How Six Vendor Names Change an Appeal Letter

There is a 177-line Python file whose job is to read a denial letter and look for six names: InterQual, MCG, Milliman, naviHealth, EviCore, Carelon. Find one of them and the appeal that comes out the other end is a different letter.

The file is algorithmic_review_detector.py. It sits in a public repository you can clone in about forty seconds.

That repository is Fight Health Insurance, the codebase behind the free appeal site of the same name. First commit February 12, 2023, 1,347 commits on main, most of it Apache 2.0.

We cloned it this morning and read it the way this desk reads a transmittal.

"What does a free appeal generator actually argue, and where does it get the argument from?"

What Happens When It Finds a Name

The detector runs two pattern maps. TERM_PATTERNS carries ten generic phrases (automated review, algorithmic determination, proprietary criteria, utilization management, and the rest), each with a weight: "automated review" scores 2.0, a bare "algorithm" scores 0.5. VENDOR_PATTERNS carries the six, and two of them are wider than they look. The naviHealth regex also matches nH Predict. The Carelon regex also matches AIM Specialty Health.

One guard in that file is worth the whole read. If the only hit is the bare word "algorithm", and it appears near "footer", "template", "document id" or "checksum", the match gets suppressed.

Somebody generated an appeal off a letter's own document-control line, noticed, and wrote the exception.

A hit appends one or more of five template blocks. The general one, verbatim:

"I request disclosure of all criteria, guidelines, software tools, algorithms, vendor inputs, and decision rules used in this determination, and whether any automated or algorithmic process contributed to the denial."

Two blocks are vendor-specific, one asks for the criteria set and version applied, and one is scoped to Medicare Advantage determinations. The module's own README states the design rule in a single line: the blocks ask for individualized review, criteria disclosure and human clinician review "without asserting legal violations."

That is a drafting decision most vendors would not make, and it is sitting in a README in a public repo.

What It Reaches For

Four evidence clients, and every one of them points at a document your own team can open (chart below).

• cms_coverage_api.py, 329 lines, queries the CMS Medicare Coverage Database Coverage API for NCDs to cite. The API is public and takes no key. We ran the same endpoint the code calls and got NCD 100.3, ambulatory esophageal pH monitoring, last updated August 12, 2026.
• clinicaltrials_tools.py hits the ClinicalTrials.gov v2 registry, and only on experimental-or-investigational denials, to separate standard of care from off-label-but-supported from genuinely speculative.
• ecri_guidelines_helper.py matches stored ECRI Guidelines Trust records against the denied procedure and diagnosis by whole-word keyword.
• imr_decision_retriever.py pulls prior external review decisions that resemble the denial. The corpus is two state databases: California DMHC independent medical reviews and New York DFS external appeals, stored with determination, diagnosis, treatment and category.

Then there is escalation_addresses.py, which computes who else gets a letter in parallel: the state insurance department, the plan's medical director, and DOL EBSA where the plan looks ERISA-covered, with 29 C.F.R. § 2560.503-1 cited in the module docstring. The addresses come from a static file carrying 51 jurisdictions, each with a complaint URL, a consumer line, a SHIP entry, the Medicaid agency and an external-review availability flag. A separate 639-line CSV carries state Medicaid agencies, helplines, legal-aid links and scraped FAQ text with a fetched date on every entry.

The Restraint Is in the Comments

The interesting engineering here is what the code declines to do.

The CMS module says out loud that NCDs come in coverage, non-coverage and limited-coverage varieties, that it does not fetch the determination text, and that citations are therefore framed as neutral pointers so the model cannot assert something false about an NCD it never read. The trial client notes that a registered trial does not by itself prove coverage. The external-review retriever calls its own output illustrative rather than legally binding.

Anyone who has read a machine-drafted appeal knows the failure mode: confident citation of a policy that says the opposite of what the letter claims. This codebase treats that as the thing to engineer around.

Who Is Writing It

1,154 of the 1,347 commits belong to Holden Karau, an Apache Spark committer and PMC member and a co-author of Learning Spark and High Performance Spark, who left Netflix to work on this. The log carries 18 author identities in all, with a second contributor at 64 commits and a third at 40.

It is still moving. 347 commits landed between January 1 and August 10 of this year, against 512 in all of 2025 and 177 in 2023 (chart below).

The patient-facing site is free and says so on the homepage, claims 10,000+ appeals generated and fifty-state coverage, runs OCR on-device, and charges only for optional faxing. The provider-facing product launched in May 2025 and had produced over 6,000 appeals within two months.

Final Thoughts

The appeal stack described above is assembled entirely from things a revenue-cycle department already has standing access to: the Coverage API, a trial registry, a guideline repository, two states' external review archives, and fifty-one complaint portals. Nothing in it is proprietary, and nothing in it is new.

What is unusual is that somebody wired them together and then published the wiring.

Read the six vendor names again and ask what your own denial letters say in the same place. If a name appears, the criteria set and version exist, they have a number, and somebody has already written the paragraph that asks for them.

Thanks for reading.