Recent reports have heightened scrutiny of state oversight of utilization management (UM) in Medicaid managed care. In 2023, the U.S. Department of Health and Human Services Office of the Inspector General documented high and variable rates of prior authorization denials across state Medicaid programs and their contracted managed care organizations (MCOs). In 2024, the Government Accountability Office examined how Medicaid agencies oversee MCO UM for childhood preventive care services and found that state and federal oversight was not necessarily sufficient to ensure MCOs were making appropriate prior authorization decisions for Early and Periodic Screening, Diagnostic, and Treatment (EPSDT) services. Ongoing work from the Medicaid and CHIP Payment and Access Commission (MACPAC) on Medicaid managed care also points to gaps in existing federal and state oversight activities and makes recommendations for improvement.

Against this backdrop, current Medicaid budget pressures — compounded by passage of the 2025 budget reconciliation act (P.L. 119-21) — may further constrain MCO rates and reinforce incentives to deny care, despite requirements such as medical loss ratios designed to support appropriate UM decisions. In this context, Medicaid agencies that contract with MCOs play an important role in developing, updating, and enforcing policies and contract requirements governing MCO‑led UM. This oversight helps balance the need to limit low-value care and control costs with ensuring access to medically necessary care and minimizing administrative burden.

Rigorous oversight takes substantial time, resources, and expertise, and states face many challenges in overseeing managed care contracts. To better understand how states approach UM oversight and successful strategies for effective implementation, the Center for Health Care Strategies (CHCS) reviewed managed care contracts in select states and interviewed experts in the field. This brief highlights seven practical strategies states are using to strengthen accountability, enhance transparency around UM practices, and protect access to care. *These findings can be helpful to states as they review their policies. Further research and peer-to-peer sharing can help to assess the effectiveness of these strategies and identify additional practices for UM oversight and accountability.

---

*This brief discusses UM related to physical and behavioral health care. UM for pharmacy coverage is not included because it uses differing approaches (e.g., preferred drug lists, step therapy) and impacts additional stakeholders (e.g., drug manufacturers, pharmacy benefit managers).

---

State Strategies to Improve MCO Oversight and Accountability in Utilization Management

Following are select strategies that state Medicaid programs are using to strengthen oversight and accountability for MCO-led UM functions, while also providing flexibility for MCOs and providers where warranted. States can explore these approaches and consider how to tailor them to their specific program goals and unique context.

1. Reduce select MCO prior authorization requirements to decrease burden and improve access to care.

While prior authorization requirements can be a necessary part of the MCO’s role in controlling inappropriate or low-value service use, prior authorization requests require substantial time from providers. Both patients and providers worry that these requirements limit access to care — especially in Medicaid managed care, where denial rates tend to be higher than in Medicare Advantage, for example. In response, state Medicaid agencies are working to address these concerns while maintaining MCOs’ role in overseeing utilization. These efforts include enacting or piloting approaches to ease burden at different levels by reducing requirements tied to individual services, providers, and provider types.

MCOs around the country have employed “gold carding” strategies, which allow providers with a strong history of prior authorization approvals to skip prior authorization for specific services. This approach reduces administrative burden on providers with high approval rates, speeds patient access to certain services, and can lift the burden on MCOs by limiting the number of prior authorization requests.

Some states are interested in expanding or standardizing this practice. For instance, Illinois enacted legislation requiring each Medicaid MCO to grant a gold card to providers who submitted at least 50 service authorization requests in the prior year with 90 percent or higher approval. The gold card would exempt providers from prior authorization requirements for all inpatient and outpatient care, except for pharmacy services or durable medical equipment. Gold card status can be suspended if the provider’s approval rate falls below the 90 percent threshold upon periodic review by the MCO or a third-party reviewer. The legislation applies to services provided on or after July 1, 2025.

In Rhode Island, a three-year pilot was launched in October 2025 that eliminates prior authorization requirements for services ordered by primary care providers (defined as medical doctors, doctors of osteopathic medicine, nurse practitioners, and physician assistants practicing in primary care specialties) in the normal course of treatment (prescription drugs are exempted). The pilot is overseen by a statewide advisory committee run by the state’s Office of the Health Insurance Commissioner and co-chaired by both a provider and an MCO representative. MCOs must submit annual reports to help assess the pilot’s value in reducing provider burden, increasing access to care, and influencing the overall cost of care.

In California, legislation passed in October 2025 is testing a pilot to decrease prior authorization by requiring MCOs to report the percentage of services approved after prior authorization submission and then prohibiting prior authorization for services with approval rates of 90 percent or higher. The state will evaluate the pilot’s impact within four years.

2. Work with MCOs to centralize and standardize prior authorization requirements.

Differing prior authorization standards across MCOs, lines of business, and states can contribute to substantial administrative burden for both MCOs and providers. Centralizing and standardizing these processes can decrease this burden. States can invest in technology — such as a centralized portal for electronic prior authorization submission and response — to streamline communication. They can also create contract requirements to jointly develop administrative simplification efforts with Medicaid MCOs, while continuing to allow MCOs flexibility to oversee utilization.

For example, Kansas’ managed care contract requires MCOs to work with the Medicaid agency, providers, and other MCOs to develop a “standardized Prior Authorization form [or] submission elements.” This approach allows providers and MCOs to weigh in on the standardized format with the goal of decreasing variation in administrative requirements. Hawai’i’s managed care contract requires MCOs to participate in state‑led administrative simplification efforts for prior authorization. MCOs must report on “progress in implementing innovative and streamlined UM programs,” providing a mechanism for ongoing monitoring and adjustment.

States can also encourage or require MCOs to offer training that helps providers understand prior authorization requirements. Clear guidance can increase the likelihood that providers will submit prior authorization requests with all necessary information, streamlining the process for both providers and MCOs.

3. Use patient and provider feedback to identify potential problems.

While states meet regularly with contracted MCOs, they may have fewer opportunities to hear directly from Medicaid members and providers about their UM experiences. Members and providers who are most directly affected by prior authorization processes and utilization review can offer insights that help states identify pain points and refine UM practices. States can engage these groups on a regular basis, using both existing and new mechanisms to gather feedback.

For example, states can work with their beneficiary advisory councils (BACs) to hear from members on access issues, referrals, prior authorization, and navigating appeals. These Medicaid member-only advisory councils ideally provide an open and honest space to raise potential issues, which can then be addressed through collaboration with MCOs, provider education, or updates to contract language. States can also gather member input by fielding surveys that ask about access to care and incorporating questions related to UM and prior authorization in existing CAHPS Health Plan surveys.

Grievances, complaints, and critiques from patients and providers can also help states identify challenges — even a small number of similar complaints can reflect a broader systemic issue experienced by many. Although CMS requires MCOs to collect and report grievance data, these requirements are relatively new, reporting may be variable or incomplete, and MCO-created classifications of different grievances may be helpful for MCOs, but less relevant for states. States may consider building on these reporting requirements if additional data collection would be useful. States might also meet with providers and provider associations to get more in-depth insights into complaints and challenges providers face. Information gathered through complaints and grievances can help states identify future work or topics to bring to the BAC, provider groups, or meetings with MCOs.

4. Ensure patients and providers understand adverse determinations and potential next steps.

Under 42 CFR Part 438 and the new 2024 Interoperability and Prior Authorization Final Rule, MCOs must provide timely denial notices with relevant information (e.g., the decision, its rationale, and processes available for appeal). However, these notices may lack certain helpful information — such as the clinical criteria the MCO used to make the adverse determination — and often use legal and clinical language which, while precise, can limit members’ understanding and ability to use the information.

To address this challenge, many states require MCOs to use templates or include specific information when sending out adverse determination notices. New Jersey’s managed care contract, for example, requires specific elements in the notification, including how the enrollee can obtain information that the MCO used to make the determination. The contract also requires MCOs to use a state-approved standardized form — a common approach that allows Medicaid agencies to assess for required language and clarity.

Other states, including Pennsylvania, go a step further by using contract language to require MCOs to use state-provided templates for adverse determination notifications. Pennsylvania’s contract requires MCOs to cite “specific clinical factors that were considered and why the member’s condition did not meet the clinical criteria for approval.” It also requires MCOs to indicate if the request was denied due to insufficient information and to specify what information would be needed to render a decision. The state requires denial notices to be written at a sixth-grade reading level and made available in accessible formats for people with visual impairments or limited English proficiency. Interviewees noted, however, that templates alone may not be sufficient to ensure clarity in these notices. Requiring regular training on using plain language for MCO staff who write adverse determinations may help improve notice accessibility. BACs may also be helpful partners in developing and updating state-provided templates or training to ensure adverse determination notices are clear and actionable for members.

5. Develop contract requirements that promote access to specific services.

Some states include managed care contract requirements to promote access to specific types of care — particularly behavioral health services, home- and community-based services, EPSDT services, and pregnancy-related care. States can also support access to care by requiring that UM clinical criteria align with state goals. For example, Pennsylvania’s managed care contract requires MCOs to submit the clinical guidelines used to make prior authorization decisions to the state for review and approval. The state also requires MCOs to publicly post these guidelines on the MCO’s website.

In New Jersey, the state’s managed care contract specifies that MCOs must use the American Society of Addiction Medicine’s guidance to make UM decisions for substance use disorder services and requires the team overseeing behavioral health decisions receive annual training on these criteria. To ensure staff understand the guidance, MCO staff must undergo competency and inter-rater reliability testing. States can also limit UM activities for specific services, such as Michigan’s contract, that does not allow MCOs to require prior authorization for medically necessary obstetrical and prenatal care, regardless of a provider’s network status. New guidance from CMS also recommends states explore methods to strengthen contract language and review prior authorization decisions to ensure children have access to EPSDT services.

States may also set requirements to ensure continuity of care as policies change or patients move between MCOs and providers. In Louisiana, managed care contracts allow enrollees who are newly enrolled or have switched MCOs to continue to receive services from their existing provider for 30 days — even if the provider is out of network and the services would typically require prior authorization — giving patients and providers time to transition care when needed. Some states also require a transition period when MCOs begin requiring prior authorization for a service, allowing patients to maintain continuity of care and giving providers time to submit a prior authorization request.

6. Consider public reporting to improve transparency and outcomes.

Public reporting of performance can be a powerful tool for managed care oversight and accountability, but it also introduces potential risks, including increasing workloads for MCOs and state staff and straining state-MCO relationships by publicly naming MCOs who miss performance goals. Until recently, public reporting related to UM was not part of federal requirements and while some states added transparency requirements to managed care contracts, it was not common. However, with the creation of the 2024 Interoperability and Prior Authorization Final Rule, starting March 31, 2026, MCOs will have to post UM metrics on their websites, including what services require prior authorization, prior authorization approval and denial rates, and average length of time for making prior authorization decisions. States can help increase awareness of these metrics by linking to them or posting the statistics on state websites.

States can use new public reporting requirements to influence MCO behavior through multiple pathways. For instance, states may be interested in collecting additional information (e.g., prior authorization approval and denial rates by provider or service type), comparing metrics across MCOs to identify and explore outlier behavior, or incorporating specific targets into contracts over time. MCOs may also benefit from public reporting, as it can give them a better sense of their outcomes compared to peers and help to identify over- or under-utilization.

States can also use accreditation bodies, such as the National Committee for Quality Assurance (NCQA) and URAC, and External Quality Review Organizations (EQROs) to support public reporting and transparency. NCQA and URAC accreditation include requirements around UM, which allows states to delegate some oversight to an external body while still ensuring MCOs meet specific requirements. States can request or require that MCOs publicly post data related to UM, including data used to achieve accreditation, and there is overlap between some accreditation standards and the metrics required via the 2024 Interoperability and Prior Authorization Final Rule. EQRO reports are required, but states do not always use reports to their full potential. States can support staff in developing the skills needed to work more effectively with EQROs and use the reporting process to identify the most relevant UM topics and measures, incorporating those priorities into existing assessments.

7. Train and support state staff overseeing UM.

The strategies discussed above can have the most impact if state staff: (1) receive and can analyze relevant information on service utilization, prior authorization submissions, grievances, denials, MCO staffing and workflows, and clinical criteria; and (2) are empowered to act on the findings from these analyses. To achieve this, staff need training and support.

While states receive substantial data through existing reporting requirements, staff may not always have the time or analytic capacity to proactively investigate and identify potential issues. Working with accreditors and EQROs can help, but staff also need the skills to conduct assessments in-house. For instance, training staff to go beyond assessing completion of reports by looking at service- and provider-level trends in prior authorization submission, denial rates, and appeals outcomes and comparing these trends across plans. These types of in-depth analyses are recommended in a CMS Informational Bulletin from March 12, 2026, and can point to potential issues or valuable policy and practice changes. Hiring staff with relevant clinical expertise — a common challenge for states — can strengthen these analyses and help states make full use of the data that MCOs report.

Staff also need to be able to act on their findings. This requires an organizational culture in which leadership welcomes staff questions and concerns, and supports staff with oversight responsibilities as they enforce contractual requirements. It also includes building the state-MCO relationship and identifying ways to work together toward common goals of maintaining access, limiting unnecessary low-value care, and being a good steward of public funds. States can address identified problems in collaboration with MCOs through multiple approaches, such as updating contract requirements, requiring accreditation, and undertaking enforcement activities (e.g., corrective action plans, training, and financial penalties). While these mechanisms may be more or less effective depending on a state’s context, state staff in oversight roles are better positioned to fulfill their responsibilities when they are trained to “own” their role as regulators and when leadership supports their decisions.

Looking Forward

UM is a key strategy MCOs use to minimize low-value and costly care, but states have an important role in overseeing UM policies and processes to ensure accurate decisions that balance goals of cost control, maintaining access to care, and minimizing burden. Driven by public interest, state Medicaid agencies may be interested in reassessing their approach to oversight and accountability of MCO UM policy and processes. While there is no broad agreement on which methods work best, states can employ an array of strategies in their managed care contracts to streamline UM, protect access to care, and build staff capabilities. Additional research and cross-state learning are needed to identify which strategies are most effective, scalable, and align with the goals of states, MCOs, providers, and Medicaid members.