A denial that cannot exist without a cited reason.

The denial stood because almost nobody appeals.

In the nH Predict litigation (Estate of Lokken v. UnitedHealth), plaintiffs allege a predictive model drove post-acute coverage denials at scale, and that roughly 90% of appeals were overturned. Yet the denials held, because only about 0.2% of patients ever appealed. The harm was not only a wrong answer. It was a confident answer with no contestable reason attached, issued faster than any human could review it.

Regulators moved. From 1 January 2026, CMS-0057-F requires payers to give a specific reason for every prior-authorization denial and to publish approval, denial and overturn metrics. California SB 1120 (the Physicians Make Decisions Act) requires a licensed clinician, not an algorithm alone, to make medical-necessity denials, and the NAIC Model Bulletin puts AI-use governance on insurers. The compliance bar is now exactly the thing nH Predict allegedly lacked: a cited reason and a human in the loop.

Sources: CMS-0057-F Interoperability and Prior Authorization Final Rule (specific-reason mandate, eff. 1 Jan 2026); Estate of Lokken v. UnitedHealth Group (nH Predict / naviHealth class action); California SB 1120; NAIC Model Bulletin on the Use of AI by Insurers.

A score that "predicts" a denial is the whole problem.

The tempting build is a model that reads the chart and outputs a medical-necessity probability: approve above a threshold, deny below. It demos beautifully, and it is exactly the failure mode now under litigation, for three reasons.

• Silence ≠ unmetThe fatal collapse. A chart that never mentions a failed therapy course does not thereby prove therapy was skipped. A scoring model treats missing evidence as negative evidence and denies. The correct behavior is to abstain, because you cannot deny on an absence.
• No citable reasonUncontestable by construction. "Risk 0.86" is not a reason a patient can appeal. CMS-0057-F now requires a specific criterion; a probability cannot be one.
• No human gateSpeed becomes the harm. An auto-denial issued in milliseconds, at a 0.2% appeal rate, means wrong answers stick. SB 1120 requires a licensed clinician on adverse determinations.

So the real job is not prediction. It is evaluating a published checklist against an incomplete chart, scoring each criterion as met, unmet, or unknown, and refusing to let "unknown" ever become "deny."

The decision is made in code. The model only finds the fact and puts it into words.

This is the load-bearing line of the whole system. A published, versioned ruleset evaluates each criterion, and the disposition rule computes the verdict. Both run in deterministic code, reproducible down to the hash. The model sits strictly downstream and stays read-only: it checks whether each criterion's fact appears in the chart and returns a verbatim citation. It never assigns a disposition, and it can never turn an absence into a denial.

The structural guarantee lives in one place. A criterion becomes unmet only when the chart contains an explicit contradicting fact. Absence of evidence is unknown, and the disposition rule routes any unknown to a human. There is no code path from "silent chart" to "denied."

# the load-bearing decision , every verdict comes from here, never from a model
def decide(proc_id, note):
    proc = RULES["procedures"][proc_id]
    results = [evaluate_criterion(c, note) for c in proc["criteria"]]

    # a denial REQUIRES a provably-unmet criterion, cited
    unmet = first(r for r in results if r.status == "unmet")
    if unmet:
        return Disposition("DENY", cited=unmet)        # CMS-0057-F specific reason

    # silence is UNKNOWN, never "deny" , abstain to a clinician
    unknown = first(r for r in results if r.status == "unknown")
    if unknown:
        return Disposition("ROUTE_TO_REVIEW", cited=unknown)

    return Disposition("APPROVE")                      # only when ALL criteria met

def evaluate_criterion(crit, note):
    # a NEGATIVE cue (explicit contradiction) is the ONLY route to "unmet"
    if any(cue in note for cue in crit.neg_cues): return Result("unmet")
    if any(cue in note for cue in crit.pos_cues): return Result("met")
    return Result("unknown")                           # absence != contradiction

Excerpt. The JavaScript engine in the live demo mirrors this exactly, so the on-screen verdicts and the published Python are the same function.

The flagship: the same chart a black box denies, the engine abstains.

Request AR-5001 is an 82-year-old, day 18 post-hip-fracture, in a skilled nursing facility. This is the exact nH Predict scenario. The chart documents a skilled need and that goals are not yet met. It is silent on one thing: whether the patient is participating in therapy this week. Watch the two systems diverge on identical input.

It cuts the other way too. Request AR-5003 does say "refusing therapy for the last four sessions." That is an explicit contradiction of the participation criterion, so the engine denies, and the denial ships with the verbatim cited phrase in CMS specific-reason format, signed by a named reviewer. A real unmet criterion gets a real, contestable denial. A silent one never does.

What the suite shows, stated flatly, and what it cannot claim.

Run over the seeded synthetic suite of 20 requests across 5 procedures, the engine produces 7 approvals, 8 denials, and 5 routed-to-review. Every one of the 8 denials carries a cited unmet criterion; zero denials are issuable without one. All 5 chart-silent cases, and only those, abstain to a clinician. Every determination, approve or adverse, emits a replayable criterion-by-criterion appeal packet whose ledger hash re-verifies.

Where these numbers come from. I authored both the ruleset and the charts, so these counts are true by construction. They prove the mechanism holds, not that it survives a real payer's ledger. The "0 denials without a citation" claim is the strongest one here precisely because it is structural rather than statistical. It is a property of the control flow shown above, not a measured rate that could regress on new data.

The honest limits, in plain terms. Real MCG/InterQual criteria are proprietary; mine are a clearly-labelled synthetic stand-in. Medical necessity is genuinely contestable, and whether a fact is "present" in a chart is often a clinical judgement this demo collapses into a simple met/unmet/unknown. Real extraction is probabilistic. It would need calibration and a confidence floor below which it must abstain. So what this demonstrates is a control architecture that cites or abstains, keeps a human in the loop, and leaves a tamper-evident trail. It is not a system that adjudicates care correctly, and I make no such claim. The synthetic-ruleset disclaimer stays visible in the app for exactly this reason.

A flipped verdict breaks the chain at exactly that row.

Every determination is written to an append-only, hash-chained ledger: ruleset version, the criterion-by-criterion evidence, the CMS-style reason, the reviewer's identity, and the appeal packet. Each entry's hash covers its own contents and the previous hash. The Tamper button does the nH Predict move. It silently flips an adverse determination to APPROVE without recomputing its hash, and Verify chain catches it at the altered row. Replay re-derives every disposition from its stored request and confirms it reproduces, bit-for-bit.

seq         : 14
request     : AR-5001  (continued SNF stay)
ruleset     : SYN-MEDNEC v1.4.0   [SYNTHETIC]
disposition : ROUTE_TO_REVIEW
evidence    : [C1:met("skilled need"), C2:unknown, C3:met("goals not met")]
cited       : C2  (participation , chart silent → abstained)
reviewer    : Dr S. Lindqvist, MD   (named clinician, HITL)
prev_hash   : 3af1c2e9
hash        : 9b7e04d1   ← = fnv1a(prev_hash + canonical(record))

See it run.

Pick any of the 20 synthetic requests and watch the criteria resolve met / unmet / unknown, with the cited line highlighted in the chart. Then open the flagship case, flip Black-box against Governed on the same note, and build the appeal packet in one click.