Ever since health insurers began engaging in utilization review, consumers have expressed frustration and anger over the process. Decades ago when HMOs were widespread, the frustration and anger tended to be directed toward the faceless bureaucrats or “bean counters” who were overruling the patient’s treating physician. Today, as Professor Oliva establishes in her article, Regulating Healthcare Coverage Algorithms in the Shadow of ERISA, coverage denials are often generated by a proprietary AI rather than a human reviewer. These coverage algorithms process prior authorization requests and claims at a speed no human could match, trained on data optimized for cost containment, shielded from scrutiny by trade secret claims, and subject to essentially no regulatory oversight.
When algorithmic coverage denials are combined with ERISA’s notoriously limited remedies and broad preemption of state law, consumers find themselves in a Kafka-esque situation with limited ability to obtain the coverage to which they are entitled. And this situation is not rare. As Professor Oliva’s article carefully explains, one recent survey found that 84% of health insurers utilize AI or machine learning, with most using these tools for utilization management and prior authorization. Further, some widely-used coverage algorithms are alleged in litigation filings to have overturn rates of ninety percent on appeal.
Against this backdrop, Professor Oliva makes the case for a novel solution to the problem: state products regulation of the software platforms used to make algorithmic coverage decisions. The specific proposal borrows various elements of the FDA’s approach to high-risk medical devices, arguing that coverage algorithms should be subject to a form of pre-market review and post-market surveillance because, like medical devices, these algorithms may cause potentially serious risks to life or health.
I found the products-regulation proposal to be an extremely clever solution to a difficult legal problem. First, it arguably avoids the ERISA preemption concerns that ordinarily doom state health reform efforts. By regulating the software product, rather than the activities or actions of an employer-sponsored health plan, the state law should at least arguably be analyzed as a law of “general applicability” rather than a state law that “relates to” an employee benefit plan. And laws of general applicability, including product safety regulation, have never been understood to fall within ERISA’s preemptive reach, even when the products in question are purchased and used by ERISA plans. States regulate the practice of pharmacy, impose taxes on insurers and employers, and regulate software used by plan administrators and medical providers, without anyone seriously arguing that ERISA displaces those requirements. Coverage algorithms, Oliva argues, are no different.
Second, the article situates the issue of AI coverage denials within a consumer protection frame, rather than as a problem of insurance regulation which, among other things, influences the institutional design of the proposal. Rather than assigning regulatory authority to state insurance commissioners — who are both ill-suited to evaluate complex AI systems and structurally constrained by ERISA’s jurisdictional limits — Oliva proposes a model Algorithm Validation Act implemented by specialized state Algorithm Policy Offices, staffed with data scientists, biostatisticians, health services researchers, and civil rights lawyers. The framework requires premarket validation before any coverage algorithm may be deployed, ongoing post-market surveillance, transparency obligations sufficient to support patient appeals, and meaningful enforcement including a private right of action. Crucially, the regulatory obligations attach to algorithm vendors, not to health plans, ensuring that the same algorithm is subject to the same standards whether deployed by a Medicare Advantage plan, a fully-insured commercial plan, or a self-insured ERISA plan.
Oliva is admirably candid about the limits of her argument. She acknowledges that ERISA preemption doctrine is notoriously indeterminate and that courts could read it expansively against state algorithm regulation. Her point is not that such regulation is litigation-proof, but that it is more defensible than alternatives — particularly given that waiting for federal action is not a viable alternative. Even under a more skeptical preemption analysis, she notes, state algorithm regulation would reach state and local government health plans, church plans, Medicaid managed care organizations, Medicare Advantage plans, and fully-insured ERISA plans — leaving a regulatory gap only for self-insured employer plans, which is a meaningful improvement over the current regime of nothing.
I also admired the article’s willingness to forcefully counter some specious arguments that might be made by insurers and software vendors against the article’s proposal. For example, in responding to the potential objection that her proposal will “stifle innovation,” Oliva plainly states that if pre-market validation of a coverage tool deters development of a product, that is innovation that should be deterred, “If validation requirements make it uneconomical to market a clinically unsound algorithm, that is a regulatory success.”
This article is important and timely in the most straightforward sense: automated systems are already governing access to chemotherapy, post-surgical rehabilitation, and life-sustaining medication, with nearly no meaningful external checks. Oliva offers states a legally grounded, institutionally coherent framework for changing that.
