Prior Authorization Tutorial

Chapter 01

The big picture

Prior authorization (PA) is the payer's check that a service is medically necessary and covered before it is delivered. For the provider it is a condition of payment: a required auth that is missing, expired or mismatched turns a clean claim into a denial that is usually not billable to the patient.

It sits between eligibility and the claim. Eligibility tells you the patient is covered; benefits tell you what the plan pays; prior authorization tells you whether this service, for this patient, at this site, has been agreed to. Done well it is routine paperwork. Done late or wrong it delays care, cancels procedures, and creates write-offs that no amount of coding skill can recover.

Why it matters in numbers

Volume

52.8 million

Prior authorization determinations made by Medicare Advantage insurers in 2024, about 1.7 per enrollee. Traditional Medicare, by contrast, reviewed about 2 per 100 beneficiaries.

Denials

7.7% denied, 80.7% overturned

Of MA requests denied in full or part in 2024, only 11.5% were appealed, yet four in five appeals won. Most denials that are never appealed would have been paid.

Burden

13 hours a week

Physician and staff time per physician on prior authorization in the AMA's 2025 survey, averaging 40 requests a week. 95% of physicians said PA delays care and 79% said patients abandon treatment because of it.

Who is involved

Ordering provider: The clinician who decides the service is needed and whose documentation supports it. Usually the one who must request the auth, even when another provider performs the service.
Rendering provider and facility: Who performs the service and where. Both must match the approval, since site of care (office, outpatient hospital, ASC, inpatient) is often part of the decision.
Payer / utilization management (UM): The plan's medical management department, or a vendor it delegates to (radiology benefit managers, musculoskeletal or oncology vendors, PBMs for drugs).
Delegated vendor: A company that handles PA for one category: imaging, sleep studies, physical therapy, cardiology, genetic testing, specialty drugs. The plan's card rarely says so; the plan's PA list does.
Clinical reviewer: A nurse applies the criteria first. Only a physician (or, under many rules, one in the same or a similar specialty) can issue a medical-necessity denial.
Clearinghouse / ePA platform: Routes electronic 278 requests and, from 2027, FHIR-based prior authorization API calls between the EHR and the payer.
Patient: Has appeal rights of their own and, under the No Surprises Act and many state laws, protection against surprise bills when a provider's auth failure causes the denial.

What goes wrong when it is skipped

Hard denials

CARC 197 (precertification absent) and 198 (exceeded) are usually contractual write-offs for in-network providers. The patient cannot be billed.

Cancelled and delayed care

Procedures bumped because the auth did not arrive, imaging rescheduled, infusion chairs held empty. Each reschedule costs the schedule twice.

Retro requests

Many payers allow retro auth only for emergencies or within a short window (often 2 to 14 days). Outside that, the only route is an appeal with a good-cause argument.

Chapter 02

What prior authorization is (and what it is not)

Several look-alike processes travel under the same name. They differ in who must do them, when, and what happens if they are missed.

Prior authorization: Also precertification, pre-approval, pre-auth. Payer approval before the service, based on medical necessity and coverage criteria. A condition of payment.
Predetermination: A voluntary, non-binding estimate of coverage, common in dental and for cosmetic-versus-reconstructive questions. It does not replace a required auth.
Referral: The PCP's permission for a member to see a specialist (HMO and POS plans). A referral is not an auth; a specialist visit may need both.
Notification: Telling the payer a service happened or an admission occurred, usually within 24 to 48 hours. Not a medical-necessity review, but missing it still triggers a penalty or denial.
Concurrent review: Ongoing review during an inpatient stay or a course of treatment. The plan approves days or visits in blocks and asks for updated clinicals to continue.
Retrospective (retro) authorization: Approval requested after the service. Allowed for emergencies, for coverage discovered late, or within a payer-defined window. Never assume it is available.
Step therapy: A drug or treatment is approved only after cheaper alternatives are tried and fail. Works through the PA process; many state laws limit it.
Medical necessity: The standard everything is measured against: the service is reasonable, appropriate and consistent with accepted standards for the diagnosis, in the least costly adequate setting.
Gold carding: An exemption from PA for providers whose requests are approved at a high rate (typically 80% to 90%) over a review period. Created by state laws, payer programs, and from 2026 by Medicare's own programs.

The clinical criteria behind the decision

Proprietary guidelines

MCG and InterQual

Licensed criteria sets most commercial and Medicaid plans use. They define the indications, failed conservative treatment, imaging findings and functional limits that justify a service. Ask the payer which set applies; many will send the relevant guideline on request.

Medicare coverage policy

NCDs and LCDs

National Coverage Determinations and the MACs' Local Coverage Determinations. Medicare Advantage plans must follow them (and the two-midnight benchmark) since the CY 2024 rule, and may use internal criteria only where Medicare policy is silent, with the evidence published.

Plan documents

Medical policies

Each payer publishes its own medical and pharmacy policies. They decide what counts as investigational, cosmetic, or not medically necessary, and they list the exact documentation a reviewer expects.

Specialty guidelines

Society criteria and compendia

ACR Appropriateness Criteria for imaging, NCCN for oncology drugs, ADA for diabetes devices. Citing the guideline the payer's policy is built on strengthens any request or appeal.

Chapter 03

Who requires it, and for what

Every payer type runs prior authorization differently. Knowing which regime a patient falls under tells you where the rules come from, how fast a decision must arrive, and what an approval looks like.

Coverage	Who decides	Typical scope	Decision clock	Notes
Commercial, fully insured	Insurer's UM department or delegated vendors	Advanced imaging, surgery, inpatient admissions, DME, specialty drugs, therapy visits, genetic testing, sleep studies	State law; commonly 2 business days urgent, 5 to 15 days standard. AHIP pledge plans target faster	State PA laws apply: gold cards, same-specialty reviewers, continuity of care
Commercial, self-funded (ERISA)	TPA or ASO carrier under the employer's plan document	Same as above; employer may add or remove categories	ERISA claims rules: 72 hours urgent, 15 days pre-service standard, one 15-day extension	State PA laws generally do not apply. Appeals follow ERISA and the plan document
Medicare Advantage	MA organization, often with vendors	Broad: 1.7 requests per enrollee in 2024. Inpatient, SNF, imaging, Part B drugs, DME	Federal: 72 hours expedited, 7 calendar days standard (since Jan 1, 2026), plus 14-day extension in limited cases	Must follow Traditional Medicare coverage criteria and the two-midnight rule; approvals valid for the full course of treatment
Traditional Medicare	MACs, and WISeR vendors in six states	Narrow: listed hospital OPD services, DMEPOS master list, repetitive non-emergent ambulance, and WISeR services	OPD: 7 calendar days standard, 2 business days expedited. WISeR portal: 3 days / 2 days	Affirmed decisions carry a UTN that must be on the claim
Medicaid managed care	The MCO, under the state contract	Varies by state; often the broadest list	Federal: 72 hours expedited, 7 calendar days standard (since Jan 1, 2026; previously 14)	Fee-for-service Medicaid uses the state's own PA unit and timelines
Marketplace (QHP)	Issuer	Commercial-style	State law plus issuer policy; the CMS 2026 decision clocks do not apply to QHPs	QHP issuers on the federal exchange must still give specific denial reasons and build the 2027 APIs
TRICARE	Regional contractor	Referrals and auths for Prime; selected services for Select	Contractor standards	Prime referrals route through the PCM
Workers' compensation	Carrier or state utilization review	Most non-emergency treatment beyond the initial visit	State workers' comp rules (for example, California UR: 5 business days)	Treatment guidelines are set by the state, not the carrier
Pharmacy benefit	PBM	Non-formulary, specialty, step-therapy and quantity-limited drugs	Medicare Part D: 24 hours expedited, 72 hours standard. Commercial: state law or PBM standard	Submitted by the prescriber, usually through an ePA platform at the point of prescribing

Services that almost always need an auth

Imaging

MRI, CT, PET, nuclear cardiology. Usually delegated to a radiology benefit manager. Modality, body part and contrast all matter.

Surgery and procedures

Spine, joint replacement, bariatric, cosmetic-adjacent (blepharoplasty, rhinoplasty, panniculectomy), vein ablation, interventional pain.

Inpatient and post-acute

Elective admissions, SNF, inpatient rehab, LTACH, home health. Inpatient stays then run on concurrent review.

DME and prosthetics

Power wheelchairs, hospital beds, CPAP, oxygen, orthoses, prosthetic limbs. Face-to-face visit and detailed written order rules stack on top.

Drugs and infusions

Specialty, biologic and oncology drugs under both the medical and pharmacy benefit. Site-of-care rules may push infusions out of the hospital.

Therapy and behavioral health

PT, OT, speech after an initial visit allowance; residential and intensive outpatient behavioral health; applied behavior analysis.

Traditional Medicare's programs

Original Medicare has no general PA requirement, but it runs several targeted programs. Each affirmed request returns a unique tracking number (UTN) that must appear on the claim, or the claim denies automatically.

Program	Services	Decision	Mechanics
Hospital OPD prior authorization	Blepharoplasty and ptosis repair, botulinum toxin injections, panniculectomy, rhinoplasty, vein ablation, implanted spinal neurostimulators, cervical fusion with disc removal, facet joint interventions	7 calendar days standard, 2 business days expedited	Request to the MAC; affirmation valid 120 days for one date of service; unlimited resubmissions; providers with a 90% affirmation rate in the semi-annual review can be exempted
DMEPOS required PA list	Power mobility devices, pressure-reducing support surfaces, lower-limb prostheses, spinal and knee orthoses, and other items on the master list	5 business days standard, 2 business days expedited	Supplier submits to the DME MAC; UTN on the claim
Repetitive scheduled non-emergent ambulance (RSNAT)	HCPCS A0426 and A0428 for 3+ round trips in 10 days or 1+ a week for 3 weeks	10 business days	Nationwide since August 2022; affirmation covers up to 40 round trips in 60 days
WISeR model (2026–2031)	Skin substitutes, nerve stimulator implants, knee arthroscopy for osteoarthritis, epidural steroid injections, vertebral augmentation, cervical fusion, incontinence devices, and others in Appendix A	3 days standard, 2 days expedited through the vendor portal	Arizona, New Jersey, Ohio, Oklahoma, Texas, Washington. Optional: claims without a PA go to prepayment review instead. Vendors are paid a share of averted spending and must use licensed clinicians for non-affirmations

Hospital inpatient is different

Traditional Medicare does not prior-authorize inpatient admissions; medical necessity is reviewed after the fact under the two-midnight rule. Medicare Advantage plans do require auth for elective admissions, but since the CY 2024 rule they must apply the two-midnight benchmark, and since January 2026 they cannot reverse an approved admission except for clear error or fraud.

Chapter 04

Is an auth needed?

The question has five inputs: the payer and product, the specific CPT or HCPCS code, the diagnosis, the site of care, and whether the provider is in network. Change any one and the answer can flip.

Where to look, in order

1
The plan's PA list or lookup tool Code level
Most payers publish a searchable code list per product line (commercial, MA, Medicaid). Save the result or a screenshot with the date: lists change quarterly and the printout is your evidence in an appeal.
2
The 271 response Plan level
An eligibility response may return EB01 = CB (coverage basis) or MSG segments such as "prior auth required for advanced imaging," and the EB authorization indicator (EB09) can flag that certification is required for a service type. It confirms the plan but not the code.
3
The delegated vendor Category level
If imaging, therapy or drugs are carved out, the vendor's own list and portal govern. Submitting to the plan instead of the vendor is a common cause of "no auth on file."
4
Medicare coverage policy Medicare and MA
Check the hospital OPD list, DMEPOS master list and WISeR Appendix A for Traditional Medicare. For MA, check the plan's list, then the NCD or LCD the plan must follow.
5
Gold-card and exemption status Provider level
A gold-carded provider or an exempt Medicare OPD provider skips the request for listed services. Keep the exemption letter and its dates in the payer file; exemptions are reassessed periodically.
6
Call and document When still unclear
Record the date, time, representative's name and the reference number. Many payers state that a phone confirmation is "not a guarantee of payment," but it is still evidence.

Auth is not a guarantee of payment

Every approval letter says so. Eligibility can end, the plan can change, the claim can still fail for coding or timely filing. An auth removes one reason for denial, not all of them.

Check both benefits

Infused and injected drugs may fall under the medical benefit (billed with J codes on the claim) or the pharmacy benefit (dispensed by a specialty pharmacy). Each has its own PA. Confirm which one applies before buying and billing the drug.

Chapter 05

Building the request

A request is a packet of identifiers plus a clinical argument. Reviewers approve what matches their criteria and deny what they cannot find. Make the match easy to see.

The data elements

Element	What to include	Common error
Member	Name, DOB, member ID exactly as the 271 returned them; subscriber if different	Dependent submitted under the subscriber's name
Providers	Ordering NPI, rendering NPI, facility NPI and tax ID; network status	Auth issued to the surgeon, claim billed by the facility with no facility auth
Service	CPT or HCPCS codes with modifiers, units, laterality; drugs with J code, NDC, dose and frequency	Requesting 72148 (MRI without contrast) when the radiologist performs 72158 (with and without)
Diagnosis	ICD-10-CM codes that support the service, to the highest specificity	Unspecified codes where the criteria require a specific indication
Dates and setting	Planned date of service or date range, place of service, inpatient vs outpatient	Service moved to a new date outside the approved window
Urgency	Standard or expedited, with the clinical reason an expedited review is justified	Marking everything expedited; payers downgrade it and the clock resets
Clinical documentation	Notes, imaging reports, labs, conservative treatment tried and failed, functional status, the specific criteria met	Sending the whole chart instead of the pages that answer the criteria

Writing to the criteria

Step 1

Pull the policy

Find the payer's medical policy or the MCG/InterQual guideline for the code. It lists required findings in order. Those become your headings.

Step 2

Answer each criterion with a date and a source

"Failed 8 weeks of PT (3/2–4/27/2026, notes attached). Radicular pain with positive SLR on exam 5/1. Neurological deficit: left EHL 4/5." A reviewer can approve this in a minute.

Step 3

Letter of medical necessity when the case is unusual

Signed by the ordering clinician. Diagnosis, history, what was tried, why alternatives are inappropriate, what the service will change, and the guideline or literature that supports it.

Step 4

Attach only what answers the question

Label attachments by criterion. For a 278 or FHIR submission, use the attachment (275 or DTR questionnaire) slots so nothing is lost in a fax queue.

Request checklist

Eligibility verified for the planned date of service Active coverage, correct product, and the auth submitted to the right entity (plan or delegated vendor)
Codes confirmed with the performing department CPT/HCPCS, modifiers, units, laterality, contrast, and add-on codes that also need approval
Diagnosis supports the service under the payer's policy Specific ICD-10-CM; indication listed in the criteria
Site of care is approved or justified Hospital outpatient vs office or ASC; inpatient vs observation
Conservative treatment and prior results documented with dates
All providers and facilities named on the request match who will bill
Urgency level chosen deliberately and justified
Submission reference captured and the follow-up date set Portal case ID, 278 trace number, fax confirmation, or call reference

Chapter 06

Submitting the request, and reading a 278

Requests travel by portal, fax, phone, the HIPAA 278 transaction, or, increasingly, FHIR APIs that run inside the EHR. Each channel leaves a different kind of evidence.

Channel	How it works	Strengths	Watch for
Payer or vendor portal	Web form per payer; attach documents; status visible online	Often the fastest decision; built-in criteria questions	One login per payer; staff re-key data; save the case ID and confirmation
X12 278	HIPAA standard request (278 request) and response (278 response) through a clearinghouse	Structured, auditable, feeds the EHR; every HIPAA payer must accept it	Many payers answer "pended" and finish by portal or fax; attachments need the 275
FHIR prior authorization API	Da Vinci CRD (does it need auth?), DTR (collect documentation), PAS (submit and get a decision) from inside the EHR; required of CMS-regulated payers by January 1, 2027	Rules and questionnaires at the point of ordering; real-time decisions for routine cases	Early rollout; drugs excluded; confirm which payers are live
ePA for drugs	NCPDP SCRIPT ePA through the e-prescribing workflow or platforms such as CoverMyMeds and Surescripts	Minutes, not days, for formulary questions	Only the pharmacy benefit; medical-benefit drugs still need the medical PA
Fax and phone	Payer form plus clinicals; phone for urgent or to check status	Universal; phone can resolve pends on the spot	No structured proof; log every call with time, name and reference number

Reading a 278 response

Below is a simplified, fictional 278 response (005010X217) to a request for a lumbar MRI. Select any line to see what it means. The segments that matter most are the HCR (the decision) and the REF with the authorization number.

Sample 278 response · Jordan Doe · MRI lumbar spine

Envelope segments (ISA, GS, GE, IEA) are omitted. Real responses may carry more loops, including one per service line and per provider.

HCR action codes you will see

HCR01	Meaning	What to do
`A1`	Certified in total	Record the auth number, dates, units and site. Schedule.
`A2`	Certified, partial	Compare what was approved with what was requested; schedule only the approved part or appeal the rest.
`A3`	Not certified	Read the reason codes (HCR03), request the denial letter, decide on peer-to-peer or appeal.
`A4`	Pended	Payer needs more information or more time. Watch for the request and the decision deadline.
`A6`	Modified	Approved with changes, such as a different site of care or fewer units.
`CT`	Contact payer	The request cannot be processed electronically. Call or use the portal.
`NA`	No action required	The service does not need authorization under this plan. Save the response as proof.

Chapter 07

Decision clocks and status

Every regime sets a maximum time for a decision. Knowing the clock tells you when to escalate, and when a silent payer has breached its own rule, which is itself an argument in an appeal.

Regime	Expedited / urgent	Standard	Extension	Source
Medicare Advantage	72 hours	7 calendar days	Up to 14 more days if in the enrollee's interest or more information is needed	42 CFR 422.568 and 422.572, as amended by CMS-0057-F
Medicaid managed care	72 hours	7 calendar days	Up to 14 more days	42 CFR 438.210(d), CMS-0057-F (from Jan 1, 2026)
Medicaid and CHIP fee-for-service	72 hours	7 calendar days	Up to 14 more days	CMS-0057-F
ERISA self-funded plans	72 hours	15 days (pre-service)	One 15-day extension with notice	29 CFR 2560.503-1
Fully insured commercial	State law; often 24 to 72 hours	State law; 2 to 15 days. Indiana: 48 hours. Iowa: 10 calendar days	State law	State utilization review statutes
Medicare Part D drugs	24 hours	72 hours	None	42 CFR 423.568
Traditional Medicare OPD	2 business days	7 calendar days	None	CMS OPD operational guide
WISeR (portal)	2 days	3 days	MAC-routed requests may take longer	WISeR operational guide

Decision deadline calculatorEnter when the payer received a complete request. Dates are shown in your browser's time zone.

Regime

Urgency

Received (date)

Received (time)

Status words and what they mean

Received / in review: The clock is running. Note the start date and time from the payer's own acknowledgment, not your send time.
Pended, additional information requested: The payer has asked for records. Under Medicare and Medicaid rules the plan may extend up to 14 days; under ERISA the clock pauses until you respond, up to 45 days. Respond the same day if you can.
Peer-to-peer offered: The reviewer could not approve on the record and is offering a physician conversation before a final denial. Take it; it has the best overturn rate of any step, and it must usually be scheduled within a short window (often 1 to 3 business days).
Approved / certified: Capture the auth number, approved codes, units, date range, site and provider. Compare against the request line by line.
Denied / adverse determination: You must receive the specific reason (required of CMS-regulated payers since 2026) and appeal instructions. The appeal clock starts at the notice date.

Chapter 08

Decisions, peer-to-peer and appeals

Four in five Medicare Advantage denials that are appealed get overturned. The appeal path is where most of the money lost to prior authorization is recovered, and where most of it is left on the table.

Anatomy of an approval

Auth numberThe reference that goes on the claim
Approved codesCPT / HCPCS, exactly
Units or visits12 visits, 2 units, 1 procedure
Valid datesStart and end; often 30 to 180 days
Site of careOffice, OPD, ASC, inpatient
ProvidersOrdering, rendering, facility
Conditions"Not a guarantee of payment"; eligibility at DOS

Full course of treatment

Medicare Advantage approvals must cover the entire approved course (for example, all planned chemotherapy cycles or the prescribed number of SNF days), and must stay valid for 90 days when an enrollee mid-treatment switches MA plans. The AHIP pledge plans extended the 90-day continuity promise to commercial coverage from January 1, 2026.

When the answer is no

1
Read the denial for its type Day 0
Administrative (missing information, wrong form, out of network, not a covered benefit) or clinical (does not meet medical necessity criteria). Administrative denials are fixed by resubmitting; clinical ones need a peer-to-peer or appeal.
2
Request the criteria and the reviewer's credentials Day 0–1
You are entitled to the specific reason and the guideline used. Many state laws and the MA rules require the denying physician to have expertise in the relevant specialty.
3
Peer-to-peer Usually within 1–3 business days
The ordering physician speaks with the plan's medical director. Prepare the chart against the criteria, lead with the findings that meet them, and ask what would be needed if the answer is still no.
4
Internal appeal Deadline set by the plan: 60–180 days
Written, with the policy cited, the criteria mapped to the record, and new evidence if any. Expedited appeals for urgent cases: 72 hours under MA, Medicaid and ERISA rules.
5
External review After internal appeal
Commercial: independent review organization under the ACA or state law (decision within 45 days, 72 hours expedited). MA: automatic forwarding to the Independent Review Entity if the plan upholds its denial, then ALJ and beyond. Medicaid: state fair hearing.

Who can appeal

The patient always can, and a provider may appeal on the patient's behalf with an appointment of representative form. In MA, a non-contracted provider can appeal a payment denial if they waive the right to bill the enrollee. Many state laws give providers direct appeal rights.

Expedited means expedited

A request is urgent when waiting the standard time could seriously jeopardize the patient's life, health or ability to regain maximum function. A physician's statement that it is urgent must be honored by MA plans and under ERISA. Do not mark routine requests urgent: payers downgrade them and the trust is spent.

Chapter 09

From authorization to claim

An approval only pays if the claim repeats it faithfully. The adjudication system compares the claim's fields to the auth on file; a mismatch is a denial even though an approval exists.

Where the number goes

837 professional and institutional

Loop 2300 REF*G1

The prior authorization number goes in REF with qualifier G1 at the claim level, or in loop 2400 for a specific service line when lines carry different auths. A referral number uses 9F.

Paper forms

CMS-1500 box 23, UB-04 FL 63

Box 23 on the professional form; form locator 63 on the institutional form, one line per payer. Medicare OPD, DMEPOS and WISeR UTNs go in the same places (and for DME, in the NTE or REF as the DME MAC instructs).

Fields the payer matches

Field	Rule	If it changed
Member	Same member, same plan, still eligible on the date of service	Re-verify eligibility; a plan change needs a new auth or a continuity-of-care transfer
Procedure codes	Billed codes within the approved set, including add-ons and modifiers	Procedure converted (laparoscopic to open, MRI without to with contrast): notify the payer, most allow an update within 24 to 72 hours
Units and visits	Cumulative billed units at or below approved	Request an extension before the units run out; CARC 198 is the result when they do
Dates	Date of service inside the valid window	Rescheduled outside the window: ask for a date change; many payers extend once
Providers	Rendering and facility NPIs match the auth	Covering surgeon or different facility: update the auth before the service
Place of service	Billed POS matches the approved site	Moved from ASC (24) to outpatient hospital (22): a new site-of-care review is usually required

Two auths, one surgery

Surgery often needs separate approvals for the surgeon (professional), the facility (institutional) and sometimes anesthesia or an implant. The auth for one does not cover the others. Confirm each entity that will bill holds its own approval or is named on the one auth.

Chapter 10

Denials and prevention

Authorization denials arrive on the remittance as claim adjustment reason codes (CARCs), often with a remark code (RARC) that narrows the cause. Reading them correctly decides whether the fix is a corrected claim, a retro request, or an appeal.

Denial triagePick the code from the 835 remittance to see the usual cause and the fix.

The habits that prevent most of them

Front-end discipline

Auth at scheduling, not at check-in. Build the lookup into the order and scheduling workflow so nothing is booked without a status of "approved" or "not required."
One source of truth. Store the auth number, approved codes, units, dates and site in the EHR's authorization record, and let the claim pull from it.
Work the pend queue daily. Requests for information and peer-to-peer offers expire. Assign an owner and a follow-up date to every open request.
Track the clock. Escalate when a payer passes its deadline; several state laws and the MA rules treat an untimely decision as a reason to approve or to go straight to appeal.
Count the units. Alert when visits or units are 80% used, and request extensions before the last approved visit.
Appeal clinical denials. The overturn rate justifies it. Template the appeal letter per payer and per service with the criteria mapped.
Measure. Turnaround time, approval rate by payer and service, denial rate for CARC 197/198/4, and time-to-appeal. The payers now have to publish their numbers; compare yours.

Chapter 11

Rules and regulations

2026 is the year the federal rules on prior authorization started to bite, with a second wave of technology requirements due in 2027. State legislatures and an industry pledge add further layers.

Federal · CMS-0057-F

Interoperability and Prior Authorization final rule (January 2024)

Applies to Medicare Advantage, Medicaid and CHIP fee-for-service and managed care, and QHP issuers on the federal exchange. From January 1, 2026: decisions within 72 hours (expedited) and 7 calendar days (standard), except QHPs; a specific reason for every denial, whatever the channel; annual public reporting of PA metrics by March 31 each year. From January 1, 2027: Patient Access, Provider Access, Payer-to-Payer and Prior Authorization APIs built on FHIR (drugs excluded), and a MIPS "Electronic Prior Authorization" attestation measure for clinicians and hospitals.

Federal · Medicare Advantage

CY 2024 and CY 2026 MA rules

MA plans must follow Traditional Medicare coverage criteria (NCDs, LCDs and the two-midnight benchmark), may use PA only to confirm medical necessity, must keep approvals valid for the whole course of treatment and 90 days after a mid-treatment plan switch, must run a utilization management committee led by the medical director, and must use reviewers with relevant expertise. From January 1, 2026, plans cannot revisit an approved inpatient admission except for clear error or fraud, and every adverse coverage decision is appealable with notice to both provider and enrollee.

Federal · Traditional Medicare

OPD, DMEPOS, RSNAT and the WISeR model

Condition-of-payment PA programs with UTNs on claims and exemption for high-affirmation providers. WISeR (Wasteful and Inappropriate Service Reduction) started January 1, 2026 in six states and runs to December 31, 2031: technology vendors paid from averted spending review selected outpatient services, with licensed clinicians required for non-affirmations and an exemption pathway planned for providers with a 90% affirmation rate.

Federal · ERISA and ACA

Claims procedure and appeal rights

ERISA (29 CFR 2560.503-1) sets 72-hour urgent and 15-day pre-service decision limits, full and fair review, and the content of denial notices for self-funded plans. The ACA adds external review by an independent review organization for non-grandfathered plans and extends the internal appeal protections to the individual market.

Industry · AHIP and BCBSA pledge (June 2025)

53 plans, four commitments

From January 1, 2026: fewer services requiring PA, 90-day continuity of existing approvals when a patient changes plans mid-treatment, and clearer denial explanations with appeal information. By 2027: standardized electronic PA with at least 80% of electronic approvals answered in real time. Plans also committed that medical-necessity denials are reviewed by clinicians. AHIP reports progress publicly; the AMA's 2025 survey found only a third of physicians expected the pledge to make a meaningful difference.

State law

Gold cards, clocks and AI limits

Gold-card laws in Texas, Arkansas, Colorado, Louisiana, West Virginia and Wyoming exempt providers with high approval rates (Texas extended its look-back to one year in 2025). Decision-time laws range from Indiana's 24 hours urgent and 48 hours standard to Iowa's 48 hours and 10 days. Continuity-of-care terms run from 90 days to a year. Maryland and others restrict AI in utilization review and require a licensed physician to make adverse determinations. Remember these apply to fully insured plans; self-funded ERISA plans are usually exempt.

Federal · Medicaid

42 CFR 438.210

Managed care plans must decide standard requests within 7 calendar days (14 before 2026) and expedited within 72 hours, extendable by up to 14 days, and must provide continuity of care during transitions under state contracts. Fee-for-service Medicaid sets its own timelines but is covered by the 2026 CMS rule.

Chapter 12

Key numbers 2026–27

Item	Figure	Context
Decision clocks
MA, Medicaid, CHIP expedited	72 hours	CMS-0057-F, from Jan 1, 2026
MA, Medicaid, CHIP standard	7 calendar days	Extendable up to 14 days in limited cases
ERISA pre-service standard / urgent	15 days / 72 hours	One 15-day extension on notice
Medicare Part D expedited / standard	24 / 72 hours	Coverage determinations
Traditional Medicare OPD standard / expedited	7 cal. days / 2 bus. days	Affirmation valid 120 days
WISeR portal standard / expedited	3 / 2 days	Six states, 2026–2031
Continuity and validity
Continuity after a mid-treatment plan switch	90 days	MA rule; AHIP pledge plans (commercial) from 2026
Gold-card threshold (typical)	80–90%	Approval rate over 6 to 12 months; Medicare exemptions use 90%
Scale and outcomes (Medicare Advantage, 2024)
Determinations	52.8 million	1.7 per enrollee
Denied in full or part	7.7%	4.1 million requests
Denials appealed	11.5%	Of those, 80.7% overturned
Traditional Medicare reviews (FY 2024)	628,243	22.9% non-affirmed
Practice burden (AMA 2025 survey)
Requests per physician per week	40	13 hours of physician and staff time
Physicians reporting care delays	95%	79% report treatment abandonment; 26% report a serious adverse event
Deadlines ahead
Payer PA metrics published	by Mar 31 each year	First set due March 31, 2026
Prior Authorization, Provider Access and Payer-to-Payer APIs live	Jan 1, 2027	MA, Medicaid, CHIP, federal-exchange QHPs
MIPS electronic PA measure	CY 2027	Performance period; CY 2029 payment year
WISeR model ends	Dec 31, 2031	Two three-year agreement periods

What is changing

In effect 2026

Faster federal clocks and denial reasons

72 hours and 7 days for MA and Medicaid, a stated reason on every denial, and public metrics. Hold payers to them.

Coming Jan 1, 2027

FHIR prior authorization APIs

Order-time checks and submissions from the EHR for CMS-regulated payers. Ask your EHR vendor and clearinghouse about Da Vinci CRD, DTR and PAS support now.

Expanding

Traditional Medicare PA

WISeR brings vendor-run, technology-assisted review to six states through 2031. Watch Appendix A updates and the exemption pathway.

Sources

Chapter 13

Glossary

Chapter 14

Knowledge check

Eight questions drawn from the chapters above. Pick an answer to see the explanation.

Score: 0 / 8

For training and reference. This page summarizes general rules and does not replace payer contracts, plan documents, CMS manuals, state law or legal advice. Example names, IDs, authorization numbers and payers are fictional.

Figures checked October 15, 2026.