The Compliance Gap Nobody Budgeted For: What Payer and Provider Leaders Need to Know Before They Build an "Agentic" Operation

Short answer:

Most healthcare organizations are running two AI transformations at once. The governed one is planned. The shadow one is already happening in individual departments, without compliance, legal, or clinical leadership aware it exists. The second one is the operating problem worth addressing now.

Editorial Desk

VHealth Partners

Key Takeaways

→Healthcare organizations are running two AI transformations simultaneously, a governed one and an ungoverned shadow one in individual departments.
→Under 42 CFR § 422.566(d), adverse Medicare Advantage medical necessity determinations require physician review before issuance, AI cannot be the last step.
→CMS's WISeR pilot applies only to Original Medicare in six states, it does not expand AI autonomy in Medicare Advantage coverage decisions.
→ONC's FAVES framework (fairness, appropriateness, validity, effectiveness, safety) is a useful internal governance benchmark even where the rule does not technically apply.
→Three practical moves address most exposure: inventory what exists, draw a hard line at adverse determinations, and apply a source-attribute standard internally.

A lot of healthcare organizations are quietly running two different AI transformations at once, and most leadership teams have not noticed the second one.

The first is the one everyone is planning for: a careful, governed rollout of artificial intelligence into claims, utilization management, risk adjustment, and member experience. The second is happening on laptops in individual departments, where staff are building their own AI agents out of consumer tools, connecting them to email, spreadsheets, and internal data, and running them without anyone in compliance, legal, or clinical leadership aware it is happening.

The second one is the operating problem worth talking about, because it is spreading faster than governance can track it.

Why This Is Happening Now

Building an AI agent no longer requires an engineering team. A business analyst can open a general-purpose chat tool, give it a name, a job description, and a folder of files, and within an hour have something that drafts appeal letters, summarizes clinical notes, or flags claims for review. The barrier that used to protect organizations from this kind of shadow deployment, the need for technical skill, has mostly disappeared.

That is a real productivity gain. It is also a real governance problem in a regulated, trust-heavy market, because the tools people are reaching for were built for marketing content and customer outreach, not for medical necessity determinations. Nobody designed them with Medicare Advantage coverage rules in mind. The people deploying them usually have no idea those rules apply to what they just built.

Why It Persists

Three conditions let this keep happening.

Ownership is fragmented

IT owns infrastructure, compliance owns policy, clinical leadership owns medical necessity criteria, and none of them own "someone in revenue cycle built an agent last week." Until an incident forces the question, nobody is accountable for finding out what agents exist, what data they touch, and what decisions they influence.

General intelligence gets mistaken for specific competence

A model that can write a fluent explanation of a coverage denial is not the same as a model that has been validated against an organization's own utilization data, its case mix, and its coverage criteria. The fluency is what makes this dangerous. A confident, well-written output does not mean the underlying reasoning was sound or auditable.

The industry conversation has gotten ahead of the regulatory one

Vendors talk about autonomous agents that plan, decide, and act without a human in the loop. Federal rules for Medicare have not moved anywhere close to that. The gap between what is being sold and what is legally permitted is exactly where exposure lives.

What Actually Matters Here

Medicare Advantage medical necessity determinations are governed by 42 CFR § 422.101(c), which requires MA organizations to base coverage decisions on the individual patient's circumstances, including medical history, physician recommendations, and clinical notes. A dataset showing what happened to similar patients is not a substitute for that individualized review.

If a partially or fully adverse medical necessity determination is going to be issued, 42 CFR § 422.566(d) requires that a physician or other appropriate healthcare professional review it before it goes out. CMS has been direct about where automation fits into this: algorithms and predictive tools can assist, for example by suggesting relevant tests or predicting length of stay, but they cannot replace the individualized review the regulation requires, and a prediction alone cannot be the basis for terminating services.

The Regulatory Boundary: Where Automation Ends

42 CFR § 422.101(c)

MA organizations must base coverage decisions on the individual patient's circumstances, medical history, physician recommendations, and clinical notes. A predictive dataset is not a substitute.

42 CFR § 422.566(d)

Any partially or fully adverse medical necessity determination requires physician or appropriate healthcare professional review before issuance. AI cannot be the last step.

CMS WISeR Model

Applies only to Original Medicare in six states (NJ, OH, OK, TX, AZ, WA), January 2026–December 2031. Even in this AI-assisted review pilot, every non-payment recommendation must be determined by a licensed clinician.

That is the pattern worth internalizing. Wherever federal rules touch medical necessity, the automation is positioned to inform the decision, not to make it.

A Useful Outside Benchmark, Even Where It Does Not Directly Apply

The Office of the National Coordinator for Health Information Technology (ONC) issued a rule, HTI-1, that applies specifically to certified health information technology and to predictive decision support interventions embedded in that technology. Most internally built agents, the kind a department assembles from a chat tool and a folder of files, fall outside that rule's direct scope. That does not make the thinking behind it irrelevant.

ONC requires certified predictive tools to expose 31 source attributes: plain-language information about what data trained the tool, how it was validated, and how it performs, so that users can evaluate whether the tool is fair, appropriate, valid, effective, and safe. That five-part standard, often shortened to FAVES, is a reasonable question to ask about any AI tool touching a coverage, payment, or clinical workflow decision, regardless of whether the rule technically requires it.

The FAVES Framework: Five Questions for Any Clinical or Coverage AI Tool

Fairness

Does the tool perform equitably across patient populations, demographics, and case mix?

Appropriateness

Is the tool being used for a purpose it was designed and validated for?

Validity

Was the tool validated against data that reflects your organization's actual patients and workflows?

Effectiveness

Does the tool actually improve the decision or outcome it is meant to support?

Safety

Are there guardrails, escalation rules, and human review points that prevent harmful outputs?

If a team cannot answer these questions about their agent, they have a tool operating below the standard federal regulators already expect from certified systems. Treating FAVES as an internal governance benchmark, not a checkbox tied to a specific rule, is the more defensible posture.

The Practical Moves

Three changes address most of the exposure without slowing the organization down.

Inventory what already exists

Before writing new policy, find out which departments have already built agents, what they connect to, and what decisions they touch. This usually surfaces more than leadership expects.

Draw a hard line at adverse determinations

Any workflow that touches a coverage denial, a termination of services, or a similarly adverse medical necessity decision needs a named physician or appropriate healthcare professional in the loop before the decision goes out, full stop. Automation can prepare the file, summarize the record, and flag the relevant criteria. It cannot be the last step.

Apply a source-attribute standard internally, even where nothing requires it

For any agent touching clinical or coverage data, document what it was trained on, what its accuracy looks like against real cases, and who is responsible for monitoring drift over time. That documentation is what turns "we have an AI tool" into "we have a tool we can defend."

None of this requires abandoning agentic AI. It requires deciding, before an auditor or a beneficiary complaint forces the question, where the automation ends and the licensed professional's judgment begins.

The organizations that get ahead of this are not the ones moving fastest. They are the ones that can produce a clear answer, on demand, to a simple question: for any AI tool touching a coverage or clinical decision, who reviewed it, what was it trained on, and where is the human sign-off. Building that answer now, department by department, is a smaller project than most leadership teams assume, and a much smaller one than rebuilding trust after the answer turns out to be "we don't know."

Frequently Asked Questions

Can AI make medical necessity determinations for Medicare Advantage?

No. Under 42 CFR § 422.101(c), Medicare Advantage organizations must base coverage decisions on the individual patient's circumstances. Under 42 CFR § 422.566(d), a physician or appropriate healthcare professional must review any partially or fully adverse determination before it is issued. AI can assist and prepare the file, but it cannot replace the individualized review the regulation requires.

What is the WISeR model and does it apply to Medicare Advantage?

WISeR (Wasteful and Inappropriate Service Reduction) is a CMS pilot that runs from January 1, 2026 through December 31, 2031 in six states: New Jersey, Ohio, Oklahoma, Texas, Arizona, and Washington. It applies only to Original Medicare, not Medicare Advantage. Even within WISeR, every recommendation for non-payment must be determined by an appropriately licensed clinician.

What is the ONC FAVES standard for AI tools in healthcare?

ONC's HTI-1 rule requires certified predictive decision support tools to expose 31 source attributes covering fairness, appropriateness, validity, effectiveness, and safety, the FAVES framework. While it applies directly to certified health IT, FAVES is a reasonable internal governance benchmark for any AI tool touching coverage, payment, or clinical workflow decisions.

What is shadow AI in healthcare organizations?

Shadow AI refers to AI agents and tools built by individual departments using consumer-grade tools, without oversight from IT, compliance, legal, or clinical leadership. Staff can now build agents that draft appeal letters, summarize clinical notes, or flag claims without any technical skill, and without anyone in governance knowing the tool exists or what data it touches.

What three practical steps reduce AI compliance exposure in healthcare?

First, inventory what already exists, find which departments have built agents, what they connect to, and what decisions they touch. Second, draw a hard line at adverse determinations, any workflow touching a coverage denial or termination of services needs a named physician in the loop before the decision goes out. Third, apply a source-attribute standard internally, document what each agent was trained on, its accuracy against real cases, and who monitors drift over time.

Sources and Regulatory References

Farzin Espahani

Strategic Advisor, Insurance Growth, Medicare Distribution, and Compliance

Farzin Espahani is a Strategic Advisor focused on insurance growth, Medicare distribution, healthcare operations, and compliance-aware performance marketing.

He has led growth, marketplace operations, partner distribution, and Medicare marketing initiatives across regulated healthcare and insurance markets, with experience spanning QuinStreet, Health IQ, Solution21, and The Patient's Guide, which was acquired by IAC Publishing.

At QuinStreet, he worked across Medicare and health insurance distribution, performance marketing, partner economics, lead quality, compliance alignment, funnel performance, and AI-enabled consumer decision support, including the development of an AI-powered Medicare plan recommendation experience for Insure.com.

Farzin also serves in industry leadership and advisory roles with the Insurance Marketing Coalition and Lead Quality Alliance, where his work supports ethical marketing, lead quality, consumer transparency, and compliance-aware growth.

His academic background in biocultural anthropology, sociology, and social psychology informs how he evaluates consumer behavior, incentives, trust, decision-making, and organizational friction. His executive education includes programs at Massachusetts Institute of Technology (MIT) Sloan, Wharton, Cornell, and Northwestern Kellogg, with advanced study in artificial intelligence (AI), revenue analytics, pricing, leadership, change management, and communication.

For VHealth, Farzin brings a practical advisory lens on healthcare growth, workflow visibility, regulated distribution, compliance-aware interpretation, and responsible AI-enabled decision support.

Build a Governed AI Operating Model

VHealth's AI Implementation & Workflow Design advisory helps payer and provider organizations implement AI in a way that improves operations without creating new compliance risk. Schedule a conversation to discuss your current program.

Schedule a Conversation →