Utilization management vendors are the companies a health plan buys UM from, and they come in four kinds: platforms that hold the cases, criteria content that reviewers apply, delegated services that review and decide requests for the plan, and technology layers, increasingly AI agents, that do the work around the decision. Choosing among them by feature lists misses what a plan is actually buying, which is help meeting federal rules it remains accountable for whichever vendor it picks. The useful way to evaluate a UM vendor is rule by rule: for each requirement, the question to put to the vendor and the evidence that answers it. Botminds' Utilization Management Automation is one of the technology layers, and the matrix below applies to it as much as to anyone.
The buyer's matrix: rule, question, evidence to demand
| Rule | Ask the vendor | Evidence to demand |
|---|---|---|
| Clocks run from receipt: 72 hours expedited, 7 calendar days standard42 CFR 422.568, 422.572; 438.210(d) | Ask the vendorWhere does your clock start for a fax, a portal submission, a phone call and a letter? Can anything pause it? | Evidence to demandA request-level export showing receipt time and its source, and every extension with its ground and notice date. |
| A physician or appropriate professional reviews every expected medical-necessity denial42 CFR 422.566(d); 438.210(b)(3) | Ask the vendorCan a nurse, a rule or a model issue or draft a denial in your product or service? | Evidence to demandRole permissions, and a sample of denials with the reviewer’s name and credential. |
| A specific reason on every denial, in every channel42 CFR 422.122(a) | Ask the vendorShow us denial notices you sent by fax and by phone script, not only the portal. | Evidence to demandReal notices, with the criterion and the missing element named. |
| Medicare’s criteria first; internal criteria public, with evidence42 CFR 422.101(b)(6), (c)(1) | Ask the vendorWhich criteria do you apply, and how is a product screen kept from narrowing Medicare’s own criteria? | Evidence to demandA criteria list that matches what the plan submits to CMS each year. |
| The UM committee approves every policy before use42 CFR 422.137 | Ask the vendorCan our committee see and approve every threshold, rule and model setting you use? | Evidence to demandVersioned settings with owners and change dates. |
| Public metrics by 31 March42 CFR 422.122(c) | Ask the vendorCan you rebuild last year’s posted averages and medians from request-level data? | Evidence to demandThe recomputation, with CMS’s template denominators. |
| The plan keeps ultimate responsibility and monitors delegates42 CFR 422.504(i); 438.230 | Ask the vendorWill you report every request, outcome and appeal, not monthly totals? | Evidence to demandA data specification in the contract, and a sample file. |
| Compensation does not reward denials42 CFR 438.210(e) | Ask the vendorHow are you paid, and does anything you earn rise when we deny more? | Evidence to demandThe fee schedule and any savings or performance terms. |
| Reconsideration by someone not involved in the first decision42 CFR 422.590(h) | Ask the vendorIf you review appeals as well, how do you keep the first reviewer off them? | Evidence to demandAssignment logic and a sample of appealed cases. |
Who are the main utilization management vendors?
The main utilization management vendors fall into four categories, and most plans buy from more than one. CMS itself names some of the best known when it tells Medicare Advantage organizations what to include in the annual submission of internal coverage criteria: "Reported ICC includes criteria developed directly by the MAO or an FDR, and criteria developed by third-party vendors such as InterQual, MCG and EviCore." That sentence covers two of the four kinds: criteria content and delegated review. A plan buying review software rather than a review service will find the feature-level questions in the guide to the best prior authorization software.
Four kinds of UM vendor, and what each one does with a decision
| Kind | What it provides | Does it decide? | Rules that follow it |
|---|---|---|---|
| UM platform | The case record: intake, workflow, criteria lookup, letters, audit trail | No; the plan’s reviewers decide in it | Clock capture, notice times, request-level export |
| Criteria content | Clinical screens and guidelines licensed by the plan | No; reviewers apply it | Limits on internal criteria; annual submission to CMS |
| Delegated UM service | Clinical review, often for one service line, decided in the plan’s name | Yes, under delegation | Every UM rule, plus the plan’s oversight duties |
| Technology or agent layer | Reading, clocking, chasing, predicting and routing around the platform | Should not | The physician-review rule, and the committee’s approval of its settings |
How do you choose a utilization management vendor?
Choose by the rules first and the features second: shortlist only vendors that can answer every row of the matrix with evidence from their own operations, then compare on fit, price and implementation. A vendor that cannot show where its clocks start, or who signed a sample of its denials, is a compliance risk the plan will carry, because the plan keeps ultimate responsibility for any UM function it delegates.
Then test on the plan's own data. Ask for a replay of a sample of last quarter's closed requests: the vendor's clock starts, expedite findings, missing-record requests and routing, compared with what actually happened. A replay costs a few weeks and answers questions no demonstration can, such as how often the vendor's predicted outcome differs from the plan's reviewers and why. The integration side of that test is set out in utilization management software: adding agents to the platform you have.
What should a utilization management vendor provide?
Beyond its product, a UM vendor should provide the evidence the plan needs to answer for it: request-level data, the rules and settings it applied, the people who decided, and access for auditors. Medicare Advantage delegation contracts must give HHS and the Comptroller General the right to audit and inspect a delegate's books, systems and records, and must specify "that the performance of the parties is monitored by the MA organization on an ongoing basis". A vendor whose evidence lives only in its own portal makes that monitoring hard and an audit harder.
What a UM vendor should hand over, whatever kind it is
- Request-level data on demand
Receipt, decision and notice times, outcome, reviewer, criterion and appeal result for every request, exportable in the layout an audit asks for.
- Every setting, versioned
Clock rules, thresholds, cadences and routing, with who changed what and when, so the UM committee can approve them as policy.
- The criteria, matched to the plan’s list
Which criteria applied to each service, consistent with what the plan submits to CMS.
- The reasoning behind any prediction
Factors for and against shown on each request, and the rate at which reviewers decided otherwise.
- Exit terms
The plan’s data, in a usable format, when the contract ends; history is what an auditor asks for.
Do utilization management vendors use AI?
Many do, and federal rules regulate the decision rather than the tool. CMS proposed AI-specific guardrails for Medicare Advantage in late 2024 and did not finalize them in April 2025 (CMS, 2025), so the binding rules are the general ones: decisions on the individual's record and physician review before a medical-necessity denial. Where CMS runs a technology program itself, it describes its WISeR participants as companies that recommend medical-necessity decisions to payers with technology such as AI (CMS, WISeR model), required to have clinicians who validate determinations; the guide to the WISeR model for prior authorization covers what the model asks of them. That is a reasonable test for any vendor: technology recommends, clinicians determine.
Ask an AI vendor three things. What does the model decide, as opposed to recommend? Who can override it, and how often do they? And what operational results, not model accuracy, has it shown on requests like the plan's? A prediction that sends a request to the right reviewer saves physician time; a prediction that a reviewer feels obliged to follow is the risk the medical director has to govern, as medical director utilization management sets out.
A prediction that shows its factors, and the reviewer it chose
How are utilization management vendors paid?
Usually by the review, by the member per month, or with a share of savings, and the structure matters as much as the price. Medicaid managed care contracts must ensure that compensation to anyone conducting UM "is not structured so as to provide incentives for the individual or entity to deny, limit, or discontinue medically necessary services to any enrollee". Medicare Advantage has a parallel rule for physician incentive plans, barring payment to a physician or group as an inducement to limit medically necessary services to an enrollee (42 CFR 422.208(c)(1)).
A plan does not need a rule to see the risk in a contract that pays a delegate more when it denies more. Savings-sharing terms tied to fewer approved services, or performance bonuses on denial rates, invite the pattern OIG found in 2026. A plan buying a technology layer should ask the same question differently: is the vendor paid for the work it does, such as requests processed or seats, or for outcomes that depend on denials?
What certifications should a utilization management vendor have?
Accreditation helps, but it does not certify compliance with the federal UM rules, so a plan should treat it as a floor and test the rules directly. Health plans and UM organizations are commonly accredited by national bodies such as NCQA or URAC. In Medicare Advantage, accreditation by a CMS-approved organization can deem a plan compliant in listed areas such as quality improvement, access to services and confidentiality of records; organization determinations and appeals are not among the deemable areas in 42 CFR 422.156(b). In Medicaid, states must publish each managed care plan's accreditation status and accrediting body each year (42 CFR 438.332).
The certifications that matter more are the people's: unrestricted clinical licences for every reviewer, matched to the states the plan requires, and physician reviewers with expertise appropriate to the services at issue, which the Medicare Advantage rule requires without requiring the same specialty as the treating physician. Ask for the roster, the licence states and a sample of denials with the reviewer's credential.
What are the risks of a utilization management vendor?
The largest risk is decisions the plan cannot see until members appeal them. OIG's 2026 post-acute reports found exactly that pattern: in the companion report on long-term acute care and rehabilitation, "In some cases, high denial rates were driven by contractors that denied prior authorization requests on behalf of the MAOs, many of which were later overturned on appeal by the MAO." The remedy OIG proposed for regulators is the same one a plan can apply to its own vendors:
"CMS should regularly collect request-level prior authorization data that include service type and contractor information"
HHS Office of Inspector General, OEI-09-24-00331, June 2026
Other risks follow from the matrix. Criteria drift, when a vendor's screens differ from Medicare's or from what the UM committee approved. Clock drift, when a vendor's system starts clocks at logging. Lock-in, when the decision history lives only in the vendor's portal. And opacity, when a predictive tool's thresholds are vendor settings rather than plan policy. What delegation oversight looks like in practice, with OIG's contractor data, is set out in utilization management outsourcing.
Settings the plan owns: clocks, thresholds and who may deny
Where Utilization Management Automation fits among UM vendors, and where it does not
Utilization Management Automation fits as a technology layer a plan runs over the doors and platform it already has. Its six agents set every clock at receipt, read every page, chase missing records, predict the likely outcome, route each request to a reviewer who can decide it, and write the timestamps behind the public metrics. Nurses approve; physicians make every partial or adverse decision; compliance signs the metrics; the UM operations manager owns every setting. Against the matrix, it answers the clock, denial-authority, committee-approval and metrics rows from its own design, and gives a plan the request-level view the oversight rows need.
It does not fit as a replacement for things it is not. It is not a delegated UM service: Botminds does not review requests or decide them for a plan. It is not criteria content. It is not the plan's UM platform of record, and it does not list the 2027 Prior Authorization API among its connections. Its figures in this guide are from fictional sample data or design targets, not customer results. A plan that wants to test it should do what this guide recommends for every vendor: replay a sample of its own closed requests and compare.
The evidence a vendor should be able to export: one row per decision
Questions people ask
What is the difference between a UM vendor and a UM platform?
A platform is software the plan's own reviewers use to record and decide cases; a UM vendor is anyone the plan buys UM from, including platforms, criteria content, delegated review services and technology layers. Only delegated services make decisions in the plan's name, and they bring the plan's oversight duties with them.
Is InterQual or MCG a utilization management vendor?
They are criteria content vendors: clinical screens plans license for reviewers to apply. CMS names them in its 2026 instructions for the annual submission of internal coverage criteria, and its 2023 rule bars Medicare Advantage plans from using such products to change coverage criteria Traditional Medicare already sets.
Should a UM vendor be paid per denial or on savings?
A plan should avoid any structure that rewards denials. Medicaid managed care contracts must ensure UM compensation does not create incentives to deny, limit or discontinue medically necessary services, and a savings share tied to fewer approvals creates exactly that incentive.
Does accreditation make a vendor compliant with CMS UM rules?
No. Accreditation can deem a Medicare Advantage plan compliant only in the areas listed in 42 CFR 422.156(b), and organization determinations and appeals are not among them. The plan must still test clocks, physician review, denial reasons and metrics directly.
How long should a UM vendor evaluation take?
Long enough to replay real requests. A matrix review takes days; a replay of a sample of the plan's own closed requests, compared decision by decision, takes a few weeks and is the only test that shows how the vendor behaves on the plan's cases.