Internal coverage criteria in Medicare Advantage, in plain words

Internal coverage criteria are the coverage rules a Medicare Advantage plan writes for itself, or licenses from a vendor, to decide whether a basic Medicare benefit is medically necessary. Under 42 CFR 422.101(b)(6), applicable since 1 January 2024, a plan may use them only when Medicare's own criteria in statute, regulation, a national coverage determination (NCD) or a local coverage determination (LCD) are not fully established; they must rest on current evidence in widely used treatment guidelines or clinical literature; and they must be published with a summary of that evidence, its sources and a rationale. Since 2026 the plan also reports every internal criterion it uses for prior authorization to CMS each year. Botminds' Medical Policy Search checks each plan criterion against the Medicare rule in force on the date and flags any that goes beyond it to the director of medical policy.

What are internal coverage criteria?

They are any coverage criteria a Medicare Advantage plan applies to a basic benefit that do not come from Medicare's own rules: the plan's medical policies, a licensed commercial criteria set, a delegated vendor's guidelines, or an LCD borrowed from another contractor's area. The label is functional, not about authorship. CMS's 2026 filing instructions count criteria developed by the plan, by its delegated entities and by third-party vendors alike.

The rule matters because of what it replaced. Before 2024, Medicare Advantage manual guidance asked for criteria no more restrictive than original Medicare's, and HHS-OIG found in 2022 that plans had denied requests that met Medicare's rules by applying their own clinical criteria, such as requiring an x-ray before more advanced imaging (OEI-09-18-00260). CMS's 2023 rule, CMS-4201-F, turned that guidance into three tests, an evidence standard and a disclosure duty.

When can Medicare Advantage plans use internal coverage criteria?

Only when one of the three tests in the figure above is met, and then only with qualifying evidence and public disclosure. Where Medicare's criteria are fully established, the plan must apply them and “may not deny coverage for basic benefits based on coverage criteria not specified in paragraph (b) or (c)” of the section. Test A is the one plans reach for most and the one with the extra burden: the plan must demonstrate that the added criteria's clinical benefits are highly likely to outweigh the clinical harms, including from delayed or decreased access to care.

Two exclusions narrow the field further. The rule covers basic benefits, so supplemental benefits such as dental or vision fall outside it. And Part B step therapy for drugs has its own regulation, which is why CMS's annual filing excludes it. Everything else a plan applies through prior authorization, concurrent review or claim review, it applies under this rule.

What does fully established mean for coverage criteria?

Medicare's criteria are fully established when a statute, regulation, NCD or applicable LCD sets the conditions for the service and none of the three tests applies. The regulation lists examples of general coverage conditions plans must follow: the inpatient admission criteria in 42 CFR 412.3, the inpatient-only list, and the payment requirements for skilled nursing, home health and inpatient rehabilitation care (42 CFR 422.101(b)(2)). For those, no internal criterion may add a condition.

The harder cases are partial. An NCD may state the indications for a service but leave a term undefined; an LCD may cover a device ‘when reasonable and necessary’ without saying how to tell. That is test A territory: the plan may interpret or supplement the general provision, but must name the provision it is supplementing and justify the addition on benefit and harm. Where an NCD expressly says no other test need come first, as OIG noted the CT scan NCD does, a plan criterion requiring one is not filling a gap; it is contradicting the rule.

What evidence supports internal coverage criteria?

Two kinds, both named in the regulation: current treatment guidelines from organizations representing clinical medical specialties, and clinical literature of a stated quality, meaning large randomized controlled trials or prospective cohort studies with clear results in peer-reviewed journals, designed to answer the clinical question, or large systematic reviews and meta-analyses. CMS's preamble excluded unpublished evidence, case series and reports, and analyses derived solely from the plan's own data (88 FR 22120).

The evidence must actually support the criterion, not just the topic. CMS's February 2024 guidance put it bluntly: “MA organizations may not add coverage criteria that are not supported in such guidelines or literature, or change the substantive recommendations contained in such guidelines or literature to support coverage criteria.” A guideline that recommends physical therapy before surgery can support a try-first criterion; a guideline that does not mention sequencing cannot.

Do internal coverage criteria have to be public?

Yes, all of it. For each internal policy the plan must publish, in a publicly accessible way, the criteria in use and a summary of the evidence considered, a list of the sources of that evidence, and an explanation of the rationale; for test A criteria, the rationale must name the general provision being supplemented and explain the benefit-harm balance (42 CFR 422.101(b)(6)(ii)). CMS's 2024 guidance added that the criteria “must be accessible via a website and cannot be behind a paywall or require a subscription for access”, open to everyone, not only members and network providers.

The disclosure list is not new to Medicare. Since the 21st Century Cures Act, each Medicare contractor must publish an LCD with a summary of the evidence considered, a list of its sources and an explanation of the rationale, and CMS recommended that plans take the contractors' presentation as their model.

In the 2023 preamble CMS said so directly: “we do recommend MA plans refer to the coverage criteria and summary of evidence presented by MACs as a guide and best practice for how to present this information publicly.” A plan that drafts its public evidence summary in the shape of an LCD has a template that a regulator already reads.

The benefit-harm test, worked through

CMS's own example shows what test A asks for. An MRI NCD leaves the choice of contrast technique to the physician. A plan might add a criterion: no gadolinium contrast for a patient with a history of hypersensitivity to it unless the patient is pre-treated. The benefit is avoiding a reaction that can be life-threatening; the harms are a missed or delayed diagnosis when contrast was needed, and the delay the criterion itself can cause. CMS said the public rationale should weigh those against each other with evidence, and should narrow the criterion to the patients who stand to benefit, not every patient ordered an MRI.

“…we believe that all internal coverage criteria should clearly and explicitly support patient safety before the criteria are used by an MA plan…”

CMS, February 2024 guidance on CMS-4201-F, on test A

Two conclusions follow. A rationale that says criteria generally help patients does not pass; it has to be specific to the criterion. And where no guideline or high-quality literature supports the benefit outweighing the harm, the plan may not adopt the criterion at all, even though Medicare's criteria are not fully established. Test A is permission to fill a gap with evidence, not permission to fill it.

Out-of-area LCDs, try-first rules and other traps

Four patterns recur in internal criteria that fail the rule. The first is the borrowed LCD: CMS has said that applying an LCD from outside the plan's service area is using internal criteria, with all the evidence and disclosure duties. The second is the try-first rule: unless Medicare's rule or the supporting evidence calls for another service first, CMS said a step requirement is “additional internal coverage criteria prohibited by § 422.101(b)(6)”. The third is the vendor criterion adopted without its evidence: the plan must understand and publish the evidence behind a licensed product's criteria, which InterQual vs MCG in Medicare Advantage takes up in detail. The fourth is the stale cross-walk: a plan criterion written to match an LCD that has since changed now goes beyond it.

A plan criterion beyond Medicare's rule, flagged on the date asked

The fourth trap is the one a plan cannot see without dates. Medicare's LCDs change in every month of the year, so a criterion that was within Medicare's rule when the committee approved it can go beyond it on the day a new LCD version takes effect. Checking each criterion against the Medicare rule in force on the date of the decision, not on the date of the vote, is what the solution's Medicare rule checker does.

What a compliant internal criterion looks like

It is short, testable and carries its paperwork. The checklist below is the minimum a director of medical policy should see before a Medicare Advantage internal criterion goes to the UM committee, written from the regulation, CMS's 2024 guidance and the annual filing.

What is CMS-4201-F, and what is 42 CFR 422.101(b)(6)?

CMS-4201-F is the contract year 2024 Medicare Advantage and Part D final rule, published on 12 April 2023 at 88 FR 22120; its utilization management provisions apply to coverage from 1 January 2024. 42 CFR 422.101(b)(6) is the paragraph of the Medicare Advantage regulations it added, setting the three tests, the evidence standard and the disclosure duty. CMS then issued guidance on 6 February 2024 and, from 2026, an annual filing of internal criteria used for prior authorization (CMS-10913).

The filing is the newest piece and the one that makes the library a regulatory submission: the Part C UM annual data submission is explained field by field elsewhere. To see each plan criterion checked against Medicare's rule on the date of a decision, start from Medical Policy Search.

Questions people ask

Can a Medicare Advantage plan use an LCD from another region?

Only as internal coverage criteria. CMS's February 2024 guidance says an LCD from outside the plan's service area is treated as the plan's own criteria, so it needs one of the three tests, qualifying evidence and public disclosure. A plan covering several contractor areas may instead elect, with CMS notice, to apply the most beneficial local policy uniformly.

Does 42 CFR 422.101(b)(6) apply to supplemental benefits?

No. It governs coverage criteria for basic benefits, the Part A and Part B services Medicare Advantage must cover. CMS's annual filing likewise excludes criteria for supplemental benefits and Part B step therapy policies.

Do the internal coverage criteria rules apply to Medicaid or commercial plans?

No; they are Medicare Advantage rules. Medicaid managed care plans must define medical necessity no more restrictively than the state's program and base practice guidelines on valid and reliable clinical evidence (42 CFR 438.210, 438.236). Commercial and exchange plans follow state law and the plan document.

What happens if a plan's internal criteria do not comply?

Denials made under them are vulnerable on appeal, and CMS can act through its oversight of the plan's contract. CMS said in 2025 it would consider adding a review of internal coverage criteria to its program audits, and the annual filing gives it the list to start from.

Are internal coverage criteria the same as prior authorization criteria?

Not exactly. Prior authorization is one of several reviews where internal criteria are applied; concurrent and retrospective reviews use them too. The annual CMS filing covers only criteria used for prior authorization, but the evidence and disclosure rules apply wherever internal criteria are used.