A physician orders an MRI on a Tuesday afternoon. The patient assumes she’ll be scanned by Friday. Instead, the order lands in a queue: someone in the practice pulls the chart notes, finds the payer’s clinical policy PDF, fills in a portal form, and waits. Nine days later the answer comes back as a denial for insufficient documentation, which turns out to mean the plan wanted six weeks of documented physical therapy first.
Nothing in that story is unusual. It’s prior authorization working exactly as designed, and it’s the single most common reason a care plan and a care calendar drift apart.
This guide covers what prior authorization actually is, the mechanics of the process, realistic timelines by plan type, the most common reasons requests get denied, and the federal rules that reset the clock starting January 1, 2026.
What is Prior Authorization?
Prior authorization is a requirement from a health plan that a provider get approval before delivering a specific service, drug, or device, or the plan won’t pay for it.
It’s a coverage decision, not a clinical one. A plan denying prior authorization is not saying the care is wrong. It’s saying the care doesn’t yet meet the plan’s documented criteria for payment. The patient can still get the service and pay out of pocket, which is exactly why the distinction matters so little in practice.
Health plans use prior authorization as a utilization management tool, alongside step therapy, quantity limits, and concurrent review. The stated purpose is to steer patients away from low-value or unnecessary services and toward less expensive alternatives that work just as well. Critics point out that it also delays and reduces spending on care that would have been approved anyway.
Prior Authorization vs. Precertification vs. Preauthorization
These terms get used interchangeably, and mostly that’s fine:
- Prior authorization, preauthorization, precertification, and prior approval all describe the same basic gate.
- Predetermination is usually a non-binding estimate of coverage rather than a decision.
- Referral is a different thing entirely: a requirement to see a primary care physician before a specialist, common in HMOs.
If a plan document uses one of these words, read the definitions section. Some payers draw distinctions that affect appeal rights.
What Typically Requires Prior Authorization
The list varies by plan, but the recurring categories are:
- Advanced imaging (MRI, CT, PET)
- Elective inpatient admissions and most surgeries
- Skilled nursing facility, inpatient rehab, and home health stays
- Durable medical equipment above a cost threshold
- Specialty drugs, biologics, and infusions
- Behavioral health inpatient and residential treatment
- Genetic and molecular testing
- Out-of-network care
Emergency care does not require prior authorization. Under the prudent layperson standard, plans must cover emergency services based on the patient’s presenting symptoms, not the final diagnosis.
How the Prior Authorization Process Works
The workflow is more or less the same across payers, even when the technology underneath differs.
1. The order is flagged. Either the EHR checks a payer rules engine, or a staff member checks the plan’s published list. This is where most delays start, because coverage lists change quarterly and nobody sends a reminder.
2. The practice gathers documentation. Chart notes, prior conservative treatment, imaging results, failed medications, ICD-10 and CPT codes. Payers deny on documentation gaps far more often than on clinical disagreement.
3. The request is submitted. Through the payer portal, an intermediary vendor, a fax line, or increasingly through an electronic prior authorization transaction inside the EHR.
4. A reviewer applies criteria. Nurses and non-clinical staff can approve. In most cases, only a physician or licensed clinician can issue a clinical denial. Many plans use third-party guideline sets (InterQual, MCG) rather than writing criteria from scratch.
5. A decision is issued. Approved, denied, or pended for more information. A pend is not a denial and does not start the appeal clock, which is one reason requests stall for weeks.
6. If denied, the provider can request a peer-to-peer review. This is a phone call between the ordering physician and the plan’s medical director. Peer-to-peer conversations overturn a meaningful share of denials, and they’re faster than a formal appeal, but they’re also scheduled at the plan’s convenience.
7. If still denied, appeals begin. Internal appeal first, then external review by an independent entity. In Medicare Advantage, the appeal path continues to an independent review entity, an administrative law judge, and beyond.
How Long Does Prior Authorization Take?
Here’s the honest answer: the regulated maximum and the typical experience are two different numbers. A plan can approve a request in four minutes or use every day the rules allow. Both are compliant.
Medicare Advantage
As of January 1, 2026, impacted payers under the CMS Interoperability and Prior Authorization final rule (CMS-0057-F) must decide:
- Expedited (urgent) requests: within 72 hours
- Standard requests: within 7 calendar days
The 7-day standard replaced the previous 14-calendar-day window. The rule also requires plans to give a specific reason for every denial, not a generic policy citation.
One important carve-out: CMS-0057-F does not apply to drugs. Part D and Part B drug prior authorization runs on separate timelines.
Medicaid and CHIP
Medicaid fee-for-service and managed care plans covered by the same rule follow the same deadlines: 72 hours expedited, 7 calendar days standard, effective January 1, 2026. State Medicaid programs may impose tighter requirements.
Marketplace and Commercial Plans
Qualified health plans on the federally facilitated exchanges are covered by CMS-0057-F and its 2026 deadlines.
Everything else is governed by state law, and state law varies a great deal. Common patterns include 15 business days for standard requests and 48 to 72 hours for urgent ones. A number of states have shortened these in recent legislative sessions.
The gap worth knowing about: self-funded employer plans regulated under ERISA are not bound by state prior authorization laws. Roughly two-thirds of covered workers in employer plans are in self-funded arrangements, so a patient’s neighbor with the same insurance card logo may operate under completely different rules.
Prescription Drugs
Pharmacy prior authorization moves faster than medical, mostly because the transaction was standardized earlier:
- Medicare Part D: 72 hours standard, 24 hours expedited
- Electronic prior authorization through pharmacy systems often returns an answer the same day, sometimes in minutes, when the request is fully automated
- Specialty drugs and buy-and-bill infusions are the slow lane, frequently one to three weeks, because they involve medical benefit review and site-of-care policies
Why Real-World Timelines Run Longer
The clock in the regulation starts when the plan receives a complete request. In practice, patients wait longer because of things that happen outside that window:
- The order sits in a work queue before anyone submits it
- The plan pends the request for records, resetting the practical timeline
- Fax and portal submissions get logged a day or two after they’re sent
- Scheduling the service after approval adds its own delay
- A denial and a peer-to-peer call can add another week or two
If you’re a patient trying to plan, assume two to four weeks from order to service for a non-urgent imaging study or surgery, and be pleasantly surprised when it’s faster. For urgent requests, the 72-hour standard is generally met.
What Changed on January 1, 2026
Prior authorization reform moved from talking point to compliance deadline. Three developments matter most.
CMS-0057-F Deadlines
The final rule CMS issued in January 2024 applies to Medicare Advantage organizations, state Medicaid and CHIP agencies, Medicaid and CHIP managed care plans, and QHP issuers on the federally facilitated exchanges. Its provisions phase in:
- January 1, 2026: the 72-hour and 7-day decision deadlines, plus the specific-denial-reason requirement, take effect.
- March 31, 2026: impacted payers begin publicly reporting prior authorization metrics on their websites, including approval and denial rates by service category and average decision turnaround. This is the first time comparable numbers have been published payer by payer.
- January 1, 2027: payers must implement a FHIR-based Prior Authorization API, along with Patient Access, Provider Access, and Payer-to-Payer APIs. The prior authorization API builds on HL7 Da Vinci implementation guides for coverage requirements discovery, documentation templates and rules, and the authorization submission itself.
The 2027 API requirement is the part that could actually change turnaround times rather than just capping them. When a rules engine can tell an EHR at the point of order what documentation a payer needs, the pend-for-records loop mostly disappears.
The Industry Pledge
In June 2025, AHIP announced that roughly 50 health plans had committed to a set of voluntary prior authorization changes covering most commercially insured Americans plus Medicare Advantage and Medicaid managed care members. The commitments include:
- Reducing the volume of services subject to prior authorization, with reductions effective January 1, 2026
- Honoring existing authorizations for 90 days when a patient changes plans mid-treatment
- Standardizing electronic prior authorization submission through FHIR APIs by January 1, 2027
- Answering at least 80 percent of electronic requests in real time by 2027, when all clinical documentation is attached
- Having a licensed clinician review every clinical denial
Voluntary pledges have a mixed track record, and the commitments are not uniformly defined across signatories. Watch the March 2026 public reporting data rather than the press releases.
The WISeR Model
Separately, CMS’s Innovation Center launched the WISeR Model (Wasteful and Inappropriate Service Reduction) on January 1, 2026. It tests prior authorization in Original Medicare, which historically has used almost none, for a narrow set of services CMS identified as prone to low-value use, including skin and tissue substitutes and certain nerve stimulator procedures.
WISeR runs in six states (Arizona, New Jersey, Ohio, Oklahoma, Texas, and Washington) and uses AI-assisted review, with final non-approval decisions required to come from licensed clinicians. It drew significant physician and congressional pushback on exactly that point. If you practice in one of those states, the affected code list is worth checking directly.
How Often Does Prior Authorization Get Denied?
KFF’s analysis of CMS data found that Medicare Advantage insurers issued roughly 50 million prior authorization determinations in 2023, and denied about 6 percent of requests in whole or in part.
The more revealing number is what happens next. Only about 12 percent of denials were appealed, and more than 80 percent of those appeals were overturned in the patient’s favor.
Read those two figures together and the picture is uncomfortable: the great majority of denied requests were probably payable, and most were never contested.
On the provider side, the American Medical Association’s annual physician survey has consistently found:
- Physicians and their staff handle roughly 39 prior authorization requests per week
- That work consumes about 13 hours of practice time weekly
- 93 percent of physicians report prior authorization delays in care
- Roughly a quarter to a third report that prior authorization led to a serious adverse event for a patient in their care
CAQH, which tracks administrative transaction costs across the industry, has repeatedly identified prior authorization as the least automated of the standard transactions it measures, and the most expensive per transaction when handled manually.
The Most Common Reasons Prior Authorization Gets Denied
Very few denials are a payer’s medical director disagreeing with an ordering physician. Most are procedural:
- Missing documentation of conservative treatment. Step therapy criteria requiring documented physical therapy, NSAIDs, or first-line drugs before advancing.
- Coding mismatches. The diagnosis code submitted doesn’t support the requested procedure code under the plan’s policy.
- Wrong site of care. The service is covered, but not in a hospital outpatient department when an ambulatory surgery center or home infusion is available.
- Out-of-network provider without a documented network adequacy exception.
- Eligibility or benefit issues. Coverage lapsed, the service is excluded, or the member hit a quantity limit.
- Stale clinical notes. Some policies require documentation from within the last 30 to 90 days.
- Missing medical necessity language. The chart shows why the physician wants the test. It doesn’t say why the alternatives are inadequate.
How to Speed Up Prior Authorization
For Patients
- Ask at the time of the order whether prior authorization is required, and who is submitting it. Do not assume the answer is yes or that someone owns it.
- Get the reference number. Every submitted request has one. Without it, you can’t track anything.
- Call your plan directly if nothing has moved in five business days. Ask whether the request is approved, denied, or pended, and if pended, exactly what’s missing.
- Ask for an expedited review if a delay would seriously jeopardize your health or your ability to regain function. This is a defined standard, not a favor, and it moves you to the 72-hour clock.
- Appeal denials. Given that most appealed Medicare Advantage denials get overturned, an appeal is usually worth the effort. Request the specific clinical criteria the plan applied so the appeal can address them directly.
- Request a peer-to-peer review through your physician’s office before filing a formal appeal. It’s often faster.
For Practices and Health Systems
- Maintain a payer-specific requirements library and update it against quarterly policy bulletins. Most avoidable denials trace back to a stale internal list.
- Submit complete on the first attempt. Building payer criteria into order sets or documentation templates cuts the pend-for-records cycle, which is the biggest single source of delay.
- Move off fax. Electronic prior authorization through the EHR creates a timestamp and an audit trail. That matters when a payer disputes when a request arrived.
- Track turnaround by payer and service line. Once the March 2026 public reporting data is available, you can benchmark your experience against what plans report.
- Pursue gold carding where it exists. Texas HB 3459 was the first law of its kind, exempting physicians from prior authorization for a given service when they hit a 90 percent approval rate over a defined evaluation period. Several states have since passed versions of it, and a number of national payers run voluntary gold card programs.
- Assign ownership. Practices that designate specific staff to prior authorization, rather than distributing it across whoever is free, consistently report shorter cycles.
Frequently Asked Questions
How long does prior authorization take?
For plans covered by CMS-0057-F as of January 1, 2026, the maximum is 72 hours for expedited requests and 7 calendar days for standard ones. Medicare Part D drugs run on 24 hours expedited and 72 hours standard. Commercial plans follow state law, commonly around 15 business days. In practice, patients often wait two to four weeks from order to service on non-urgent care, because of documentation gathering, pended requests, and scheduling.
Can I get a service without prior authorization?
Yes, but you’ll likely pay for it yourself. The requirement is a payment condition, not a legal barrier to care. Emergency services are the exception and cannot be subject to prior authorization.
What happens if prior authorization is denied?
You have appeal rights. Start with a peer-to-peer review between your physician and the plan’s medical director, then an internal appeal, then an external review by an independent organization. Ask the plan for the specific clinical criteria it applied.
Who is responsible for getting prior authorization?
Usually the ordering provider’s office, though for some drugs it falls to the pharmacy or the specialty pharmacy hub. Confirm rather than assume. Requests fall through the cracks precisely because everyone believes someone else submitted them.
Does prior authorization expire?
Yes. Approvals typically carry a validity window, often 30 to 180 days. Medicare Advantage rules require that an approval remain valid for as long as medically reasonable and necessary for the course of treatment, so a plan can’t force a re-authorization mid-treatment for the same condition.
Do Original Medicare patients need prior authorization?
Historically, almost never. That changed slightly in 2026 with the WISeR Model, which applies prior authorization to a narrow list of services in six states. Most Original Medicare care remains unaffected.
What to Do With This
If you’re a patient with a pending request, do one thing today: call the plan, get the reference number and the current status, and ask whether it’s pended for records. That one call resolves more stalled authorizations than any amount of waiting.
If you run a practice, pull your denial reasons from the last 90 days and sort them by cause. If more than half trace to documentation or coding rather than clinical disagreement, the fix is upstream in your intake process, not in your appeals process. And check the payer prior authorization metrics published since March 2026 before your next contract negotiation. For the first time, those numbers are public.
