How US Healthcare Works, Part 5: Coverage Policy

Part 3 assumed every service was covered and only asked how the cost is split. Part 4 gave the codes a claim is written in. Between those sits a question that comes first: will the plan pay for this service, for this patient, for this reason? The answer lives in coverage policy, the written rules that tie procedure codes to the diagnoses and circumstances under which a payer considers them medically necessary.

1. Covered benefit and medical necessity are two tests

A service has to pass two separate tests before a plan pays for it.

1. Is it a covered benefit? The plan document lists what the plan covers and excludes. Cosmetic surgery, most adult dental care and experimental treatments are typical exclusions. This is a contract question.
2. Is it medically necessary for this patient? A covered benefit still isn't paid if it wasn't appropriate for the patient's condition. An MRI is a covered benefit; an MRI of a knee for an ear infection is not medically necessary. This is a clinical question.

Coverage policy is mostly about the second test: it writes down, service by service, what counts as medically necessary.

2. Medicare: "reasonable and necessary"

For Medicare, the starting point is one sentence in the Social Security Act, section 1862(a)(1)(A): Medicare doesn't pay for items and services that are "not reasonable and necessary for the diagnosis or treatment of illness or injury". Everything below is an attempt to turn that sentence into specific rules.

There are two levels.

National Coverage Determinations (NCDs). CMS itself decides how Medicare covers a service across the whole country. An NCD can cover a service, cover it only under listed conditions, or not cover it. The process is public: CMS opens a national coverage analysis, reviews the evidence, posts a proposed decision for comment and then a final one.

Local Coverage Determinations (LCDs). Where there is no NCD, the Medicare Administrative Contractor (MAC) for a region can write its own policy. LCDs used to differ a lot between regions. Today MACs often coordinate and adopt the same LCD, but differences remain. Each LCD usually comes with a billing and coding article that lists the actual ICD-10 and CPT codes: which diagnosis codes support the service, which modifiers to use, what documentation is required.

All of these are public, in the Medicare Coverage Database.

3. An example: two knee operations

Maria's knee surgery in part 3 shows why the details matter. Medicare's NCD 150.9, in effect since 2004, doesn't cover three uses of arthroscopy in an osteoarthritic knee:

• lavage (washing out the joint) on its own,
• debridement (removing loose fragments) when the patient's only complaint is knee pain, and
• lavage or debridement for severe osteoarthritis (Outerbridge grades III and IV).

CMS's reason was that controlled studies hadn't shown these procedures work. A 2002 randomized trial had found that they did no better than a placebo operation. Debridement for milder arthritis with mechanical symptoms, such as locking, is left to each MAC to decide. But an arthroscopic meniscectomy to repair a torn meniscus, the operation Maria had, isn't affected. Same joint, same type of scope, similar CPT codes: one is covered, one isn't, and the difference is entirely in the diagnosis and the documentation. A claim system enforces this by checking the diagnosis codes on the claim against the codes the policy allows for the procedure.

4. Coverage with Evidence Development

Sometimes the evidence for a new service is promising but incomplete. Medicare can cover it only for patients enrolled in an approved study or registry, so that the data needed to decide fully gets collected. This is coverage with evidence development (CED). Transcatheter heart valve replacement and some new Alzheimer's drugs have been covered this way. For the claim system it means an extra check: is this patient in the registry?

5. Medicare Advantage: Medicare's rules, plus a narrow door

A Medicare Advantage plan has to cover everything traditional Medicare covers. Until recently, plans could apply their own, stricter internal criteria, and a 2022 report from HHS's Inspector General found that 13% of the prior authorization requests that MA plans denied in a sample from June 2019 met Medicare's coverage rules and would likely have been approved under traditional Medicare.

CMS's 2024 rule, CMS-4201-F, tightened this. From 2024:

• MA plans must follow NCDs, LCDs and the coverage rules written into Medicare law.
• They may use internal coverage criteria only when Medicare's criteria are "not fully established", and those criteria must be based on current evidence in widely used treatment guidelines or clinical literature.
• Internal criteria must be publicly available, with the evidence behind them.

Part 9 comes back to how MA plans apply these rules in utilization management.

6. Commercial plans: medical policies

Employer and marketplace plans aren't bound by NCDs or LCDs. Each insurer writes its own medical policies, also called clinical policy bulletins or coverage policies. A typical policy covers one service or drug and has the same structure:

Policy:       Knee arthroscopy
Covered when: listed diagnoses, plus conditions (failed conservative treatment
              for 6 weeks, imaging showing a specific finding, ...)
Not covered:  listed situations considered not medically necessary
Experimental: uses considered experimental or investigational
Codes:        CPT/HCPCS and ICD-10 codes the policy applies to
Evidence:     the studies and guidelines it rests on
Review date:  policies are reviewed, usually yearly

Most large insurers publish their policies online. Policies often follow Medicare's lead, but can be stricter or more generous, and they differ between insurers.

Commercial policy is also shaped by:

• State mandates. Many states require fully insured plans to cover particular services, such as autism therapy or fertility treatment. As part 2 explained, self-funded employer plans under ERISA usually don't have to follow them.
• The ACA. Marketplace and small-group plans must cover the ten essential health benefit categories, defined state by state through a benchmark plan, and most plans must cover recommended preventive services with no cost sharing.
• The employer. A self-funded employer can choose to cover or exclude services, within federal law.

7. Medicaid

Each state sets its own Medicaid coverage policy within federal rules, and each managed care plan in a state follows the state's rules, sometimes with its own policies on top. One federal rule is unusually broad: for members under 21, the EPSDT benefit (Early and Periodic Screening, Diagnostic and Treatment) requires states to cover any medically necessary service that federal law allows Medicaid to cover, even if the state doesn't cover it for adults.

8. The criteria vendors

Writing evidence-based criteria for thousands of services and hospital admission decisions is a lot of work, so most payers license criteria sets from two vendors instead of writing all of them:

Payers apply these criteria during utilization management (part 9). Hospitals often license the same criteria, so both sides can argue a case in the same terms. The criteria themselves are proprietary, which is one of the transparency complaints that the MA rule in section 5 tries to address.

9. From policy text to claim edits

A policy is written in English. A claim system needs rules it can run. So payers translate each policy into configuration:

IF procedure in {29877, ...}                       -- the arthroscopic codes in scope
AND primary diagnosis in {knee osteoarthritis codes}
AND no diagnosis in {meniscal tear codes, ...}
THEN deny, reason: not medically necessary per policy

Some rules run automatically on every claim. Others can't be checked from codes alone, such as "failed six weeks of physical therapy", so the payer either requires prior authorization (part 10) or reviews the medical record after the claim arrives. Keeping hundreds of policies, thousands of codes and yearly code updates in sync with claim edits is a large part of a payer's configuration work, and a common source of wrong denials.

10. Where coverage policy is weak

• Evidence is uneven. Many common services have never been tested in good trials, so policies rely on expert opinion, and two reasonable payers can disagree.
• Policies lag the evidence, in both directions: some keep covering services shown not to work, and some take years to cover new ones that do.
• What a policy means depends on documentation. The same patient can pass or fail a policy depending on what the doctor wrote down.
• Transparency varies. Medicare's rules are public and open to comment. Commercial policies are published, but the proprietary criteria they rely on often aren't.

Remember

Next, in part 6: eligibility and enrollment, how members get into a payer's system, how a provider checks coverage before a visit, and what happens when a person has two plans.

Sources

• Social Security Act, section 1862
• CMS, Medicare Coverage Database and NCD 150.9
• CMS, Contract Year 2024 Medicare Advantage final rule (CMS-4201-F)
• HHS Office of Inspector General, Some Medicare Advantage Organization Denials of Prior Authorization Requests Raise Concerns (2022)
• Medicaid.gov, Early and Periodic Screening, Diagnostic, and Treatment