Domain Atlas / Clinical decision support & deterioration alerting
EviCore by Evernorth: the review threshold
Explore this deployment in the PAN Lab ↗
In the PAN Lab, the readouts of this case's model organization carry a shaded evidence band whose width follows the least-established class among the modeling inputs the readings rest on.
The least-established input behind this case's model organization's readings is an assumption, not a measurement. Evidence base: 2 assumed · 8 published baseline.
EviCore by Evernorth (eviCore healthcare MSI, LLC), a Tennessee-domiciled utilization-review entity owned by The Cigna Group since 2018, performs delegated prior-authorization review for more than 100 client insurers — including UnitedHealthcare, Aetna, Blue Cross Blue Shield plans, Medicare and Medicaid contractors, and its own parent — covering about 100 million people, roughly one in three insured Americans. The mechanism is common ground between the company and its critics: an artificial-intelligence-backed algorithm scores each submitted request with a probability of approval, requests above the operating threshold are approved with no clinical review, requests below it route to in-house nurses and then to physicians, and only a physician may issue a denial. The algorithm approves or routes; it denies nothing. On October 23, 2024 ProPublica and The Capitol Forum (T. Christian Miller, Patrick Rucker, David Armstrong; co-published by CNN on November 7), working from internal documents, corporate data and interviews including five former employees, reported that this routing threshold is adjustable and that insiders called it the dial: 'If EviCore wants more denials, it can send on for review anything that scores lower than a 95%,' one former employee said, and a former executive said of the review rate, 'We could control that. That's the game we would play.' The same investigation reports strictness sold as a product feature — a marketed return of three dollars of medical spend avoided per dollar of fees, sales staff touting denial increases of up to 15 percent, insurers including Aetna and Cigna requesting 'high touch' configurations that send more cases to review, and 'risk' contracts under which the vendor keeps or splits what it saves below a client's baseline spending target. EviCore and Cigna dispute this characterization, stating that the company 'uses the latest evidence-based medicine' and that its algorithms exist 'ONLY to accelerate approval of appropriate care and reduce the administrative burden on providers.' The dial and everything hanging off it are the investigation's findings, resting on internal documents and largely unnamed former employees, and are not adjudicated fact.[2]
What happened
EviCore by Evernorth is the largest company in delegated prior-authorization review. Formed in a 2014 merger of two smaller utilization-management firms and owned by The Cigna Group since 2018, it is hired by more than 100 client insurers — including UnitedHealthcare, Aetna, Blue Cross Blue Shield plans, Medicare and Medicaid contractors, and its own parent — to decide whether requested care is medically necessary for about 100 million covered people, roughly one in three insured Americans.
The mechanism is not in dispute, and both sides describe it the same way. A treating practice submits a prior-authorization request with clinical documentation. An artificial-intelligence-backed algorithm scores the request with a probability of approval, measured against clinical criteria the vendor writes itself and against the client insurer's contract configuration. Requests scoring above the operating threshold are approved with no clinical review at all. Requests below it route to in-house nurse reviewers and then to physician reviewers — and only a physician may issue a denial. The algorithm approves or it routes. It denies nothing. That two-step structure is common ground between the company and its critics, and it is the hinge of everything that follows: to change the denial rate you do not change the algorithm's answer, you change how many requests it sends to the people who are permitted to say no.
On October 23, 2024, ProPublica and The Capitol Forum published an investigation by T. Christian Miller, Patrick Rucker and David Armstrong, co-published by CNN on November 7, built on internal documents, corporate data and interviews including five former employees. Its central finding is that the routing threshold is adjustable, and that insiders called it the dial. 'If EviCore wants more denials,' one former employee told the reporters, 'it can send on for review anything that scores lower than a 95%.' A former executive said of the review rate: 'We could control that. That's the game we would play.' The investigation reports that strictness was sold as a product feature — a marketed return of three dollars of medical spend avoided per dollar of fees, sales staff touting denial increases of up to 15 percent, insurers including Aetna and Cigna requesting 'high touch' configurations that send more cases to clinical review, and 'risk' contracts under which the vendor keeps or splits whatever it saves below a client's baseline spending target. 'Where you really made your money was on a risk model,' a former executive said. 'Their margins were exponentially higher.' EviCore and Cigna dispute this characterization. 'Simply put, EviCore uses the latest evidence-based medicine to ensure that patients receive the care they need and avoid the services they do not,' the company said, adding that its algorithms exist 'ONLY to accelerate approval of appropriate care and reduce the administrative burden on providers.' An Evernorth article updated on October 22, 2024 — the eve of publication — states: 'We aren't in the denial business, we're in the approval business.'
Around the contested parameter sits a set of measured signals, each with its own limit. The investigation's analysis of data Arkansas publishes about this vendor's book of business found prior-authorization requests turned down in full or in part almost 20 percent of the time since 2021, against roughly 7 percent for Medicare Advantage plans overall in 2022 — an order-of-magnitude contrast across different populations and programmes, not a controlled comparison, and the analysis is the reporters' rather than a finding Arkansas published. Vermont Medicaid materials showed quarterly denial rates under this vendor's review swinging between 6.1 percent and almost 15 percent. A 2019 Vermont presentation recorded something else again: advanced-radiology requests down 16 percent, to 3,629, and cardiology requests down 38 percent after review began — the deterrence the industry markets as the sentinel effect, in which requests that are never submitted appear in no denial statistic anywhere. A former physician reviewer, maternal-fetal medicine specialist Gail Miller, told the investigation she was required to decide at least 15 cases an hour, one every four minutes, frequently outside her own specialty, and left after nine months. The vendor's own published figures — 500-plus board-certified physicians across 60-plus specialties, 1,200-plus nurses and other clinical specialists, roughly two-thirds of decisions rendered in real time, 90 percent of approvals completed within one business day — are company claims with no independent verification, and the share of requests approved outright rather than routed to review is quantified nowhere public at all.
The one enforcement loop that has closed is small, procedural and admitted. Between September 19, 2023 and January 29, 2024 the Connecticut Insurance Department examined 196 of the vendor's calendar-2021 Connecticut files. Its February 5, 2024 report and stipulation and consent order, Docket MC 24-15, records 77 adverse-determination letters that omitted the mandatory notice of the 120-day external appeal; urgent-care, appeal and retrospective determinations issued past their statutory 48-or-72-hour, 30-day and 60-day clocks; three files whose documentation could not support regulatory review; two denials not reviewed by an appropriate clinical peer; and one appeal decided by the same physician who made the initial denial. eviCore admitted the allegations, paid a $16,000 fine and undertook a corrective-action report within 90 days. These are utilization-review compliance violations. The examination read files, not thresholds, and made no finding about the algorithm or about any denial rate — no regulator on this record has examined a routing threshold. An earlier signal points at the criteria rather than the routing: a 2018 audit by the federal Medicare and Medicaid agency (CMS), which reached this vendor only through its insurer client HCSC, found that outdated eviCore cancer guidelines had produced inappropriate denials for 30 patients, after which the company retrained staff. That the market structure and not one firm carries the incentive is suggested by an adjacent settlement: Carelon, the utilization-management arm of Elevance and formerly its specialty-benefits business, paid $13 million in 2022 over wrongful-denial techniques without admitting fault.
The investigation's central patient account is that of Little John Cupp, a 61-year-old Ohio man whose cardiologist twice sought approval for a left heart catheterization. The vendor's process did not approve it. He underwent the authorized nuclear stress test instead and died of cardiac arrest 36 hours later. Three of the four cardiologists ProPublica consulted considered the catheterization appropriate.
There is no litigation centered on the eviCore screening algorithm as of 2026-08-28. The Cupp malpractice action dropped UnitedHealthcare and eviCore as defendants, the plaintiff's lawyer citing the litigation advantages insurers enjoy in federal court. Greenwood v. Cigna Health and Life Ins. Co. and Evernorth Behavioral Health, a putative class action under the Employee Retirement Income Security Act (ERISA) filed August 22, 2025 over behavioral-health medical-necessity criteria, names a sibling Evernorth unit and not eviCore, and its pleadings are allegations rather than findings. The regulatory record is the Connecticut consent order and nothing else specific to this vendor: the Department of Health and Human Services Office of Inspector General's (HHS OIG) 2022 evaluation of Medicare Advantage prior-authorization denials and the Senate Permanent Subcommittee on Investigations report of October 17, 2024 both examine insurers, and no congressional letter, hearing or subpoena naming eviCore was located.
Two developments close the record as it stands, and they run in opposite directions. On the same April 30, 2026 earnings call, Cigna reported removing hundreds of tests, procedures and services from prior authorization altogether, cutting medical prior-authorization volume by about 15 percent — and announced a strategic review of alternatives for eviCore, contemplating partnership or combination with other industry participants, with no transaction underway per the company. The adjustable parameter's owner may change hands.
The sociotechnical reading
The governed object in this deployment is not a prediction. It is a threshold.
Almost every decision-support case in this atlas turns on whether a model's output was right and whether the people downstream could tell. Here both questions are the wrong ones. The scoring layer produces a probability of approval, and the vendor and its critics agree it cannot refuse anyone anything. What it produces instead is a queue: the set of requests routed to human review. Because a denial is reserved to a physician, that queue is the denial pathway, and its size is set by one number. Move the number and the denial rate follows, without the algorithm ever having been wrong about anything. This is why the record supports no claim that the model erred, and why a fidelity-first reading has to put the parameter, not the prediction, at the centre.
The second structural fact is who owns that parameter and who pays for it. This is a third party. It is not an insurer automating its own review, and it is not a benefit manager inside one payer family. It is an independent-in-function vendor selling the same decision function to more than 100 competing insurers at once, so a single operating point governs care for tens of millions of people across firms that compete with each other — and, through the parent's ownership, across firms that compete with the parent. Per the investigation, the strictness of that operating point is a purchased feature: clients asked for it, sales priced it, and under risk contracts the vendor's own margin rode on it. The usual direction of oversight inverts. The paying principal is documented pressing for more review rather than less, which means the party best placed to audit the threshold is the party that bought its position.
Accountability then fragments along the seams of the arrangement, and the fragmentation is visible in what each observer can see. State licensure examines files, and Connecticut's read 196 of them and found letters and deadlines — real, admitted, and silent about any threshold. Client insurers receive savings reporting, which measures the parameter's effect and not the parameter. Members receive a denial letter from their own insurer, one step removed from the company that decided, and in 77 of those 196 sampled letters the sentence telling them an external appeal exists was missing. The federal scrutiny that does exist for prior-authorization automation was aimed at insurers. Nobody in this record reads the dial.
Two further dynamics do work here that the denial rate alone would hide. The first is compression at the human tier: the layer the whole design relies on for its legitimacy is one physician per determination, and the only account of its pace in the record is a decision every four minutes, frequently outside the reviewer's specialty. A check that exists and cannot be exercised is a different object from a check that does not exist, and the Connecticut findings — two denials without an appropriate clinical peer, one appeal decided by the physician being appealed — are what that looks like in a file sample. The second is demand suppression. Once clinicians know a gatekeeper is reading, they ask for less: radiology down 16 percent, cardiology down 38 percent in one state's presentation. The industry markets this as the sentinel effect. Its governance property is that a request never submitted is invisible to every measurement anyone takes — the regulator's file sample, the client's savings report, the denial rate itself.
What the record therefore documents is not a model failure but a governance vacancy, and it sits on exactly the surface that decides outcomes. The checking that exists lands elsewhere: on files, once, in one state; on criteria, once, in 2018, and only because an insurer client's own auditor got there. Both of those prove the missing check is possible. Neither has ever been pointed at the threshold.
The concepts used in this reading are defined in the Field Guide; the governance responses live in the Practice Library. The model organization for this case can be stress-tested in the PAN Lab.