What Is Prior Authorization? Process, Timelines and the 2026 Rules

What Prior Authorization Means

Prior authorization is a requirement that a healthcare provider obtain approval from a patient's health plan before delivering a specific service, procedure, medication or device, as a condition of the plan paying for it. The plan reviews the request against its coverage rules and clinical criteria and returns a determination: approved, denied, or pended for more information. If the service is delivered without the approval, the plan can refuse to pay, and in most contracts the provider cannot bill the patient for the difference.

You will see it called preauthorization, prior approval, precertification, or simply PA. The terms are interchangeable in everyday use, though precertification has a narrower meaning for facility care that we cover below. When a claim is denied for a missing approval, the remittance usually carries claim adjustment reason code 197 (precertification, authorization or notification absent) or code 15 (authorization number missing, invalid, or does not apply to the billed service).

Prior authorization is a form of utilization management, which is the set of tools payers use to decide whether care is medically necessary and delivered in the right setting. It is standard practice in Medicare Advantage, Medicaid managed care, and commercial insurance. Traditional Medicare uses it far less, mostly for certain durable medical equipment, a short list of hospital outpatient procedures, repetitive non emergency ambulance transport, and, since January 2026, the services covered by the WISeR model in six states. That difference is one reason prior authorization is one of the most debated topics in US healthcare policy.

Why Payers Require Prior Authorization

Payers defend prior authorization on three grounds: cost, appropriateness, and safety. Providers experience it mostly as the first one. Both views are partly right, and understanding the payer logic makes the process easier to work with.

• Cost and utilization control. High cost services with wide variation in use, such as advanced imaging, spinal surgery, and specialty drugs, are where plans see the most spending they consider avoidable. Requiring review before the service is the most direct lever they have.
• Appropriateness against clinical criteria. Reviewers compare the request to published criteria. Medicare Advantage plans must follow Medicare National Coverage Determinations and Local Coverage Determinations, and under CMS-4201-F may apply their own internal criteria only where Medicare rules are not fully established, and must publish those criteria. Commercial plans typically use licensed criteria sets such as MCG or InterQual alongside their own medical policies.
• Patient safety. For drugs, prior authorization enforces step therapy, quantity limits, and checks for dangerous combinations or off label use. For procedures, it can confirm that conservative treatment was tried first.
• Site of service and network steering. Many plans approve a procedure only in an ambulatory surgery center rather than a hospital outpatient department, or require the service to be in network. Prior authorization is where that decision is enforced.
• Fraud, waste and abuse. Categories with a documented history of improper billing, such as power wheelchairs and skin substitutes, tend to attract prior authorization requirements first.

The tension is that every one of those goals is pursued through a process that adds delay and staff cost to the provider. The reforms described later in this article are attempts to keep the review while removing the friction.

What Typically Needs Prior Authorization

There is no universal list. Each plan publishes its own, usually by CPT or HCPCS code, and the list changes several times a year. That said, the categories are consistent across payers, and the same handful of service lines generate most of the volume.

Two categories deserve a note. Emergency care cannot legally require prior authorization, but plans usually require admission notification within 24 to 48 hours and will review the inpatient stay concurrently. And for prescription drugs the process runs through the pharmacy benefit, not the medical benefit, with its own standards and its own vendors, which is why drug prior authorization is handled separately in the electronic standards described later.

The Prior Authorization Process, Step by Step

The prior authorization process runs from the moment a clinician orders a service to the moment the payer issues a determination and, if approved, an authorization number that must appear on the claim. In a well run practice it looks like this.

• 1. Order and eligibility check. Staff confirm the patient's coverage is active and check the plan's prior authorization list for the ordered CPT or HCPCS code. Many groups run this through an eligibility verification agent so the requirement is flagged before scheduling, not after.
• 2. Assemble the clinical packet. The request needs the ICD-10 diagnosis, the procedure or drug code, the ordering and rendering provider NPIs, the site of service, and the supporting documentation: progress notes, imaging reports, lab results, and evidence of conservative treatment where the criteria call for it.
• 3. Submit. Depending on the payer this is a web portal, a fax, a phone call, an X12 278 transaction through a clearinghouse, or an electronic request sent from inside the EHR. Most practices use all of these for different payers on the same day.
• 4. Payer intake and administrative review. The plan confirms eligibility and benefits, checks that the request is complete, and applies automatic approval rules. A large share of routine requests are approved here without a human reading them.
• 5. Clinical review. Requests that do not auto approve go to a utilization management nurse who compares the documentation to the criteria. Anything the nurse cannot approve escalates to a medical director, because in Medicare Advantage and in most states only a physician or an appropriately licensed clinician can deny a request on medical necessity grounds.
• 6. Determination. The plan returns an approval with an authorization number, a validity window, and the approved units or visits; a denial with the reason; or a pend requesting more information. Under CMS-0057-F the denial must state the specific reason, not a generic code.
• 7. After the decision. Approved services are scheduled and the authorization number is carried onto the claim. Staff track expiration dates and unit counts. Denials go into the appeal path covered below.

Who does the work

On the provider side the work sits with prior authorization coordinators, referral specialists, medical assistants, and, for drugs, pharmacy technicians. Nurses get pulled in for clinical summaries, and the ordering physician is needed for peer to peer calls. In large health systems this is a centralized team inside the revenue cycle department; in a small specialty practice it is often one person's entire job.

On the payer side the request passes through intake representatives, utilization management nurses, pharmacists for drug requests, and medical directors. A great deal of it is delegated. Radiology benefit managers handle imaging, pharmacy benefit managers handle drugs, and lab benefit managers handle genetic testing, each with their own portals and criteria. That fragmentation is why payers are now investing in utilization management software that puts one workflow in front of all of it.

How Long Does Prior Authorization Take?

Prior authorization takes anywhere from a few minutes to several weeks. Routine requests that meet automatic approval rules can come back the same day. Requests that need clinical review take days, and requests that get pended for more information or denied and appealed can stretch past a month. The regulatory ceilings depend on the type of coverage.

Three details matter in practice. First, the clock starts when the payer receives a complete request, so a pend for missing documentation effectively restarts it. Second, plans may take an extension when it is in the patient's interest, for example to obtain records, so the ceilings are not absolute. Third, the CMS-0057-F timeframes apply to items and services, not to drugs, and they do not apply to Qualified Health Plans on the federal exchanges, which follow separate rules.

Two other 2026 changes affect timing indirectly. Since 2024, CMS-4201-F has required Medicare Advantage approvals to remain valid for the full course of treatment, and has required a 90 day transition period during which a new plan cannot re impose prior authorization on an active course of care. And beginning in 2026, impacted payers must publish aggregate prior authorization metrics each year, including approval and denial rates and average decision times, which for the first time lets providers compare payers on turnaround.

Prior Authorization vs Referral vs Precertification vs Predetermination

These four terms are routinely confused, including on payer websites. They differ in who initiates them, whether the payer is bound by the answer, and what happens if you skip them.

The most common mistake is treating a referral as if it were an authorization. A referral gets the patient in the specialist's door; the specialist still has to obtain prior authorization for the MRI or the procedure. The second most common is relying on a predetermination as a promise to pay. It is not one, and the claim is still adjudicated against the benefits in force on the date of service.

Denial Reasons and the Appeal Path

Most prior authorization denials are not clinical disagreements. They are missing information, mismatched codes, or a request sent to the wrong place. KFF's analysis of 2023 Medicare Advantage data found plans denied about 6.4% of nearly 50 million prior authorization requests, providers appealed only about one in nine of those denials, and more than 80% of the appeals that were filed were overturned. The Office of Inspector General reached a similar conclusion in 2018, finding that Medicare Advantage plans overturned roughly three quarters of their own denials on appeal.

• Medical necessity not established. The documentation does not show the criteria were met, often because a required element such as failed conservative treatment or a specific imaging finding is not in the notes.
• Incomplete or missing documentation. The most frequent administrative reason, and the easiest to prevent.
• Code or site of service mismatch. The CPT or HCPCS code on the request differs from what was performed, or the plan approves the procedure only in a different setting.
• Step therapy or formulary requirements not met. Common for specialty drugs where a preferred alternative must be tried first.
• Benefit exclusion or out of network provider. The service is not covered under the plan or the rendering provider is outside the network.
• No authorization on file, expired, or units exceeded. Technically a claim denial rather than a PA denial, but it is where prior authorization failures show up in the revenue cycle.

The appeal path

The first step is usually a peer to peer review, an informal call between the ordering physician and the plan's medical director. Many denials are reversed here once the physician explains the clinical picture, and some plans allow a peer to peer only before the denial is finalized, so the window is short.

If that fails, the provider or patient files an internal appeal, called a reconsideration in Medicare Advantage. MA plans must decide a standard pre service reconsideration within 30 calendar days and an expedited one within 72 hours, and a denial they uphold is automatically forwarded to the Independent Review Entity. Commercial and Medicaid plans have their own internal appeal timelines under ERISA, state law, or 42 CFR Part 438.

The last step is external review by an independent reviewer with no stake in the outcome. For most commercial coverage this is the independent review organization process under 45 CFR 147.136, with a decision due within 45 days, or 72 hours for expedited cases. In Medicare Advantage the chain continues from the Independent Review Entity to an Administrative Law Judge, the Medicare Appeals Council, and federal court. Predicting which denials are worth appealing, and drafting the appeal itself, is the workload our denial management article covers in depth.

Related Guides

These guides cover the neighboring concepts this article refers to, each written in the same answer first format.

• What Is Revenue Cycle Management? The 2026 Guide to Healthcare RCM: the full revenue cycle, its 12 steps and the KPIs that measure it.
• What Is Medical Coding? ICD-10, CPT and HCPCS Explained: ICD-10, CPT and HCPCS, E/M leveling and how coding feeds the claim.
• Healthcare Interoperability Explained: HIE, TEFCA, USCDI, Cures Act and SMART on FHIR: the four levels of interoperability, TEFCA, USCDI and SMART on FHIR.
• What Is Agentic AI? Definition, Architecture, Examples and Risks: what makes AI agentic, the autonomy levels and the controls that keep agents safe.

The Administrative Burden, in Numbers

The American Medical Association has surveyed physicians on prior authorization every year since 2016, and the picture has barely moved. In the 2024 AMA prior authorization physician survey, practices reported completing an average of 39 prior authorizations per physician per week and spending about 13 hours of physician and staff time each week on them. More than nine in ten physicians said prior authorization delays access to necessary care, a large majority said it leads patients to abandon treatment, and more than a quarter reported that it had led to a serious adverse event for a patient in their care.

The cost side is just as stubborn. The CAQH Index, which tracks adoption of electronic administrative transactions, has consistently ranked prior authorization as the least automated of the core transactions, with well under half of requests handled fully electronically and manual requests costing providers several times more per transaction than electronic ones. Portals count as partly electronic in that data, and portals are where most of the work actually happens today.

For a hospital or medical group, that burden lands inside the revenue cycle, alongside eligibility, coding and denials. If you want the broader context on where prior authorization sits in that pipeline, our companion piece on what revenue cycle management is walks through the full front, middle and back end. The short version is that a prior authorization failure at the front end becomes a denial at the back end, and the cost of fixing it rises at every step in between.

Electronic Prior Authorization: Standards and the 2027 API Deadline

Electronic prior authorization (ePA) means submitting the request, exchanging the clinical documentation, and receiving the determination as structured data between systems, rather than through fax, phone or a payer portal. Several standards exist, and they do not all cover the same thing.

The X12 278 has been the HIPAA standard for two decades, but it only carries the request and the yes or no. It cannot carry the notes and images that reviewers actually need, and HHS has never finalized a companion attachments standard, which is why most 278 traffic is followed by a fax. The Da Vinci guides fix that by moving the whole exchange onto FHIR: CRD answers "does this need authorization" inside the ordering workflow, DTR gathers the documentation from the chart, and PAS submits the bundle and receives the decision.

CMS-0057-F turns those guides into a deadline. By January 1, 2027, Medicare Advantage organizations, state Medicaid and CHIP agencies, Medicaid and CHIP managed care plans, and Qualified Health Plan issuers on the federal exchanges must offer a Prior Authorization API built on HL7 FHIR that lets a provider system discover whether authorization is required, learn what documentation is needed, submit the request, and receive the decision with a specific reason for any denial. The rule recommends rather than mandates the Da Vinci CRD, DTR and PAS guides, but in practice they are the only complete implementations. Drugs are excluded from the API requirement. The rule also adds an Electronic Prior Authorization measure to the Promoting Interoperability program, so from the 2027 performance period hospitals and MIPS clinicians report on their use of it.

For provider organizations the implication is that EHR and revenue cycle systems need to speak FHIR to every payer they bill. That is integration work of the kind we do on FHIR integration engagements, and it is the foundation that any automation on top of prior authorization depends on.

Gold Carding and the Reform Agenda

Gold carding exempts clinicians with a strong approval history from prior authorization for specific services. Texas passed the first statewide gold card law, HB 3459, in 2021. It requires state regulated plans to exempt a physician from prior authorization for a service when at least 90% of that physician's requests for it were approved during a six month evaluation period. Louisiana, West Virginia, Michigan, Vermont, Arkansas, Oklahoma and other states have since passed their own versions, each with different thresholds and scope. UnitedHealthcare launched a national gold card program for its commercial, Medicare Advantage and Medicaid plans in October 2024.

Gold carding is one part of a broader reform push that accelerated in 2025 and 2026.

• Federal rules. CMS-4201-F (2024) tied Medicare Advantage coverage criteria to traditional Medicare, required continuity of approved care, and required physician review of medical necessity denials. CMS-0057-F (2026 and 2027) shortened decision times, mandated specific denial reasons, required public metrics, and set the API deadline.
• Industry commitments. In June 2025, health plans coordinated through AHIP and the Blue Cross Blue Shield Association pledged to reduce the number of services subject to prior authorization, honor existing approvals for 90 days when a patient changes plans, adopt standardized electronic prior authorization by January 1, 2027, and answer at least 80% of complete electronic requests in real time by 2027.
• State AI rules. California's SB 1120, effective January 1, 2025, prohibits plans from denying care on medical necessity grounds based on an algorithm alone; a licensed physician must make the determination. Several states have followed with similar bills.
• Traditional Medicare pilots. The CMS WISeR model, which began January 1, 2026 in Arizona, New Jersey, Ohio, Oklahoma, Texas and Washington, tests technology assisted prior authorization for a short list of services with documented overuse, including skin substitutes, electrical nerve stimulator implants, and knee arthroscopy for osteoarthritis. Denials under the model still require a licensed clinician.

None of these eliminates prior authorization. What they do is narrow it, speed it up, make it electronic, and keep a clinician accountable for every denial. Those four properties are exactly what the software on both sides of the transaction now has to deliver.

How AI Agents Handle Prior Authorization, With Clinicians in the Loop

Almost every step in the process above is rules based, repetitive, and spread across systems that do not talk to each other. That is the profile that suits an AI agent: software that pursues a goal by reading the chart, calling payer systems, filling forms, and tracking outcomes, while handing clinical judgment back to a person. The distinction that matters is between the agent doing the paperwork and a clinician owning the medical decision.

On the provider side

A provider side agent determines at order time whether the payer requires authorization, using the plan's published list or a CRD call where the payer supports it. It then assembles the packet from the EHR, matching the documentation to the payer's criteria and flagging gaps for the clinician before submission rather than after a pend. It submits through whatever channel the payer accepts, portal, fax, X12 278 or a FHIR PAS bundle, and it polls for status so nothing sits unnoticed past the decision deadline. When a denial arrives it drafts the appeal with the specific reason addressed and routes it to the ordering physician for review. The physician still attests to medical necessity; the agent removes the hours spent finding, copying and re keying. Bonami builds this as a set of AI agents for prior authorization, and the single agent view is on our prior authorization agent page. For a narrative of what that looks like against a real payer phone tree, read how AI makes the prior authorization call faster.

On the payer side

Payer side automation has a different shape. The agent checks eligibility and completeness on intake, approves requests that plainly meet published criteria, routes the rest to a utilization management nurse with the relevant criteria and documentation already lined up, and drafts determination letters that carry the specific denial reason CMS-0057-F now requires. What it must not do is issue a medical necessity denial on its own, which CMS-4201-F, California SB 1120 and the AHIP commitments all rule out. Our prior authorization platform for payers is built around that constraint: automate approvals and routing, keep the medical director on every denial, and produce the metrics the 2026 public reporting requirement demands.

Both sides share one dependency: the data has to move as structured FHIR, not as PDFs. The 2027 API deadline forces that on payers, and provider systems that already exchange FHIR through an AI revenue cycle platform will be the first to see prior authorization turn from a phone call into a transaction that completes in minutes.