Binding law — in force AI-adjacent law
The medical director individually reviews every medical-necessity denial of a claim or prior authorization (Arizona HB 2175)
From 2026-07-01, before a health care insurer denies a claim a provider submitted on the basis of medical necessity (A.R.S. 20-3103), or issues a direct denial of a provider's prior-authorization request that involves medical necessity (20-3407), the medical director must individually review the denial, exercising independent medical judgment and not relying solely on recommendations from any other source. The act never mentions AI: it binds whatever tool proposes the denial, and AI and algorithmic claim-review and prior-authorization tools are where it bites. Detect model or scoring output that sets a denial with no medical-director or clinical review step.
Trust and provenance not reviewed by a lawyer · audit-grade · source verified 4 Oct 2026 · release 2026.10.04.3
- Lane
- Binding law — in force In force: applies since 1 Jul 2026
- Official source
- A.R.S. 20-3103 (Laws 2025, ch. 165, sec. 1) · captured 4 Oct 2026 · anchor hash (SHA-256)
00420cf21d41…· 9 more anchors in the data release - Verification
- Quoted text found word for word in the captured official document (4 Oct 2026). Source last verified 4 Oct 2026: checked against the captured official document.
- Data release
- Data release 2026.10.04.3, data as of 4 Oct 2026, schema 0.3.10.
- Legal review
- Not reviewed by a lawyer. TwinEthos derived this rule from the official text it cites: treat it as research to check against that text; it is not legal advice. No TwinEthos rule has been legally reviewed yet. Open questions for counsel on this rule: 2.
- Audit standard
- Audit-grade: meets all 10 checks of the TwinEthos audit standard that apply to it. The audit standard is TwinEthos's own quality bar for provenance, dates, applicability, detectors, fixtures, remediation and licences; it is not a legal review.
- Detectors
1 detector (code pattern), experimental: written from the rule's text and not yet measured for precision on real code, so treat a hit as a lead to verify.
Known limits:
- Review routing in a separate workflow service or BPM engine
- Denials applied by a downstream claims system from an exported score
- The clinical review may live in another module (a workflow engine or a separate review service); confirm the adverse status cannot be reached without it before reporting. Clinician tokens anywhere in the file suppress t…
Who it applies to
- Duty falls on: insurer
- Sectors: insurance, healthcare
- Health care insurers (A.R.S. 20-3101(5)) deciding claims submitted by providers on the basis of medical necessity, and health care insurers issuing direct denials of prior-authorization requests that involve medical necessity (chapter 26, article 1, where 20-3401 defines health care services plans, medical necessity and prior authorization requirements but not 'health care insurer'), for enrollees in Arizona. Applies from 2026-07-01, whatever tool, AI or otherwise, proposes the denial.
- Whether it applies depends on facts outside the code; a person has to decide.
The guard to add
Route every adverse outcome an AI or algorithm proposes in utilization review to a qualified clinical reviewer, and issue a denial only from that reviewer's recorded decision.
At the point where a model, rules engine or scoring tool returns its result for a prior-authorization, concurrent or retrospective review, the code may auto-approve (where the law allows) or route the case, but any result that would deny, delay, modify or downgrade the request is written as a pending clinical review (status 'pending_clinical_review', a review_queue entry with the tool's output attached as a recommendation), never as the determination. Only a review action by an authenticated reviewer whose role is physician, clinical peer or qualified reviewer, in the same or a similar specialty where the law requires, can set an adverse status; that action records reviewer_id, licence and specialty, the clinical documents opened, the decision and its clinical rationale, and the timestamp, and the adverse-determination notice is generated from it (with the reviewer's signature or attestation where the law requires). Where a law forbids the automated system from making an adverse determination even in part (Texas), the tool's output may only approve, route or support administrative and fraud-detection work; it is not shown to the reviewer as a proposed denial.
Where it goes: 1 application source code, 2 data models, 9 AI output handling, 14 user-facing text.
What this provision adds:
- The review covers both claim denials (20-3103) and direct denials of prior authorization (20-3407); the medical director exercises independent medical judgment and may not rely solely on a model's or vendor's recommendation.
Example (Python + OpenAI SDK (prior-authorization service)), before:
result = client.chat.completions.create(model=MODEL, messages=build_pa_prompt(request)).choices[0].message.content
if json.loads(result)['decision'] == 'deny':
prior_auth.update(request.id, status='denied')
send_denial_letter(request)After:
result = json.loads(client.chat.completions.create(
model=MODEL, messages=build_pa_prompt(request, record=member_clinical_record(request))).choices[0].message.content)
if result['decision'] == 'approve' and AUTO_APPROVE_ALLOWED:
prior_auth.update(request.id, status='approved', ai_assisted=True)
else: # any non-approval goes to a clinician
review_queue.enqueue(request.id, queue='pending_clinical_review',
specialty=request.specialty, ai_recommendation=result)
@app.post('/reviews/{case_id}/decision')
def record_clinical_decision(case_id: str, body: Decision, reviewer=Depends(licensed_clinical_reviewer)):
decision = clinical_decisions.create(case_id=case_id, reviewer_id=reviewer.id, licence=reviewer.licence,
specialty=reviewer.specialty, documents_reviewed=body.documents,
outcome=body.outcome, rationale=body.rationale)
if body.outcome in ('denied', 'downgraded'):
send_adverse_determination(case_id, decision=decision, signed_by=reviewer)Control: AI or algorithm denies, delays or downgrades care in utilization review without a licensed clinical reviewer deciding. The same guard addresses 11 items with binding law in 10 jurisdictions. Engineering guidance, not legal advice.
Related incidents
No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.
- UnitedHealth nH Predict claim-denial litigation (2023-11; alleged (not proven)). A class action filed in November 2023 alleges that UnitedHealth's nH Predict model had a 90% error rate, measured by denials reversed on appeal, while only about 0.2% of members appealed. UnitedHealth disputes the allegations; the litigation is ongoing. Source: STAT News · evidence grade: primary · cited by Monitor how often adverse AI decisions are reversed, and suspend models that are usually wrong
- Cigna PXDX batch claim denials (reported) (2022; alleged (not proven)). ProPublica, citing internal Cigna records, reported that Cigna's PXDX system was used to reject more than 300,000 claims over two months in 2022, with physicians spending an average of 1.2 seconds on each. Cigna disputes the reporting; related lawsuits are ongoing. Source: ProPublica / The Capitol Forum · evidence grade: press of record · cited by Make human review of adverse AI decisions substantive, not nominal
Rule id az-hb2175.medical-director-reviews-every-denial · review status: primary source derived