What Is Prior Authorization? Process, Denials, and Guide

What is prior authorization? It sounds like a technical insurance term, but the idea is simple: your health insurer may need to approve a treatment, test, medicine or service before it agrees to cover it. Prior authorization is also called prior approval, preauthorization or precertification.

‍

For a patient, it can mean one extra step before care begins. For a provider, it can mean forms, clinical records, payer rules, follow-ups and sometimes an appeal. In many cases the provider submits the request on the patient's behalf, and the health plan reviews it and decides whether to approve it, deny it or ask for more information. The purpose is to check whether the requested care meets the plan's coverage rules and clinical requirements.

‍

An approval does not always guarantee that the insurer will pay the whole bill. Coverage can still depend on eligibility, benefits, exclusions, deductibles, provider network status and the terms of the patient's plan.

‍

Here is how it works in practice. A doctor recommends an MRI, and the patient's plan requires prior authorization for it. The doctor's office checks the requirement, gathers the clinical information and submits the request. The insurer then approves it, asks for more detail or denies it.

‍

The process can also create delays when requirements are unclear, documentation is incomplete or requests move between disconnected systems. Electronic prior authorization and AI-powered automation are changing that. Instead of relying only on phone calls, portals and fax, providers and payers can increasingly use connected systems to identify requirements, collect documentation, submit requests, track decisions and reduce manual work.

‍

Health plans use prior authorization mainly as a form of utilization management. It lets them review certain services before they are delivered, rather than only after a claim arrives. There are four common reasons.

• Cost containment: Some treatments, medicines, tests and procedures are expensive. A plan may require authorization to confirm the service is covered and to check whether a lower-cost, clinically appropriate alternative exists.

• Utilization management: Authorization helps plans manage how certain services are used, including whether they are medically necessary, appropriate for the patient's condition and consistent with coverage rules.

• Evidence-based care: Payers can apply clinical policies and evidence-based guidelines to judge whether a treatment or service is appropriate.

• Program integrity and fraud prevention: It adds a checkpoint before some high-cost services, helping flag care that may be unnecessary, duplicative or inconsistent with coverage requirements.

‍

From the insurer's side the logic is straightforward: review certain care before it is provided. From the provider's and patient's side, it can look very different. When rules are complex, documentation is missing or responses are slow, prior authorization becomes a barrier to care.

‍

This is not a small administrative process. The American Medical Association's 2024 survey of 1,000 practising physicians found that 93% reported prior authorization delays patient care. Some 82% said it can lead patients to abandon treatment, and 29% reported that it had led to a serious adverse event for a patient in their care.

The workload is heavy too. The AMA reports that the average physician practice completes about 39 prior authorizations per physician each week, with doctors and staff spending nearly two business days a week on them.

‍

Volume is equally striking in Medicare Advantage. KFF found that insurers made nearly 53 million prior authorization determinations in 2024, and about 4.1 million requests were denied in whole or in part. Only 11.5% of denied requests were appealed, yet 80.7% of appealed denials were partially or fully overturned.

‍

These figures point to the central problem with the traditional process. The hard part is not making a decision. It is getting the right information to the right organisation at the right time.

‍

1. Identify the requirement. The provider checks whether the patient's plan requires authorization for the service, medicine or treatment. Modern systems can check payer requirements electronically. Manual processes may mean searching payer websites, calling the plan or checking a portal.

2. Gather documentation. The provider collects diagnosis codes, procedure codes, medical notes, test results, medication history, previous treatments and the clinical justification. Missing information is one of the most common reasons a request is delayed or put on hold.

3. Submit to the insurer. The request goes to the health plan or its utilization management partner through an electronic health record, payer portal, electronic transaction, API, pharmacy ePA system, fax or phone.

4. Insurer review. The plan checks the request against its coverage and clinical criteria. Depending on the service, that may be automated checks, administrative review, clinical review or a combination.

5. Decision. The plan approves the request, denies it or asks for more documentation. A request can also sit in pending status while the plan waits for information.

6. Communication. The decision is shared with the provider and, depending on the plan and situation, the patient. Under CMS rules that took effect primarily in 2026 for impacted payers, specific denial reasons must be given for applicable medical prior authorization decisions.

7. Service delivery. Once approved, the provider can go ahead within the terms and time period of the authorization. Approval does not necessarily remove deductibles, copayments or other cost-sharing.

8. Claim payment. After the service, the provider submits a claim. The authorization helps show the required approval was obtained, but the claim can still be subject to eligibility, coverage, coding and other payment rules.

‍

Timing varies at every step. Under the CMS Interoperability and Prior Authorization Final Rule, impacted payers, excluding Qualified Health Plan issuers on federally facilitated exchanges, must generally respond to applicable medical prior authorization requests within 72 hours for expedited requests and seven calendar days for standard ones.

‍

• High-cost imaging: MRI, CT and PET scans.

• Elective surgeries: planned procedures where the insurer reviews medical necessity first.

• Specialty medications: biologics, oncology medicines and other expensive or complex drugs.

• Durable medical equipment: items such as oxygen systems or infusion pumps.

• Behavioural health services: certain inpatient, outpatient or intensive programmes.

• Home healthcare: some home health services before they begin.

• Skilled nursing: admission or continued care.

• Genetic testing: certain advanced or expensive tests.

‍

Requirements depend on the insurer, plan, benefit design and sometimes the patient's location. Patients should check their own plan rather than assume a service does or does not need authorization.

‍

These terms are often mixed up, and their exact meaning can vary by plan.

Six reasons account for most denials.

• Insufficient clinical documentation: The insurer lacks the records to confirm why the service is needed.

• Not medically necessary under the payer's criteria: Based on the information submitted, the service does not meet the plan's criteria.

• Step therapy not attempted: Some plans require a lower-cost treatment to be tried first.

• Out-of-network provider: The provider or facility does not meet the plan's network requirements for the service.

• Service not covered: The plan excludes a particular treatment, procedure, medication or category of care.

• Administrative or coding errors: Wrong codes, missing information, incomplete forms or a missed submission step can derail a request.

‍

The traditional process makes all of these harder to manage because every payer has its own rules and submission requirements. The AMA's 2024 survey ties prior authorization to delays and treatment disruption, which is why clearer and simpler processes matter.

‍

A denial is not necessarily the end of the road. Exact appeal rights depend on the plan, applicable law and type of coverage, but a common pathway looks like this:

• First-level internal appeal: The provider or patient asks the plan to reconsider and supplies more clinical information or explains why the care meets the plan's requirements.

• Clinical or peer-to-peer review: The treating physician speaks directly with a clinical reviewer, which can clarify the patient's condition, treatment history and medical need.

• Second-level or independent review: Some plans offer another internal review or bring in a different reviewer.

• External review: Where law or plan rules require it, an independent external reviewer evaluates the decision.

‍

These steps are not universal. Peer-to-peer review, for instance, can happen within an internal appeal rather than as a separate formal level. Appeals are worth the effort: KFF found that 80.7% of Medicare Advantage appeals in 2024 were partially or fully overturned, yet only 11.5% of denied requests were appealed.

‍

Prior authorization has long depended on phone calls, paper forms, fax machines and payer portals. Electronic prior authorization, or ePA, moves more of that workflow into connected digital systems. Several standards make this possible:

• NCPDP SCRIPT supports electronic prior authorization for pharmacy benefits, letting patient- and drug-specific criteria move electronically between participants.

• X12 278 is the long-standing industry standard for healthcare services review requests and responses for medical services.

• CAQH CORE operating rules standardise parts of the electronic workflow, including acknowledgements, connectivity and response expectations, to reduce back-and-forth between providers and plans.

• HL7 FHIR APIs are the newer direction. CMS requires impacted payers to implement a Prior Authorization API that shows covered items and services, documentation requirements and the status or result of a request, using HL7 FHIR as the technical foundation.

‍

The objective is to make prior authorization part of the provider's existing workflow instead of another disconnected task.

‍

The CMS Interoperability and Prior Authorization Final Rule, known as CMS-0057-F, introduced major changes for impacted payers, with operational requirements beginning primarily on January 1, 2026.

• Decision timeframes: For applicable medical items and services, payers generally must decide within 72 hours for expedited or urgent requests and seven calendar days for standard requests.

• Denial reasons: Payers must give a specific reason when they deny applicable requests.

• API requirements: These come later. Beginning primarily January 1, 2027, impacted payers must implement a Prior Authorization API, and Patient Access and Payer-to-Payer APIs must include certain prior authorization information, excluding drug-related prior authorizations under the 2024 final rule.

• Public reporting: Payers must report specified prior authorization metrics annually, with the first set due by March 31, 2026.

‍

One distinction is worth stating clearly. In 2026, CMS proposed additional interoperability and prior authorization requirements for drugs, including different decision timeframes for certain programmes. Those provisions are part of a proposed rule and should not be presented as finalised requirements under CMS-0057-F.

‍

AI and automation can help at several points in the workflow.

• Requirement detection: Software can work out whether a procedure or treatment needs authorization from payer rules, service codes and patient information.

• Documentation gathering: AI can extract relevant information from medical records and flag missing documentation before submission.

• Submission automation: Requests can be routed to the right payer connection and submitted electronically where supported.

• Denial prediction: Machine learning can spot patterns linked to incomplete requests or higher denial risk, so staff can close gaps first.

• Status follow-up: AI agents can check payer portals, retrieve updates and cut repetitive calls to health plans.

• Agentic prior authorization: The next step is from task automation to workflow automation. An agentic system can coordinate several steps: identifying that authorization is needed, gathering information, preparing and submitting the request, checking status and escalating cases that need a human.

‍

Healthcare demands particular care here. Prior authorization decisions affect patient access, so automation should be governed, auditable and designed around human oversight. The AMA has raised concerns about AI in prior authorization where automated systems could create or reinforce inappropriate denials.

‍

Vendors are approaching this differently. Cohere Health positions its platform around AI-powered automation, clinical intelligence, workflow orchestration and human oversight. Infinx combines AI agents with payer connections and human specialists across determination, initiation and follow-up. Infinitus focuses on voice AI for the parts of the process that still need phone calls to payers. The broader direction is to automate repetitive administrative work while keeping clinical judgement and exception handling accountable.

‍

‍

A few notes on how these differ. Availity offers authorization workflows through its multi-payer platform and supports FHIR-based approaches aligned with CMS and HL7 implementation guides. CoverMyMeds focuses on electronic prior authorization for medications using the NCPDP SCRIPT Standard. Experian Health provides software to automate requirement checks, route submissions and update payer information. EviCore combines utilization management with clinical expertise and technology, including provider submission and tracking tools.

• Verify requirements at the point of care: Know whether authorization is needed before scheduling the procedure or ordering the service.

• Standardise documentation: Build templates for common procedures and make clinical justification and supporting records easy to find.

• Use ePA wherever available: Electronic submission reduces manual entry, faxing and repeated phone calls.

• Track payer-specific requirements: Plans ask for different things, so keep payer rules current and update them regularly.

• Use denial analytics: Look at why requests are denied or delayed. Recurring problems can often be fixed upstream.

• Prepare staff for common denial reasons: Teams should know which documentation, coding and clinical details most often cause requests to pend or deny.

• Create clear escalation paths: Urgent care, complex conditions and clinical disagreements should reach the right human reviewer quickly.

‍

The goal is not to automate every decision. It is to remove unnecessary administrative work so clinicians and staff can spend more time on patient care.

‍

Q1: What is prior authorization in health insurance?

It is approval that a health plan may require before it will cover certain medical services, treatments, medicines or equipment.

‍

Q2: How long does prior authorization take?

It depends on the plan, service and urgency. For impacted payers covered by CMS-0057-F, applicable medical prior authorization decisions generally must be made within 72 hours for expedited requests and seven calendar days for standard requests. Other plans and services can have different rules.

‍

Q3: Why do prior authorizations get denied?

Common reasons include missing documentation, not meeting medical necessity criteria, step-therapy requirements, an out-of-network provider, lack of coverage and administrative or coding errors.

‍

Q4: Can I appeal a prior authorization denial?

Often, yes. Patients and providers can usually request an internal appeal, and some situations allow additional review or an external appeal. The exact process depends on the plan and applicable law.

‍

Q5: What is the difference between prior authorization and a referral?

Prior authorization is an insurer's approval for certain care. A referral is generally a direction or approval to see another healthcare provider, often a specialist. A referral does not automatically mean the service has received prior authorization.

‍

Q6: What is electronic prior authorization (ePA)?

It is the digital exchange of the information needed to request and process an authorization. For prescription drugs, NCPDP SCRIPT supports electronic PA workflows. For medical services, X12 278 and newer FHIR-based APIs support electronic exchange.

‍