Medical policy management: the economics and the KPIs to track

Medical policy management is the work of writing, approving, publishing, applying and retiring a health plan's coverage criteria, and of proving afterwards which edition applied to each decision. Its costs are visible (analysts, committee time, licensed criteria, publishing) and its returns are mostly invisible, because they arrive as denials that were never overturned, reviews that did not stall and audits that found nothing. That makes it easy to under-fund. Botminds' Medical Policy Search serves the part of the program most plans run by hand: answering, for any service, plan type and date, which criteria applied, quoted from the edition in force, and finding every decision that cited a section later found wrong. This guide puts numbers on the program so a medical officer and a finance partner can argue about the same ones.

What is medical policy management?

It is the lifecycle of a coverage criterion: a trigger (a new code, an NCD or LCD, new evidence, an appeals pattern), an evidence review, a draft, a committee vote, publication with an effective date, application by reviewers, monitoring and, eventually, retirement. Three parts of that lifecycle are now set by federal rule for Medicare Advantage. The UM committee must approve every UM policy before use and review them at least annually (42 CFR 422.137). Internal criteria must be publicly accessible with a summary of evidence, a list of sources and a rationale (42 CFR 422.101(b)(6)). And since 2026 the plan must report every internal criterion it uses for prior authorization to CMS each year.

Those rules turn a clinical library into a regulated asset. The program's job is no longer only to say what is covered; it is to say what was covered on any past date, show why, and file it.

What does a medical policy department do?

It researches, drafts, cross-walks and publishes; reviewers apply. A typical department reads Medicare's and the state's coverage changes and the quarterly code files, reviews the clinical evidence for new and contested services, drafts editions with their evidence summaries, maps each policy to the NCD or LCD it sits beside, prepares the UM committee's agenda, publishes approved editions and bulletins, and answers reviewers' questions about what a criterion means. Since 2026 it also assembles CMS's Part C UM annual data submission. The people and their weeks are set out in the medical policy analyst's job.

Who owns medical policy at a health plan?

Clinically, the chief medical officer or a medical director; operationally, a director of medical policy. In Medicare Advantage the rule names the clinical owner: the UM committee is led by the plan's medical director, and no UM policy may be used without its approval. Compliance owns the filings and audit responses, and the appeals and UM teams own the decisions made under the policies. The economics below cross those lines, which is why a program rarely has one budget owner who sees all of them.

Where a medical policy program pays off: three returns

The first return is denials that do not get overturned. Medicare Advantage insurers made 52.8 million prior authorization determinations in 2024 and denied 4.1 million; 11.5% of denials were appealed, and 80.7% of those appeals were partially or fully overturned, according to KFF's analysis of CMS data. Our arithmetic puts that at roughly 380,000 overturns in one year, each a review done twice. HHS-OIG named plan criteria not found in Medicare's rules as one of the two common causes behind denials it found met Medicare's rules (OEI-09-18-00260). Criteria and editions are the policy team's to fix.

The second return is review time. Every prior authorization and appeal starts with finding the right criteria; by Botminds' estimate that takes 15 to 25 minutes by hand when the reviewer must find the policy, the edition in force and Medicare's rule and compare them. The third is defensible criteria: “CMS imposed 14 Civil Money Penalties (CMPs) based on violations identified through program audits, financial audits, and other routine oversight activities conducted in 2025”, and a program that can show its criteria, their evidence and their editions spends less time in remediation.

How much do policy-related overturns cost?

No public source prices an overturned denial for a health plan, so the honest answer is a method. Count the denials that cited a medical policy section; take the share appealed and the share overturned from your own appeals data; multiply by the cost of handling each stage (the first review, the reconsideration, the physician's second review, the letter, any interest or penalty on a late payment) and add the cost the plan cannot see, the denials that were wrong and never appealed. KFF's 2024 figures show how large that last group can be: fewer than one in eight Medicare Advantage denials were appealed at all.

The useful split is by cause. An overturn because new records arrived is the system working. An overturn because the denial quoted an edition not yet in force, a commercial criterion on a Medicare Advantage member or a criterion Medicare does not have is a policy defect, and it repeats on every decision that cited the same section until someone finds them all. That search, not the single appeal, is where the money is.

One overturned appeal, and every other decision that cited the same section

The cost of keeping a medical policy library current

Upkeep is the program's fixed cost, and it is driven by how fast the rules beside each policy move. The split at the top of this page shows the pace: 41% of Medicare's LCDs in effect on 27 October 2026 had a version that took effect that year. The CMS filing adds a known cost: CMS estimated 15 hours per Medicare Advantage organization for the annual criteria submission, at an adjusted $92 an hour, or $241,500 a year across the 175 organizations it expected to file (CMS-10913 supporting statement). CMS's own note on scope explains why that is an average: “Some MAOs have identified no internal coverage criteria, while others develop internal coverage criteria that differ from contract to contract, or locality to locality.”

The answering term is the easiest to leave out, because it is spread across hundreds of reviewers. It is also the easiest to size. The figure below applies Botminds' midpoint estimate of 20 minutes per lookup by hand and the 10-second design target to three illustrative lookup volumes.

What KPIs should a medical policy team track?

Track outcomes of the criteria, not activity of the team. Counting editions published says nothing about whether reviewers applied the right one. The table defines eight KPIs that do, each with its formula and the data it needs; most can be computed from decision letters that cite policy, section and edition, which is reason enough to make that citation mandatory.

How do you measure a medical policy program?

Start from the decisions, not the documents. Pull a year of denials and appeals with the policy, section and edition each one cited; join them to the edition intervals and to the Medicare document each policy sits beside; and compute the KPIs above as a baseline before changing anything. Where decision letters do not cite an edition, sample them and reconstruct it by hand: the size of that effort is itself a finding.

Public numbers help as context, not as targets. Medicare Advantage organizations now post prior authorization metrics each year, including the share of standard requests approved after appeal (42 CFR 422.122(c)); the guide to prior authorization metrics reporting traces how each measure is built. KFF's analyses give the market-wide picture. Neither tells a plan which of its own sections cause its overturns. That needs the join between decisions and editions, a measurement each plan has to build for itself.

What software do health plans use for medical policy?

Usually four kinds, often from different vendors: an authoring and publishing system for the plan's own policies; licensed commercial criteria sets for common services and levels of care; a utilization management platform where prior authorization and concurrent review run; and a document library or portal where reviewers and providers read published policies. Search across editions, by date and plan type, with Medicare's rule beside the plan's, is the gap between them, which is where dated medical policy search sits.

The policy library as a working view: current edition, next review and the Medicare rule beside each policy

Buying questions follow from the KPIs. Can the system say which edition was in force on a past date, and prove it with the edition's own words? Does it follow your Medicare contractors? Can it list every decision that cited a section? Does it keep plan types apart? Who decides? Medical Policy Search answers the first four in software and leaves the fifth with a physician reviewer. It does not author policies, run the committee, replace a licensed criteria set or run prior authorization; it needs the plan's editions, and a plan that kept only current PDFs must rebuild its history before the KPIs mean anything. To see it on your own policies, start from Medical Policy Search.

Questions people ask

What does a director of medical policy do?

Runs the library and its calendar: decides which policies need review, assigns analysts, prepares the UM committee's agenda, publishes approved editions and owns the plan's public criteria. In Medicare Advantage the director's work feeds two federal obligations, the committee's annual review and the annual criteria filing to CMS.

Is medical policy management the same as utilization management?

No. Medical policy decides what the criteria are; utilization management applies them to requests through prior authorization, concurrent review and retrospective review. In Medicare Advantage the two meet in the UM committee, which must approve every UM policy before it is used.

How many medical policies does a health plan keep?

No public source counts them across plans. In the supporting statement for the filing it finalized in 2025, CMS noted that some Medicare Advantage organizations had identified no internal coverage criteria while others vary theirs by contract or locality. The solution's fictional sample plan keeps 214 policies with 1,312 editions back to 2016, which gives a sense of how editions multiply.

What does the CMS criteria filing cost a plan?

CMS estimated 15 hours per Medicare Advantage organization a year for the Part C UM annual data submission, at an adjusted $92 an hour, about $1,380 per organization. That covers assembling and submitting the list; it does not cover the evidence summaries and rationale that internal criteria must already carry in public.

Can a medical policy program reduce prior authorization denials?

It can reduce wrong ones. Criteria that follow Medicare's where they are fully established, editions applied by date and plan type, and testable wording all cut the denials that get overturned. Whether total denials fall depends on the requests; the measure to watch is the policy-cited overturn rate.