Utilization management outsourcing is a health plan's decision to delegate some or all of its UM work, most often prior authorization for a defined set of services such as post-acute care, imaging or specialty drugs, to a contractor that reviews requests and issues decisions in the plan's name. It is common: in June 2024, contractors processed 68 percent of requests for skilled nursing facility admission across the 19 largest Medicare Advantage organizations, according to the HHS Office of Inspector General. Outsourcing moves the work but not the accountability. A Medicare Advantage organization keeps "ultimate responsibility" for every delegated function, and OIG's 2026 findings show why that matters: the plans themselves overturned nearly all of their contractors' appealed skilled nursing denials. Botminds' Utilization Management Automation is software a plan runs itself, so it is an alternative to delegating some of the work and a way to watch the work it still delegates.
Three ways to run UM, and what the plan still owns in each
Delegated to a UM contractor: The contractor’s nurses and physicians, under the plan’s criteria and delegation agreement.
In-house, with agents doing the waiting work: The plan’s own nurses and physicians; agents read, clock, chase and route.
Delegated to a UM contractor: The plan, for every decision: delegation does not transfer accountability.
In-house, with agents doing the waiting work: The plan, with every decision made under a named reviewer’s authority.
Delegated to a UM contractor: What the contract requires the contractor to report, often monthly and aggregated.
In-house, with agents doing the waiting work: Every request, clock and decision as it happens.
Delegated to a UM contractor: Usually reviewed by the plan, so the plan sees the delegate’s errors after members have appealed.
In-house, with agents doing the waiting work: Reviewed by the plan, by a physician who did not make the first decision.
Delegated to a UM contractor: Denial patterns the plan learns about from appeals, audits or an inspector general.
In-house, with agents doing the waiting work: Under-staffing in the physician lane; the agents show it, but cannot fix it.
What is utilization management outsourcing?
It is delegation of UM functions, from intake to clinical review to the decision itself, to an outside organization under contract. In Medicare Advantage terms the contractor is a first tier, downstream or related entity; in Medicaid managed care, a subcontractor. Delegates range from single-service specialists in imaging, therapy or post-acute care to companies that run a plan's whole UM operation, and some are owned by the same parent as the plan. Outsourcing UM is distinct from buying UM software: a delegate makes decisions, while software helps the plan's own staff make them.
The vocabulary of oversight comes from the rules. A Medicare Advantage delegation contract must specify the delegated activities and reporting, provide for revoking the delegation if the delegate does not perform, and state that the plan monitors performance on an ongoing basis (42 CFR 422.504(i)(4)). Medicaid managed care contracts carry the same three terms (42 CFR 438.230(c)).
Are health plans responsible for delegated utilization management decisions?
Yes, entirely. The Medicare Advantage contract rule states that, notwithstanding any delegation, "the MA organization maintains ultimate responsibility for adhering to and otherwise fully complying with all terms and conditions of its contract with CMS." The appeals and coverage-decision subpart says the same for UM specifically: a plan that delegates any of those responsibilities is ultimately responsible for the delegate meeting them (42 CFR 422.562(a)(3)). Medicaid managed care plans keep the same ultimate responsibility toward the state (42 CFR 438.230(b)(1)).
CMS's auditors titled a lesson in their 2025 enforcement report with the point: "Delegation Does Not Transfer Accountability". Among the examples they found, "Decisions from delegated entities were not always consistent with Medicare coverage requirements and/or the Sponsor’s approved plan benefit package." The plan also answers for the criteria its delegates apply: from 2026, Medicare Advantage organizations submit to CMS each year the internal coverage criteria used "by their organization or delegated entities" for services under prior authorization.
What did OIG find about prior authorization contractors?
In June 2026 OIG reported that, across the 19 largest Medicare Advantage organizations in June 2024, contractors processed most skilled nursing admission requests, one contractor denied them at a higher rate than plans reviewing internally, and plans overturned nearly all appealed contractor denials. The plans denied 12 percent of skilled nursing admission requests overall; when denials were appealed, they overturned 95 percent. The contractor naviHealth, which OIG notes is a subsidiary of UnitedHealth Group, processed half of all requests and denied 14 percent, against 11 percent for plans reviewing internally and 9 percent for other contractors.
Skilled nursing admission requests, June 2024: denial and appeal overturn rates by who reviewed
OIG's own summary of the contractor finding is the sentence a delegation oversight committee should read: "MAOs later overturned 97 percent of SNF denials issued by naviHealth when enrollees appealed. This raises concerns about whether contractors are receiving appropriate training and oversight from MAOs." The companion report on long-term acute care and inpatient rehabilitation found the same pattern in other post-acute settings: plans overturned 36 percent of appealed long-term acute care denials and 43 percent of rehabilitation denials, and some high denial rates were driven by contractors (OIG, June 2026).
The finding is not only about one company. Denials by other contractors were overturned on appeal at 97.4 percent, a higher rate than naviHealth's, though from fewer appeals. OIG's view is that contractor overturn rates above the plans' own "could indicate differences in policies or procedures between the parent company and its contractor or differences in interpretation of CMS coverage rules". Researchers at Brown University's School of Public Health, in a 2026 commentary in Health Affairs Scholar, summarized the wider evidence the same way: reviews done by vendors tend to deny more and to be reversed more often on appeal than reviews done inside the plan (Health Affairs Scholar, 2026; the passage is quoted in the guide to the best prior authorization software).
Why are delegated denials overturned?
Because the plan sees the appeal with more information than the delegate had at the first decision, and sometimes applies the rules differently. OIG found a structural reason in the way the work is split: "Although many MAOs used contractors to review initial prior authorization requests, they reviewed any appeals internally." A delegate that never sees its own overturns cannot learn from them unless the plan sends them back.
Three further causes recur in the oversight findings. Criteria drift, when a delegate's screens differ from the plan's approved criteria or from Medicare's, which CMS's auditors found as decisions "not always consistent" with coverage requirements. Incomplete files, when the first decision rests on a summary and the appeal on the full record, which is the risk CMS's 2025 report warned of in coverage decisions generally. And incentives, where a contract pays per review or rewards savings; Medicaid managed care contracts must bar compensation structured to encourage denials, as the utilization management vendors guide sets out. Across Medicare Advantage as a whole, KFF found that 11.5 percent of denied prior authorization requests were appealed in 2024, so each overturn stands for many denials nobody challenged.
What data should plans collect from UM delegates?
Request-level data, not monthly aggregates: every request with its receipt, decision and notice times, outcome, service type, the reviewer's credential, the criteria applied, the denial reason, and what happened on appeal. OIG's recommendation to CMS rests on the same idea at national scale: regulators cannot see contractor patterns without request-level data that names the contractor and the service. A plan can collect that from its own delegates today, through its delegation agreement.
Request-level fields to require from every UM delegate
- Receipt, decision and notice timestamps, with the receipt source
The same fields the plan needs for its own audit universe and its 31 March public metrics; a delegate’s clock is the plan’s clock.
- Service type and site of care
OIG’s findings were by service (skilled nursing, rehabilitation, long-term acute care); aggregate denial rates hide service-level patterns.
- Outcome, with partial approvals marked
Approved, partly approved or denied, and for partial decisions what was approved instead.
- Who decided, and their credential
Nurse, physician or other professional, so the plan can confirm that every medical-necessity denial had the required review.
- The criterion applied and the specific denial reason
Matched to the criteria the UM committee approved and the plan submits to CMS each year.
- Extensions, with the ground and notice date
An extension without a valid written notice is a late decision.
- Appeal and overturn, joined back to the original request
The single most telling measure of a delegate’s first decisions, and the one a delegate cannot compute without the plan.
- Residence and setting of the member
OIG found denial rates of 40 percent for nursing home residents seeking skilled nursing care, against 11 percent for other enrollees.
The fields a plan should demand from a delegate, as one log shows them
Is outsourcing utilization management cheaper?
Sometimes on the invoice, not always in total. No public source compares the cost of delegated and in-house UM, so a plan has to build the comparison itself, and the delegate's per-review fee is only the first line. The full cost of a delegated decision includes the plan's appeal reviews of the delegate's denials, the oversight team, the audit exposure for the delegate's late or unsupported decisions, and the member and provider friction behind every overturned denial.
What OIG's June 2024 sample implies for one delegated service line
68%
of skilled nursing admission requests processed by contractors
18%
of skilled nursing denials appealed by enrollees and providers
95%
of appealed denials overturned by the plans
40%
denial rate for nursing home residents, against 11% for other enrollees
Run the arithmetic on the plan's own numbers: delegated requests, the delegate's denial rate, the share appealed, the overturn rate and the plan's cost of an appeal review. A delegate whose appealed denials are overturned nineteen times in twenty is producing work the plan pays for twice. The comparison is also not binary. A plan can keep the delegate for clinical review in a specialty it cannot staff, take back the denials, or run its own intake and clock so that it sees every delegated request as it arrives rather than in next month's report.
Keep, split or bring back: choosing a model
Keep a delegate where the plan lacks the specialists and the delegate's request-level data shows decisions consistent with the plan's own; split the work where the delegate's first decisions are the problem; bring the work back where oversight costs approach the cost of doing it. Most plans end up splitting by service line. The common split keeps the delegate's clinical reviewers but brings the plan's own physicians onto every adverse decision, so that a denial in the plan's name is made by the plan.
Utilization Management Automation supports each model in a different way. In-house, its agents take the reading, clocking, chasing and routing that make outsourcing attractive in the first place, and the plan's nurses and physicians decide. Alongside a delegate, the plan can run every request through its own intake and clock, so it sees each delegated request, its deadline and its outcome as they happen, and builds its delegate oversight from one log. What the solution is not is an outsourcing service: Botminds does not review requests or make decisions on a plan's behalf. The criteria and timeliness rules a delegate must meet are the same ones in prior authorization metrics reporting.
Physician hours on shift, by lane: the capacity question behind outsourcing
How request-level data exposes a delegate's pattern
A delegate's pattern shows in four comparisons that aggregates hide: its denial rate against the plan's own by service, its overturn rate on appeal, its denial rate for particular groups of members, and its time to decision by channel. Each needs requests, not totals. OIG's skilled nursing finding about nursing home residents, 40 percent denied against 11 percent for others, appeared only because OIG collected request-level data from the plans.
The same was true in Medicaid. In its 2023 review of Medicaid managed care, using 2019 data, OIG found that 12 of 115 plans had prior authorization denial rates above 25 percent, twice the overall rate, and that most state Medicaid agencies did not routinely read a sample of the plans' denials to check them (OEI-09-19-00350; the denial rates themselves are compared in prior authorization denial rates). Oversight that reads samples of decisions catches what reports of averages miss. In the solution, the metrics screen shows late decisions by month for each line of business and is filtered from the same request-level log the plan exports for audits.
Late decisions by month and time to decision, from one request-level log
Questions people ask
How do plans oversee utilization management vendors?
Through the delegation agreement and ongoing monitoring: the contract must specify delegated activities and reporting, allow the plan to revoke the delegation, and provide for ongoing performance monitoring, under 42 CFR 422.504(i)(4) in Medicare Advantage and 438.230(c) in Medicaid. In practice that means request-level reporting, audits of samples of decisions, and review of appeal overturns.
Can a delegate deny a request in the plan's name?
Yes, if the delegation agreement allows it, but the same rules apply as if the plan decided: in Medicare Advantage an expected medical-necessity denial must be reviewed by a physician or appropriate professional first, with a specific reason, and the plan answers to CMS for the decision.
Who reviews the appeal of a delegate's denial?
Usually the plan. OIG found in its June 2026 report that although many Medicare Advantage organizations used contractors for initial skilled nursing reviews, they reviewed all appeals internally, so overturn rates measure the plan's disagreement with its delegate's first decisions.
Does CMS collect data on UM contractors?
Not routinely at request level. OIG recommended in June 2026 that CMS regularly collect request-level prior authorization data including contractor information; CMS pointed to a voluntary data collection pilot, which OIG said does not include contractor names.
Is naviHealth a Medicare Advantage plan?
No. OIG describes naviHealth as a contractor that reviews post-acute requests for Medicare Advantage organizations and notes that it is a subsidiary of UnitedHealth Group; in June 2024 it reviewed requests for several organizations, and most of the skilled nursing requests it reviewed were for UnitedHealth Group plans.