaid Services, 04/08/2026), which CMS presents as a taxpayer-protection design leaving coverage and payment policy untouched. A Congressional Review Act attempt to end it failed on a party-line Senate vote in July (Healthcare Dive, 17/07/2026).
Overturned on appeal against appealed at all
Overturn rates by market segment against the median-plan appeal rate. Sources: KFF, Forvis Mazars.
Disruption Pathway
Three stages. Through 2026 the disclosures are commercially useful and publicly weak: percentages without denominators, inconsistent formats, no breakdown by service, which is why comparison stays hard (Healthcare Dive, 14/08/2026). From January 2027 the API obligations put the same decisions into machine-readable form (Forvis Mazars, 18/08/2026), and the questions MACPAC has put to Congress, on who must sign an adverse determination and what plans must disclose about automation, become answerable against real data (MACPAC, 07/05/2026). Between 2027 and 2029 the order either corrects or sets: denominators, service-level detail and human-review duties are written in, or the instruments stay in the sequence they landed in.
Stress lands in three places. On payer medical-loss ratios, where denials that reverse late cost more than approvals granted early. On utilisation-review vendors paid on averted spend, whose revenue is measured before appeals resolve and whose payment incentives KFF flags as the live risk in the design (KFF, 10/02/2026). And on provider revenue cycle teams, advised to treat the published data as a negotiating input rather than as proof (Forvis Mazars, 18/08/2026). Two adaptations follow. Payers move spend from denial toward front-end documentation and gold-carding, because an approval that never needed appeal is the cheapest outcome. And review contracts get rewritten to settle on post-appeal outcomes rather than initial determinations, which on this report's reading is the only version that survives once the denominators arrive.
Why This Matters Now
The constituency is payer boards, hospital CFOs and the vendors sitting between them. What needs revision is how denial performance is contracted and measured. Any utilisation review arrangement priced on initial determinations, whether a commercial vendor contract or the federal contingency design where participants take a percentage of averted expenditure (Centers for Medicare & Medicaid Services, 04/08/2026), was written for a period without public numbers and now has them. Taken together, the sources suggest the near-term use of that data is commercial rather than regulatory: a negotiating exhibit before it is ever an enforcement one. Boards should know their own post-appeal overturn rate before a counterparty quotes it back.
Decision-action posture for this signal: Prepare — the disclosures are live and the January 2027 API date is fixed, but the oversight rules that would make the data binding are still only recommended, leaving a window to renegotiate review contracts first.
Counter-Argument
The strongest objection is that the data cannot govern anything. KFF's own reading is that the disclosures are hard to locate and interpret, carry no denominators and no breakdown by service, and so are of limited use to the public they were written for (KFF, 13/08/2026). Percentages without volumes cannot tell a regulator which denials matter, and inconsistent formats defeat comparison between plans (Healthcare Dive, 14/08/2026).
Which is the point, not a rebuttal. KFF's remedy is better reporting standards, and MACPAC's is oversight design written before the tools scale (MACPAC, 07/05/2026). Both describe an instrument arriving ahead of the rules that would make it usable, and in that interval the data is not neutral: it is available to whichever party is already organised to use it.
Implications
This looks durable rather than a disclosure fashion, because three instruments are now in the field and none of them is scheduled to be withdrawn: published metrics, a machine-readable API with a fixed 2027 date, and a public payer whose review contracts are priced on averted spend. The inflection runs from 2027 to 2029, when the reporting standards and human-review duties either catch up with the tools or do not. Payers with clean front-end documentation gain; vendors priced on initial denials lose. WISeR services accounted for 5.3% ($12.3B) of traditional Medicare Part B spending in 2024, which sizes what rides on the review contract (KFF, 10/02/2026).
Early Indicators to Monitor
- A payer publishing its post-appeal net denial rate alongside the required initial-determination metric.
- A hospital system citing published payer denial metrics in a contract dispute or rate negotiation.
- A revenue-cycle or legal-tech firm launching an automated appeal product priced per overturned denial.
- A state insurance department or attorney general opening an inquiry using the published disclosures.
- CMS proposing denominators, service-level breakdowns or a standard template in a follow-on rulemaking.
Disconfirming Signals
- Second-year disclosures showing appeal rates flat or lower than the first-year figures.
- CMS delaying or narrowing the January 2027 prior-authorisation API obligations.
- Payers cutting initial denial rates enough that overturn rates fall toward the low single digits.
- Congress or CMS ending the WISeR model before its scheduled close, removing the contingency-paid case.
- Courts or regulators ruling the published metrics inadmissible or too unreliable to support a claim.
Strategic Questions
- What is our post-appeal net denial rate, and would we publish it?
- Are our review contracts priced on initial determinations or on outcomes that survive appeal?
- If appeal volume tripled, which of our denial categories would stop paying for themselves?
- Do we spend more on denying claims or on getting the documentation right the first time?
Keywords
Prior authorization; CMS-0057-F; denial rates; appeals; overturn rate; WISeR model; utilisation management; Medicare Advantage; Medicaid managed care; revenue cycle; payer transparency; health AI governance
Bibliography
Source tiers: Tier 1, governments, regulators and intergovernmental bodies. Tier 2, think-tanks, academic institutes, major consultancies and quality data providers. Tier 3, quality journalism and specialist trade press. Tier 4, vendor, company and practitioner sources, used only as directional corroboration.
- Tier 1 WISeR (Wasteful and Inappropriate Service Reduction) Model page. Centers for Medicare & Medicaid Services (evergreen reference page, accessed 23/08/2026).
- Tier 1 Automation in Medicaid Prior Authorization: Recommendations. MACPAC (07/05/2026).
- Tier 2 Prior Authorization Metrics Provide New Insights into Insurer Practices. KFF (13/08/2026).
- Tier 2 Examining the Potential Impact of Medicare's New WISeR Model. KFF (10/02/2026).
- Tier 2 CMS-0057-F: Using Public Payor Prior Authorization Data. Forvis Mazars (18/08/2026).
- Tier 3 Prior authorization denials vary widely among insurers. Healthcare Dive (14/08/2026).
- Tier 3 Senate Republicans kill bid to end Medicare prior authorization pilot. Healthcare Dive (17/07/2026).