Health Insurance AI Denial Lawsuits: Lessons for Claims Automation Governance

Why Claims Denial Litigation Is a Governance Signal

Over the past 12 months, several lawsuits filed against health insurers have alleged that AI and algorithmic tools were used to deny claims or terminate coverage with little or no individualized clinical review. These are civil complaints, and the underlying allegations have not been adjudicated. But regardless of case outcomes, the complaints describe specific governance failures that any enterprise deploying claims automation should treat as a design checklist:

• Absent or inaccessible audit trails for individual decisions
• Unclear accountability between the AI vendor and the insurer deploying the system
• Human review processes that existed on paper but not in practice

For AI governance leaders, the value of this litigation is not legal precedent. It is a documented account of what regulators and courts consider evidence of inadequate oversight.

What the Complaints Describe

Estate of Lokken v. UnitedHealth Group

Filed in the District of Minnesota in November 2023, this suit alleges that UnitedHealth and NaviHealth used the nH Predict AI model to deny post-acute care to Medicare Advantage patients, overriding the determinations of treating physicians. The complaint further alleges that human clinical reviewers had limited practical ability to deviate from AI-generated recommendations, reportedly because performance metrics were tied to algorithm compliance.

Barrows v. Humana

A related suit makes similar allegations regarding the same algorithm's use in terminating skilled nursing and rehabilitation coverage. As with the UnitedHealth complaint, the central allegation is that a human reviewer was nominally in the loop but structurally unable or unincentivized to exercise independent judgment.

Kisting-Leung v. Cigna Health and Life Insurance Co.

Filed in the Eastern District of California in July 2023, this complaint alleges that Cigna's PXDX system allowed physicians to batch-deny claims at an average of 1.2 seconds per claim. The complaint asserts that formal physician sign-off did not reflect substantive individualized medical review.

Regulatory Expectations Now in Place

Two regulatory developments give these governance gaps a direct compliance dimension.

State adoption of the NAIC bulletin is not uniform. Governance programs should verify applicable state guidance rather than assume a single national standard applies.

Technical Controls to Close the Audit Trail Gap

The complaints and regulatory guidance together point to a set of technical controls that claims automation architectures should address:

• Immutable decision logging: Every AI-assisted claim decision should generate a tamper-evident log capturing model version, input data, model output, and the reviewer action taken.
• Model version traceability: The specific model version and configuration active at the time of each decision must be identifiable in retrospect, including any updates or reconfigurations that occurred between deployment and the decision.
• Human-in-the-loop enforcement: Workflows should technically enforce a genuine review checkpoint, not merely record that a reviewer was present. This includes structured fields requiring documented rationale when accepting or overriding an algorithmic recommendation.
• Override rate monitoring: Anomalously low override rates can indicate that reviewers are not exercising independent judgment. Monitoring should flag denial spikes or override rate anomalies by claim type, model version, and reviewer cohort.
• Vendor audit cooperation: Contracts with AI tool vendors should include data-retention commitments, audit-cooperation clauses, and access rights sufficient to respond to regulatory inquiry or discovery.

Policy and Ownership Controls

Technical controls require corresponding policy and accountability structures to be effective:

• A named AI governance owner accountable for claims automation systems, distinct from the vendor relationship manager
• Documented roles and responsibilities for human reviewers, including explicit authority to deviate from algorithmic recommendations without performance consequences
• Periodic review of denial rates and override patterns as a governance metric, not only as an operational one
• Third-party vendor onboarding criteria requiring disclosure of model training data, update cadence, and validation methodology for tools used in coverage decisions
• Documented escalation paths when algorithmic output conflicts with treating physician determinations

Evaluation Questions for Governance Leaders

Use the following questions to assess your current claims automation governance posture against the gaps described in this litigation and the regulatory record:

• Can the system produce an immutable audit trail showing model version, inputs, and reviewer action for any individual denial?
• Does the workflow technically enforce a genuine human review checkpoint, or do design and incentives default to the algorithm's output?
• Is documentation available to demonstrate individualized medical necessity review, consistent with CMS Medicare Advantage requirements?
• Is model monitoring in place to detect abnormal override rates or denial spikes by claim type or model version?
• Do vendor contracts include audit-cooperation and data-retention commitments in the event of regulatory inquiry or discovery?
• Are reviewer performance metrics structured to avoid penalizing deviation from algorithmic recommendations?

Where Runtime Governance Fits

The gaps described across these lawsuits, missing audit trails, unclear model accountability, and human review that exists in name but not in substance, are runtime problems as much as policy problems. Runtime governance is designed to enforce oversight at the point of decision: logging model and agent actions as they occur, applying policy controls before an automated output reaches a downstream system, and maintaining an audit record that reflects what actually happened rather than what a policy document says should happen.

For claims automation specifically, that means the ability to enforce and log human checkpoints, track model version at the moment of each decision, and produce records that hold up under regulatory or litigation scrutiny.

Trussed AI provides runtime governance and security controls for enterprise AI systems, including audit logging, runtime policy enforcement, and oversight mechanisms relevant to the accountability gaps described in this litigation.