Utilization management review records for payer medical-necessity AI

This page is for teams building on the payer side. If your model reads provider submissions rather than reviewer work, start with prior authorization submission packets and payer decisions; for the broader category, see the industry-specific operational data hub.

What a usable UM case record contains

A usable UM record is a linked case, not a pile of notes: every artifact should join on a stable case key and carry timestamps for each step. Most payers run UM in platforms such as a care management or UM workflow system that stores intake, clinical review queues, medical director referrals and letters as separate objects. Ask suppliers which objects they can export and whether the joins survive de-identification.

The core fields, in rough review order:

• Request: case key, review type, service category, CPT/HCPCS and ICD-10-CM codes, requested units or days, place of service, urgency flag (standard or expedited), received timestamp.
• Clinical summary: the nurse reviewer's abstracted vitals, labs, imaging findings, functional status and prior treatments, plus attached clinical document references.
• Criteria applied: criteria product and version identifier, guideline or subset ID, met/not-met per criterion, and whether a medical policy or Medicare national or local coverage determination was cited instead.
• Reviewer notes: first-level nurse note, escalation reason, physician reviewer note and specialty, peer-to-peer date and result.
• Determination: approve, partial approve, deny, withdrawn; denial reason code and letter text; decision timestamp.
• Downstream outcome: internal appeal, external review, overturn flag, and the paid claim, if any, linked by claim key.

Prospective, concurrent and retrospective review are different tasks

Treat the three review types as separate label distributions, because the evidence available and the question asked differ in each. Prospective (pre-service) review decides whether to authorize a planned service. Concurrent review covers inpatient or post-acute stays day by day: level of care, additional days, discharge readiness and observation versus inpatient status. Retrospective review judges services already delivered, often with the full chart.

A model trained on mixed records without a review-type field will learn shortcuts, such as treating length of stay as a proxy for denial. Ask for concurrent records at the review-day grain (one row per review event, with bed day and level of care) and for prospective records with the decision timeframe captured, since CMS-0057-F set 72-hour expedited and 7-calendar-day standard timeframes for impacted payers' non-drug prior authorization decisions from January 2026 and requires a specific reason for denials [4].

Rules on AI in coverage decisions shape the data you need

Regulators allow algorithms to assist UM but require determinations to rest on the individual patient's circumstances and, in some states, on a licensed clinician's judgment, so training data has to support individualized rationale. As of October 2026, CMS's February 2024 FAQ to Medicare Advantage organizations says plans must base medical-necessity determinations on the individual's circumstances under 42 CFR 422.101(c) [1]. Summaries of that FAQ note that a determination resting on a larger data set rather than the patient's own history, physician recommendation or clinical notes would not comply [2].

California's SB 1120, effective January 2025, requires that medical-necessity determinations be made by a licensed physician or other competent licensed professional and that tools rely on the enrollee's own records rather than solely on a group dataset [3]. Other states have introduced or passed similar bills; verify each statute before relying on it. For a buyer, the practical consequences are:

• Train toward rationale and evidence retrieval (which note supports which criterion), not toward a bare approve/deny label.
• Keep the physician-reviewer step as a distinct field so evaluation can separate nurse-level triage from final determinations.
• Retain per-case criteria evidence so an auditor can trace any model suggestion to the patient's record.

This page is general information, not legal advice. Confirm requirements with counsel for your jurisdiction and use case.

Criteria sets, policy text and the label-quality problem

Commercial criteria sets are licensed content that a payer usually cannot redistribute, so ask for criteria identifiers and per-criterion met/not-met flags rather than the criteria text itself. Pair those identifiers with your own license to the criteria product, or with the plan's public medical policies; see payer medical and coverage policy documents for RAG for that corpus.

Historical denials are noisy labels. Policies change mid-period, some denials were overturned on appeal, and some reflect missing documentation rather than clinical judgment. Use appeal, external review and peer-to-peer outcomes to audit labels, and request the policy effective dates so you can drop cases decided under retired criteria. The approach mirrors outcome-labeled evaluation data: the later outcome checks the earlier decision. Also screen for templated letter language and canned reviewer phrases, covered in boilerplate and template text in business records.

De-identifying UM records without destroying date logic

UM records are protected health information, and most reviewer-assist work needs the timing that Safe Harbor removes, so Expert Determination is usually the right route. Safe Harbor requires removing 18 identifier types, including all date elements more specific than year [5][6]. That erases admission-to-review intervals, decision turnaround and concurrent-review day counts.

Expert Determination lets a qualified expert keep shifted or relative dates when re-identification risk is shown to be very small, at higher cost and with more documentation [7]. A limited data set under a data use agreement keeps dates but stays PHI [6]. Free-text reviewer notes need PHI detection and surrogate replacement; see de-identifying clinical free text for LLM training and how to review an Expert Determination report. Behavioral health cases may include substance use disorder records under 42 CFR Part 2, whose 2024 final rule had a compliance date of February 16, 2026 [8]; ask whether those cases are flagged or excluded.

Illustrative UM case record

The record below shows the linkage and field grain worth asking for. Note criteria IDs instead of criteria text and relative dates in place of calendar dates.

Illustrative example: invented to show structure; it does not describe an available dataset.

{
  "case_key": "UM-7f3a91",
  "review_type": "concurrent",
  "line_of_business": "medicare_advantage",
  "service": {"setting": "inpatient", "icd10_primary": "J44.1", "requested_days": 3},
  "review_day": 4,
  "days_from_admit": 3,
  "criteria": {"product_id": "CRITERIA_VENDOR_A", "version": "2025", "guideline_id": "G-RESP-012",
               "met": ["oxygen_requirement"], "not_met": ["iv_therapy_ongoing"]},
  "nurse_note": "[SURROGATE] Pt on 2L NC, SpO2 93%, transitioned to oral steroids day 3...",
  "physician_review": {"specialty": "internal_medicine", "outcome": "partial_approve", "approved_days": 1},
  "peer_to_peer": {"held": true, "days_from_decision": 1, "result": "upheld"},
  "determination": {"code": "PARTIAL", "denial_reason_code": "LOC_NOT_MET", "decision_hours": 20},
  "appeal": {"level": "internal", "outcome": "overturned"},
  "deid": {"method": "expert_determination", "date_handling": "relative_to_admit"}
}

Buyer checklist for a UM data request

Use this checklist to scope a request and compare supplier responses before diligence.

Healthcare administration buyers can also see Healthcare Administration AI Training Data, buyers by industry: healthcare administration and licensing medical records for AI training.

How SourceX handles UM review data requests

SourceX sources operational datasets from US companies on request; it holds no stock, and a request does not guarantee a match. Buyers describe the records they need, and SourceX looks for US businesses that hold them; every release is approved by the supplying company. Each dataset is rights-reviewed for ownership and consents, and health records require HIPAA de-identification by Safe Harbor or Expert Determination. Delivery runs through private, access-controlled workflows only after an executed agreement and supplier approval. You can describe your UM data requirements to SourceX using the checklist above.

Request utilization management review data

SourceX manages the process from Find and Assess through Agree, Transact and Manage, and nothing is contracted until a supplier agrees. Terms, including allowed uses, are set in a license for each deal, and SourceX does not train models. To scope UM case records for a reviewer-assist or audit model, start a buyer request.