Illinois HB 2472 (P.A. 103-0656; Managed Care Reform and Patient Rights Act, 215 ILCS 134)

Binding law — in force

Algorithmic review must use physician-set criteria, verified by board-certified physicians before changes and after errors (Illinois HB 2472)

215 ILCS 134/85(b-10) · official text · In force: applies since 1 Jan 2025 · Illinois (US-IL)

From 2025-01-01, utilization review programs that use algorithmic automated processes to decide whether to render adverse determinations based on medical necessity must use objective, evidence-based criteria compliant with URAC or NCQA accreditation requirements and prove compliance with each registration (215 ILCS 134/85(b-10), (a)); the registration must attach policies and procedures (1) ensuring that licensed physicians with relevant board certifications establish all criteria the process uses and (2) for a program integrity system that, before new or revised criteria are used and when implementation errors are found, requires such physicians to verify that the process and its corrections yield results consistent with the criteria for their certified field. A plan or program using an automated process must have that accreditation and those policies (45(i)). Detect the absence of physician criteria sign-off and pre-release integrity verification.

Who it applies to

• Duty falls on: insurer, organization
• Sectors: insurance, healthcare
• Health care plans (HMOs, managed care community networks and accountable care entities with a provider network) and any person conducting a utilization review program in Illinois (registered with the Department of Insurance) that uses an algorithmic automated process in utilization review for medical necessity. In force 2025-01-01.
• Not covered:
  • Section 85 does not apply to persons providing utilization review program services only to the federal government (215 ILCS 134/85(c)(1))
  • Section 85 does not apply to self-insured ERISA health plans, though it applies to persons conducting utilization review on their behalf (85(c)(2))
  • Section 85 does not apply to hospitals and medical groups performing utilization review for internal purposes unless conducted for another person (85(c)(3))
  • 'Health care plan' (Section 45) excludes indemnity policies (including those with a contracted network), dental-only and vision-only plans, preferred provider administrators, self-insured ERISA plans, workers' compensation care and certain union-affiliated plans (134/10)
• Whether it applies depends on facts outside the code; a person has to decide.

llm:
  model: gpt-4o
  temperature: 0.7

llm:
  model: gpt-4o-2024-08-06     # change only via PR; triggers the eval workflow
  temperature: 0.7

Standards that recommend the same control

• GenAI risks should be re-assessed and red-teamed after fine-tuning, RAG, or a new use of a third-party model (NIST GenAI Profile) (NIST GenAI Profile (AI 600-1) · NIST AI 600-1, MG-3.1-003)

Related incidents

• Serving-stack changes silently degraded Claude output quality (2025-08; disclosed by the operator). Anthropic reports that three infrastructure bugs, including one introduced by a runtime performance optimization, intermittently degraded Claude's responses between early August and early September 2025, and that its benchmarks, safety evaluations, and canary deployments did not capture the degradation. It now runs quality evaluations continuously on production systems. Source: Anthropic (operator postmortem, 2025-09-17) · evidence grade: primary · cited by Re-run behavior and safety evaluations before any model, version, or serving change reaches users
• GPT-4o update shipped with sycophantic behavior and was rolled back (2025-04-25; disclosed by the operator). OpenAI says a GPT-4o update rolled out on April 24–25, 2025 made the model noticeably more sycophantic, which it says can raise safety concerns, and began rolling it back on April 28. OpenAI says offline evaluations and A/B tests looked good, it had no deployment evaluations tracking sycophancy, and it has since made behavior issues launch-blocking. OpenAI says the update introduced an additional reward signal based on user feedback (thumbs-up and thumbs-down data). Source: OpenAI (operator disclosure, 2025-04-29) · evidence grade: primary · cited by Re-run behavior and safety evaluations before any model, version, or serving change reaches users

Rule id il-hb2472.automated-process-criteria-and-integrity · review status: primary source derived

Binding law — in force

Only a clinical peer makes adverse determinations; an algorithmic automated process may only certify or refer (Illinois HB 2472)

215 ILCS 134/45(i) and source note · official text · In force: applies since 1 Jan 2025 · Illinois (US-IL)

From 2025-01-01, even if a health care plan or other utilization review program uses an algorithmic automated process in utilization review for medical necessity, it must ensure that only a clinical peer (a health care professional in the same profession and the same or similar specialty as the provider who typically manages the condition) makes any adverse determination based on medical necessity, and that only a clinical peer reviews an appeal (215 ILCS 134/45(i)). Only a clinical peer may make adverse medical-necessity determinations; a health care professional or an accredited algorithmic automated process may certify medical necessity, and the process may refer a case to a clinical peer for a potential adverse determination (85(e)(2)). Detect automated output that sets a denial without a clinical peer, and prompts or schemas that ask the model to deny.

Who it applies to

• Duty falls on: insurer, organization
• Sectors: insurance, healthcare
• Health care plans (HMOs, managed care community networks and accountable care entities with a provider network) and any person conducting a utilization review program in Illinois (registered with the Department of Insurance) that uses an algorithmic automated process in utilization review for medical necessity. In force 2025-01-01.
• Not covered:
  • Section 85 does not apply to persons providing utilization review program services only to the federal government (215 ILCS 134/85(c)(1))
  • Section 85 does not apply to self-insured ERISA health plans, though it applies to persons conducting utilization review on their behalf (85(c)(2))
  • Section 85 does not apply to hospitals and medical groups performing utilization review for internal purposes unless conducted for another person (85(c)(3))
  • 'Health care plan' (Section 45) excludes indemnity policies (including those with a contracted network), dental-only and vision-only plans, preferred provider administrators, self-insured ERISA plans, workers' compensation care and certain union-affiliated plans (134/10)
• Whether it applies depends on facts outside the code; a person has to decide.

result = client.chat.completions.create(model=MODEL, messages=build_pa_prompt(request)).choices[0].message.content
if json.loads(result)['decision'] == 'deny':
    prior_auth.update(request.id, status='denied')
    send_denial_letter(request)

result = json.loads(client.chat.completions.create(
    model=MODEL, messages=build_pa_prompt(request, record=member_clinical_record(request))).choices[0].message.content)
if result['decision'] == 'approve' and AUTO_APPROVE_ALLOWED:
    prior_auth.update(request.id, status='approved', ai_assisted=True)
else:                                   # any non-approval goes to a clinician
    review_queue.enqueue(request.id, queue='pending_clinical_review',
                         specialty=request.specialty, ai_recommendation=result)

@app.post('/reviews/{case_id}/decision')
def record_clinical_decision(case_id: str, body: Decision, reviewer=Depends(licensed_clinical_reviewer)):
    decision = clinical_decisions.create(case_id=case_id, reviewer_id=reviewer.id, licence=reviewer.licence,
                                         specialty=reviewer.specialty, documents_reviewed=body.documents,
                                         outcome=body.outcome, rationale=body.rationale)
    if body.outcome in ('denied', 'downgraded'):
        send_adverse_determination(case_id, decision=decision, signed_by=reviewer)

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• UnitedHealth nH Predict claim-denial litigation (2023-11; alleged (not proven)). A class action filed in November 2023 alleges that UnitedHealth's nH Predict model had a 90% error rate, measured by denials reversed on appeal, while only about 0.2% of members appealed. UnitedHealth disputes the allegations; the litigation is ongoing. Source: STAT News · evidence grade: primary · cited by Monitor how often adverse AI decisions are reversed, and suspend models that are usually wrong
• Cigna PXDX batch claim denials (reported) (2022; alleged (not proven)). ProPublica, citing internal Cigna records, reported that Cigna's PXDX system was used to reject more than 300,000 claims over two months in 2022, with physicians spending an average of 1.2 seconds on each. Cigna disputes the reporting; related lawsuits are ongoing. Source: ProPublica / The Capitol Forum · evidence grade: press of record · cited by Make human review of adverse AI decisions substantive, not nominal

Rule id il-hb2472.clinical-peer-adverse-determination · review status: primary source derived