How prior authorization works, from request to paid claim

Prior authorization is a payer’s approval, given before a service is performed, that the service meets the plan’s coverage criteria for that patient; without it, a service on the payer’s list is denied after the fact even when the care was right. The approval carries a number, a set of codes, a unit or visit count and a date range, and the claim has to match all four.

This guide follows one authorization from the scheduling desk to the paid claim. It sits alongside the denials guide and the other billing guides, and it stays with the payer rules that are published: CMS programs, the federal deadlines that took effect in 2026, and the claim form fields.

What is prior authorization, and who requires it?

Prior authorization is a pre-service coverage check that Medicare Advantage plans, Medicaid programs and their managed care plans, and commercial insurers each apply to their own list of services, while traditional Medicare uses it only in a handful of named programs. The list, the form and the deadline belong to each payer, so the first job is knowing which payer you are dealing with.

Traditional Medicare is the narrow case. CMS runs prior authorization for certain hospital outpatient department services, repetitive scheduled non-emergent ambulance transport, and certain durable medical equipment items, plus review choice demonstrations for home health and inpatient rehabilitation². CMS says these programs do not change medical necessity or documentation requirements; they ask for the same information Medicare already needs to pay, only earlier².

The hospital outpatient list is short and specific. It started in July 2020 with blepharoplasty, botulinum toxin injections, panniculectomy, rhinoplasty and vein ablation, added implanted spinal neurostimulators and cervical fusion with disc removal in July 2021, and added facet joint interventions in July 2023³.

The newest program is WISeR. It runs in New Jersey, Ohio, Oklahoma, Texas, Arizona and Washington from January 1, 2026 to December 31, 2031, and the CMS examples of included services are skin and tissue substitutes, implanted electrical nerve stimulators, and knee arthroscopy for knee osteoarthritis⁴. It does not apply to Medicare Advantage enrollees⁴. The WISeR post covers the choice between requesting approval and accepting pre-payment review in those six states.

Medicare Advantage is where the volume sits. KFF counted nearly 53 million prior authorization requests to Medicare Advantage insurers in 2024.¹ CMS rules limit how plans use the process: authorization may only confirm diagnoses or other medical criteria, and plans must follow Medicare’s national and local coverage determinations⁵.

How do you know if a service needs authorization?

You know a service needs authorization by checking the specific plan’s current authorization list for the procedure code, the place of service and the provider type on the date you schedule, because the same code can need approval under one plan and not under another plan from the same insurer. Memory and last year’s list are how authorization denials start.

Run eligibility first. The authorization has to go to the plan that will pay the claim, and a patient who changed plans since the last visit carries the old plan’s rules in your head and the new plan’s rules on the claim. The eligibility verification service exists because this step fails quietly.

Then check the list in the place each payer publishes it:

Lists change mid-year. From January 1, 2027, the payers covered by the CMS interoperability rule must run a prior authorization API that lists the items and services needing approval and identifies the documentation each one requires¹. Until your system reads that, the portal lookup is the record, and a dated screenshot is your proof that you checked.

What does a complete authorization request contain?

A complete request contains the patient and plan identifiers, the ordering and servicing providers with their NPIs, the procedure codes by number with units, the diagnosis codes that support them, the planned dates and place of service, and the clinical notes that show the plan’s criteria are met. A request missing any of these is not denied faster; it is pended, and the wait starts over.

Read the plan’s medical policy for the service before you attach records. A policy that requires six weeks of conservative treatment before an imaging study will be decided on whether the notes show six weeks of conservative treatment. Attach the pages that show it and label them; a reviewer reading 40 unlabeled pages misses things.

How is the request sent: portal, fax or X12 278?

Requests go through whatever channel the payer accepts, which today means a payer portal, a fax form, a phone line for urgent cases, or the X12 278 electronic transaction, and the channel you use decides what proof of submission you will have when the request goes missing. Log the channel, the date and the reference number on the day you send it.

The 278 is the electronic standard. X12 names it the health care services review transaction, a request for review and a response, and its published example shows a primary care provider asking a utilization management organization to approve a referral to a cardiologist⁷. Referrals and authorizations are one of the HIPAA standard transactions, and covered entities exchanging them electronically must use the adopted X12 standard¹³.

Portals are faster for a single request and weaker as proof. Save the confirmation page or the submission number with the request in your log. For fax, keep the transmission report with the page count. When a payer says it never received a request, the confirmation is the only thing that moves the conversation.

How long does the payer have to decide?

From January 1, 2026, Medicare Advantage plans, Medicaid and CHIP fee-for-service programs, and Medicaid and CHIP managed care plans must decide expedited requests within 72 hours and standard requests within 7 calendar days, and every payer under the rule must give a specific reason when it denies¹. Drug authorizations are outside this part of the rule¹.

Marketplace issuers on the federal exchange are covered by other parts of the rule but excluded from those two decision deadlines¹. Commercial employer plans follow their contracts and state law. Put the deadline that applies to each payer in your log, and chase a request on the day it passes, not the week after. The 2026 decision deadlines post covers which plans the deadlines bind and how to track each payer’s clock.

Payers under the rule also had to post prior authorization metrics on their websites, with the first report due March 31, 2026¹. Read your largest plans’ reports. They let you compare approval rates and decision times plan by plan, which tells you where incomplete requests cost the most.

Traditional Medicare’s own programs keep their timeframes. For the hospital outpatient services, the standard decision is 7 calendar days and the expedited decision is 2 business days, as of January 1, 2025³.

What happens after the approval?

After an approval, you log the number, the approved codes, units or visits, the date range and the servicing provider, then compare every scheduled visit against those limits, because the claim is paid only for what the approval covers and nothing more. An approval is a contract with edges.

Three things break approvals in practice:

• Units run out. A plan approves 12 visits; visit 13 is not covered. Count units at every visit and send the renewal request while units remain.
• Dates expire. An approval for 60 days does not stretch because the patient cancelled twice. Reschedule inside the window or request an extension.
• The service changes. The surgeon adds a level, the radiologist adds contrast, the therapist adds a code. The approval does not follow; the payer has to be asked.

Medicare Advantage gives one protection that helps with continuity. An approved course of treatment must stay valid for as long as medically reasonable, and an enrollee in active treatment who moves to a new Medicare Advantage plan gets a transition period of at least 90 days⁵. Ask the new plan for that transition in writing when a patient switches mid-course.

How does the authorization show up on the claim?

The authorization number goes on the claim in the field the payer reads, which on the paper 1500 form is item 23 and on the 837P is the matching prior authorization reference, and the codes, units and dates on the claim must sit inside what the approval covered. A correct number on a claim that bills more units than approved is still denied.

The National Uniform Claim Committee instructions say item 23 takes a prior authorization number, a referral number, a mammography certification number or a CLIA number, as assigned by the payer for the current service, entered without hyphens or spaces, in a field of 29 characters⁸. Because item 23 holds one number, a visit that needs two different approvals may need two claims.

Medicare’s version of item 23 is narrower: it holds the Quality Improvement Organization prior authorization number for procedures that need QIO approval, and Medicare’s manual says the item can carry only one condition, with additional conditions reported on a separate claim⁹. Medicare Advantage plans publish their own claim instructions; follow the plan’s manual, not Medicare’s.

Check the match at charge entry. The biller should see the approval beside the charge: codes, units used and remaining, and the end date. A claim that does not match should stop before it leaves, not after it denies.

What should you do when a request is denied?

When a payer denies a request, read the specific reason the payer gave, decide whether the gap is missing documentation or a disagreement about the criteria, and then either resubmit with the missing records, ask for a peer-to-peer review if the payer offers one, or file the appeal inside the plan’s deadline. Each route has its own clock.

For Medicare Advantage, the appeal of a denied request is a reconsideration by the plan. It must be filed within 65 calendar days from the date of the notice, and the enrollee, the enrollee’s representative or the enrollee’s physician can request it⁶. The plan decides an expedited pre-service reconsideration within 72 hours, a standard pre-service reconsideration within 30 calendar days and a payment request within 60 calendar days⁶.

If the plan upholds its denial in whole or in part, it must send the case to the Part C Independent Review Entity automatically⁶. You do not file that step; you watch for it and keep the records ready.

The published numbers say appeals are worth sending. KFF found that Medicare Advantage insurers fully or partially denied 4.1 million requests in 2024, that only a small share of those denials were appealed, and that more than eight in ten appealed denials were overturned.² A denial with a documentation gap is the easiest of those to reverse.

For commercial and Medicaid managed care plans, the appeal levels and deadlines are in the provider manual. When you write the appeal, the appeal letter guide sets out a letter that names the reason code, cites the coverage rule and points to the record pages. Record the deadline when the denial arrives, and if the service is urgent, ask for the expedited route the same day.

Which denial codes point to an authorization problem?

On the remittance, authorization problems usually arrive as CARC 197 when the payer found no approval on file, CARC 198 when the service went past what was approved, CARC 39 when the payer had already refused the service at the request stage, or CARC 288 when a required referral was missing¹⁰. Each one has a different fix.

One retired code still turns up in old work queues. X12 stopped CARC 15, which covered a missing or invalid authorization number, on May 1, 2018¹⁰. If your reports still group denials under 15, the mapping is out of date. The CO-197 page and the CO-198 page walk through the common pairings.

What goes in an authorization log?

An authorization log is one row per approval, with the request date, the payer’s reference, the status, the approved codes and units, the units used so far, the date range and the next action date, so that anyone in the practice can see on any morning what is pending, what is running out and what has expired.

Sort the log two ways each morning: pending requests past their deadline, and approvals with fewer than two visits of units left or less than two weeks to run. Those two lists are the day’s authorization work.

Worked example · hypothetical

A worked example: an approval that did not match the procedure

This is a hypothetical example. A two-physician pain management practice schedules a facet joint injection for a Medicare Advantage patient. The front desk requests approval through the plan’s portal for one spinal level on the right side, attaches the notes showing the plan’s conservative treatment criteria, and logs the reference number. The plan approves it in five calendar days, inside its 7-day standard window.

On the day, the physician finds the pain source extends to the level below and treats both levels. The note supports it. The claim goes out with the approved code and the add-on code for the second level, both under the one approval number.

The 835 pays the first line and denies the second with CARC 198 and RARC N54: more was done than was approved, and the billed service does not match the approval. The biller does not appeal yet. The plan’s manual allows an approval update after the service within a stated window, so the biller sends the update request with the procedure note the same day and logs it with its deadline.

The plan amends the approval. The biller sends a corrected claim for the second line with the amended number. The prevention step goes to the scheduling desk: for multi-level procedures on this plan, the request now asks for the levels the physician may treat, as the plan’s form allows, so a change on the day does not need a second request.

Nothing here required an appeal. The denial was read correctly as a mismatch, the fix went to the right place, and the scheduling habit changed.

When should a billing team run authorizations?

Hand authorizations to a billing team when requests are going out late or incomplete, when approvals lapse because nobody counts units, or when the staff who send requests also run the front desk and the phones. A dedicated remote biller can check payer lists, send and log requests, chase decisions against each payer’s deadline, and match every claim to its approval before it leaves.

Remitwright works this way through its prior authorization service: a dedicated biller per client (or a dedicated team for larger groups), working remotely inside the client’s own practice management system and payer portals. The clinical judgment stays with your clinicians. The biller prepares the request, attaches the records the plan’s policy asks for, and brings the peer-to-peer or appeal file to the physician when one is needed.

Keep the split honest. A biller cannot make a service meet a plan’s criteria; only the documentation can. What a biller can do is make sure the plan sees that documentation, on time, attached to a request that matches the claim.

Footnotes

1. KFF analysis of Medicare Advantage prior authorization data for 2024, published January 28, 2026¹². KFF also reports an average of 1.7 requests per Medicare Advantage enrollee that year. ↩

2. Same KFF analysis¹²: 4.1 million requests fully or partially denied, 7.7 percent of all requests; 11.5 percent of denied requests appealed; more than eight in ten appealed denials overturned. ↩

Checklist

Prior authorization checklist

1. The payer's current authorization list is checked for every scheduled service, not only new patients
2. Eligibility is run before the request so the authorization goes to the plan that will pay the claim
3. Each request carries the procedure codes by number, the diagnosis codes, units, dates and the supporting note
4. The submission channel, date and reference number are logged on the day the request goes out
5. Pending requests are chased against the payer's decision deadline, expedited ones the same day
6. Approvals are logged with the number, codes, units, date range and servicing provider
7. The schedule is compared with the approval before the visit, and changes go back to the payer first
8. Units used are counted at every visit, with a renewal request sent before the approval runs out
9. The authorization number goes in item 23 of the 1500 or the matching field of the 837P
10. Denied requests get the payer's stated reason recorded, and the appeal clock starts from the notice date
11. Claim denials for authorization are split into absent, exceeded and mismatched before anyone appeals
12. Repeat authorization denials are traced back to the scheduling or intake step that caused them

Print this checklist

Or get a link to this guide in your work email, so you can come back to it.

Leave these three fields empty.

Company websiteCommentsSubject

Work email

Email me a copy

By sending this you agree that we may contact you about your inquiry and keep your details as described in our privacy policy.