A non-partisan briefing on how artificial intelligence shapes both sides of every medical bill — providers coding claims, and payers reviewing them. Built to help policymakers see the whole system before drawing a line through part of it.
AI is now embedded on both sides of every medical claim. A bill that addresses only one side leaves the other unchecked — and may make the imbalance worse.
Provider AI use largely emerged as a response to payer AI use. As insurers automated denials, downcodes, and prior-auth gates, providers turned to AI to keep up with the volume and complexity. Banning one side without addressing the other doesn't level the playing field — it tilts it further.
What the evidence actually shows about how clinicians and hospitals use AI to influence the codes that get submitted.
Every medical service is translated into a code. Diagnoses use ICD-10International Classification of Diseases, 10th revision — the standard system for coding diagnoses on medical bills.; procedures and office visits use CPTCurrent Procedural Terminology — the AMA's code set for procedures and services. CPT codes determine most physician payment.; hospital stays roll up into DRGsDiagnosis-Related Groups — the bundled payment categories Medicare uses to pay hospitals for inpatient stays. Higher-severity DRGs pay more.; Medicare Advantage uses HCCsHierarchical Condition Categories — diagnosis groupings CMS uses to risk-adjust Medicare Advantage payments. More documented chronic conditions = higher capitated payment. to risk-adjust monthly capitated payments. Each code carries a payment level. Upcoding is submitting a code that pays more than the service actually delivered or the documentation actually supports. It can be deliberate fraud, careless overstatement, or — most commonly with AI — a pattern of optimistic interpretation at scale.
To engage meaningfully on this issue, it helps to know exactly where AI plugs into a clinician's day. There are four pressure points where AI influences a code on its way to a payer:
An ambient AI scribeAI tools that listen to patient-clinician conversations and generate draft clinical notes. Examples: Abridge, Nuance DAX, Suki, Ambience. Duke Health is deploying Abridge to 5,000 clinicians. listens to the conversation and generates a draft clinical note. It can capture chronic conditions a clinician would otherwise forget to chart (legitimate value), but it can also surface diagnoses the patient never confirmed, list symptoms that were ambiguous, and produce more detailed notes than hand-charting would have.
Computer-Assisted CodingNatural language processing tools embedded in the EHR that read clinical documentation and recommend ICD-10 or CPT codes for billing. Most major EHR vendors include this functionality. tools — built into Epic, Cerner/Oracle, athenahealth — read the documentation and recommend ICD-10 and CPT codes. The model is trained on past coding decisions, so it tends to reproduce the patterns it has seen, including any historical bias toward higher-paying codes.
Practice management and revenue-cycleThe business processes that translate care into paid claims — coding, billing, collections, denial management. Revenue cycle is where most provider-side AI lives. tools surface visits that "look like" they could be coded higher based on the documentation. A clinician sees a prompt: "This visit may meet criteria for level 4." Pre-AI, this conversation happened with a human coder — and was often appropriate. With AI, it happens at scale, for every visit, every day.
In Medicare Advantage, plans get paid more for sicker members. AI mines clinical notes, claims history, and in-home assessments for additional HCCHierarchical Condition Categories — diagnosis groupings used to risk-adjust Medicare Advantage payments. diagnoses. Per the HHS OIG, about 70% of those mined diagnoses are not supported in the medical record — and per Sen. Grassley's 2024 investigation, this accounted for $8.7B in inappropriate UnitedHealth payments in a single year.
AI doesn't decide to upcode the way a person does. It optimizes for the objective its operator sets. When the operator's metric is "revenue captured per visit," the model finds revenue. The same model, with the same training data, deployed by a payer with the metric "claims to question," would find claims to question instead. The behavior follows the incentive, not the technology. That's why constraining the technology without constraining the incentive structures on both sides rarely changes outcomes.
Not every upward code shift is gaming. Patient acuity has genuinely risen. The 2021 AMA E/M revision intentionally allows higher coding when medical decision-making complexity is documented. AI scribes can surface chronic conditions that hand-charting misses. The peer-reviewed RAND study controlled for acuity and still found roughly two-thirds of the growth unexplained — but providers' point that pre-AI charts undercoded elderly and chronic patients deserves a fair hearing.
Every modern EHR contains code-suggestion features. Banning "AI to upcode" without surgical definitions risks catching (a) ambient scribes that legitimately reduce clinician burnout, (b) compliant Clinical Documentation Improvement programs, and (c) small and rural practices that depend on AI to navigate payer complexity.
The disparate impact is the most overlooked policy harm. A 67-hospital system has dedicated revenue-cycle teams, in-house coders, compliance attorneys, and dedicated denial-management staff. A rural primary-care office or an independent physical therapy clinic has a front-desk staffer doing all of it between patients. When the rules tighten, the system absorbs the cost; the small practice closes the doors or stops accepting the patients the rules were meant to protect. Provider AI restrictions disproportionately burden the practices least able to comply — and the patients those practices serve.
The under-examined other half of the equation. Same technology, same incentives — flipped.
Payer AI operates at three sequential points in the life of a claim. At each one, algorithms can deny outright, recommend a lower payment level (downcodingWhen a payer reassigns a claim to a lower-complexity code, paying less than the provider billed. Often done silently, without a formal denial.), or cut off coverage already approved.
Before a service can be delivered, the payer's AI screens the request. Algorithms compare the request against utilization patterns, predicted length of stay, and probability of approval. Companies like EviCore process prior auths for ~100M Americans. Denials at this stage prevent care from happening at all.
For inpatient and post-acute stays, AI models like UnitedHealth's nH Predict project a "right" length of stay based on millions of past cases. Case managers were pressured to keep stays within 1% of the algorithm's projection — even when the bedside physician disagreed.
When a claim arrives, AI compares it against the payer's policies. It can deny outright (Cigna PXDX flagged 300K claims in two months at 1.2 seconds each) or silently reassign a higher-complexity code to a lower-paying one — the practice of downcoding. Downcoding is often not formally appealable because no formal denial was issued.
Cigna's PXDX system routed flagged claims to medical directors who signed off in batches without opening files. One director denied 60,000 claims in a month.
300,000+
Denials in two months in 2022, averaging 1.2 seconds each — ProPublica, 2023
Algorithm predicted Medicare Advantage post-acute stays; case managers were pressured to stay within 1% of its projection.
90%
Of nH Predict denials reversed on appeal — STAT News, 2023
Cigna-owned EviCore handles prior auth for ~100M Americans across Aetna, UHC, BCBS plans. Internal tool can be tuned to raise denial rates; pitches a 3-to-1 ROI to insurers.
3x
Arkansas denial rate vs. Medicare Advantage average — ProPublica/CNN, 2024
UnitedHealthcare, Humana, and CVS/Aetna investigated. Post-acute denial rates 3x–16x higher than other care types. CVS projected $77.3M in 3-year AI savings.
16x
Humana post-acute denial rate vs. other care — Senate PSI, Oct 2024
Court filings and journalism document specific cases: Gene Lokken (91), denied skilled nursing despite a fractured leg, family paid $150K out of pocket, died shortly after. Dale Tetzloff (74), stroke survivor, rehab cut off at 20 days based on algorithm. JoAnne Barrows (86), rehab cut at 14 days despite a 6-week non-weight-bearing order. The pattern is not exceptional — the AMA survey found nearly 1 in 3 physicians has personally reported a patient harmed by prior auth.
The same models, the same failure modes — but the consequences flip depending on who's using the tool and what outcome they're optimizing for. A bill that doesn't name these risks can't actually constrain them.
AI in healthcare coding and claims is not a single thing. It's a stack of statistical models — natural language processing, predictive algorithms, and increasingly large language models — trained on historical data, deployed inside business workflows, and tuned toward whoever is paying for the system. That last point is the one most often missed in policy debate: AI optimizes for the objective its owner sets. A model deployed by a payer to flag "questionable" claims will find them. A model deployed by a provider to surface "missed" diagnoses will find those. Both can be technically accurate and systematically biased at the same time.
Click any card to expand examples of how the risk plays out on each side.
Models inherit the patterns in their training data. If the data reflects historical underdocumentation, overdocumentation, or population-level inequities, the AI replicates them at scale.
A model that worked when deployed slowly degrades as clinical practice, coding rules, payer policies, and patient populations change. Without monitoring, performance silently decays.
Generative AI can produce confident, fluent output that is partly or wholly fabricated. In documentation and claim adjudication, hallucinated content is hard to detect because it reads like the real thing.
Modern AI is tuned to agree with and serve its user. If the user is incentivized to find upcoding, the model will find it. If incentivized to find reasons to deny, it will find those too. The model isn't neutral — it mirrors the goal it's pointed at.
Most healthcare AI is a vendor product. Clinicians and patients see the recommendation, not the model card, validation data, or training population. Even regulators rarely see them.
When AI shapes the data it later trains on, errors compound. The system can't distinguish "what's true" from "what we've been doing for years."
A bill can't ban "bias" or "hallucination" — those are properties of how the technology works. But a bill can require the things that surface and constrain these risks: ongoing performance monitoring, third-party validation, transparency about the model's objective function, human review of consequential decisions, and audit trails. The risks are technical. The remedies are governance.
Identical technology, used by both sides, in pursuit of opposite financial outcomes — but only one side faces serious oversight today.
If AI in coding decisions warrants legislative scrutiny, the principle applies equally to the side that generates the code (providers) and the side that adjudicates the code (payers) — and any well-designed bill should address both, with parallel guardrails and parallel enforcement.
The same facts feel different depending on whose chair you sit in. Toggle through the perspectives the committee will hear from.
The person whose care, money, and trust are on the line.
A bill they don't understand. A diagnosis on their record that was never explained. Surprise out-of-pocket cost when an AI-elevated code crosses a deductible threshold.
Denied care for a condition their doctor said they need treated. A 90%-wrong algorithm cutting off rehab. Coverage decisions made in seconds, appeals that take weeks. Care delays linked to serious harm.
Nurses, physicians, PTs, and other licensed clinicians caught between the two algorithms.
Pressure from revenue-cycle dashboards to chart for billing rather than care. Ethical bind when codes don't match clinical reality. But: AI scribes meaningfully reduce documentation burden — nurses spend ~23% of a 12-hour shift in the EHR, and burnout is the top reason RNs leave.
Hours each week fighting denials. Moral distress when an algorithm overrides their clinical judgment. Discharge planning constrained by a model nobody at the bedside has ever seen. Patients harmed while appeals are pending.
Institutions running on thin margins in a complex payer environment.
False Claims Act exposure if AI nudges drift into fraud territory. Reputational and AG-level scrutiny. Compliance overhead of validating every AI suggestion. Smaller practices can't afford in-house compliance — they need rules that don't pick winners.
Cash flow disruption from denied claims. AHA reports claim denials up 20%+ over five years. Administrative cost of appeals — care that was delivered but takes months to be paid. Small practices and rural hospitals hit hardest.
Insurers' best-faith case for current practice — and where it breaks down.
"Provider AI inflates codes; we use AI to catch it. The 80% overturn rate proves we sometimes deny in error, but the alternative — paying every claim — drives premiums up for everyone. CMS already lets us use AI; we follow the rules."
The 1.2-second denial review. The 90%-error-rate algorithm. The internal "dial" that tunes denial rates. The lack of any state-level transparency requirement. The pattern of denying expensive care for vulnerable populations, then winning by attrition when only 11% appeal.
What it looks like from the state insurance department, AG, and committee dais.
Federal infrastructure already extensive — FCA, OIG, CMS audits. A state ban risks duplicating federal enforcement, triggering preemption challenges, or catching legitimate documentation improvement. Surgical definitions matter.
Federal floor exists only for Medicare Advantage. Commercial and Medicaid managed care AI use is largely unregulated in NC. Six states have moved; NC has not. Patient harm is documented. Enforcement gap is the larger policy problem.
Before drafting new rules, what frameworks and federal requirements already apply.
Every major medical ethics body — AMA, ANA (nursing), NAM, WHO, and the Coalition for Health AI — converges on the same principles: AI in healthcare must augment, not replace human clinical judgment; must be transparent about how it works and what data trained it; must be monitored for bias and drift; and must keep licensed professionals accountable for the decisions made in their name. None recommend outright bans — all recommend governance.
NC's own SB 624 (Sen. Mayfield, in Senate Rules) would require providers to disclose AI use in medical-necessity determinations. SB 315 (Sen. Burgin, in Health Care Committee) addresses utilization review transparency. Both are potential vehicles for symmetric, enforceable language.
As of May 2026, at least seven states have enacted or signed AI-specific healthcare claims/utilization-review statutes. North Carolina has bills in motion (SB 315 — Sen. Burgin; SB 624 — Sen. Mayfield; HB 434) and the technical infrastructure (NC HealthConnex) to lead. What's missing is enacted, symmetric legislation. (Colorado's general AI Act and Illinois's mental-health AI law are not included in this comparison because neither is a healthcare-claims statute.)
The Senate chairs have said "limit, not ban." That's the right instinct. Here's what a well-designed limit can actually look like — and what each option costs.
A categorical ban on "provider use of AI to upcode" is hard to enforce and easy to evade. Every modern EHR contains coding-suggestion features. The behavior the bill is targeting — gaming codes for revenue — is already illegal under the federal False Claims Act. A ban without surgical definitions risks chilling legitimate documentation tools while doing nothing to constrain the larger, less-regulated payer-side AI behavior.
A well-crafted limit instead does three things: (1) defines the conduct it's targeting with precision, (2) creates auditable obligations on both sides, and (3) gives regulators visibility — not just patients with the energy to appeal.
Require a licensed clinician to review and attest to any final code submitted (provider side) or any adverse determination issued (payer side). AI can suggest; humans decide.
Give NC DOI and Medical Board authority to demand AI model documentation, validation evidence, training-data summaries, and outcome audits — for both provider-side and payer-side AI used at scale.
Require annual public reporting of: AI-influenced code adjustments (providers); denial rates by service line and AI involvement (payers); appeal overturn rates (payers). Sunlight is enforcement.
When AI materially influences a coding or coverage decision, the patient gets a plain-language notice — and a clear path to appeal with the algorithm's role disclosed.
Apply parallel rules to providers and payers. Equal definitions of "AI use," equal disclosure obligations, equal audit authority. Politically durable and ethically coherent.
Scale compliance obligations to organization size. Independent and rural practices rely on AI scribes and coding assists to keep up with payer-imposed complexity — they cannot carry the same compliance load as a 67-hospital system. Rules that ignore this gap don't level the field; they accelerate consolidation and reduce patient access in exactly the NC counties least able to afford either.
Any limit needs a credible enforcer. Options NC already has: NC DOI (insurance), NC Medical Board (clinicians), NC AG / Medicaid Fraud Control Unit (fraud), and private right of action (used cautiously). The single most overlooked enforcement asset is NC HealthConnex — as of October 2025, NC Medicaid claims data flows into the state HIE alongside clinical records, creating the technical substrate to audit coding-vs-clinical-reality patterns at scale.
Why this bill, why now, and what's already happening in the state.
Statewide market debates tend to anchor on the big systems. But a substantial share of North Carolinians get care from small, independent, and rural providers — and that share is concentrated in exactly the counties where access is already most fragile.
The Sheps Center and NCDHHS describe rural NC care delivery as "a fragmented network of providers, many working independently." These are the practices that cannot absorb new compliance costs without consequence — and the patients in those communities are the ones who lose access first when small providers exit the market.
NC is projected to be short ~12,500 RNs by 2033. In 2023, 1 in 6 RN positions were unfilled. Documentation burden is repeatedly cited as a top driver of clinician attrition — and AI scribes are one of the few tools that have shown measurable burden reduction. Policy that catches legitimate documentation AI in the same net as upcoding gaming will hit the clinical workforce hardest.
"In our private-practice physical therapy clinic here in North Carolina, we've watched prior authorization requirements and denials climb year over year. The administrative burden is material. The moral distress on our clinicians is real. And the people who lose are our patients — North Carolinians who aren't getting the post-acute and rehabilitative care their clinical experts say they need. We can't fight every denial the way a hospital system can. Policy that constrains provider AI without addressing the payer AI driving that volume will push small practices like ours out of the market — and take our patients' access with us."
— Rich G. Kenny, owner, NC physical therapy clinic; former critical care and emergency nurse
Every claim above traces to a primary source. Listed for staff verification and deeper research.