What Is Prior Authorization?

Why payers require prior authorization

Payers use prior authorization to confirm that a service is covered, medically necessary, and delivered in an appropriate setting. It is most common for high-cost services: advanced imaging, surgery, specialty drugs, durable medical equipment, and some therapy and behavioral health services.

How the process works

Although each payer has its own forms and portals, the steps are similar.

• Determine whether the planned service requires authorization for this patient's plan.
• Gather clinical documentation: diagnosis, history, prior treatment, and test results.
• Submit the request through the payer's portal, by fax, or electronically.
• Respond to requests for more information or a peer-to-peer review.
• Record the approval, including codes, units, dates, and site of service.
• Confirm the delivered service matches the approval before billing.

Where authorizations go wrong

Authorization denials rarely come from a missing request alone. Problems often appear when care changes after approval.

• The procedure performed differs from the code that was approved.
• The number of visits or drug units exceeds what was approved.
• The approval expires before the service is delivered.
• The service moves to a different facility or site of service.
• The patient's coverage changes after the approval.

Regulatory changes

The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) requires Medicare Advantage organizations, state Medicaid and CHIP programs, and qualified health plans on the federal exchanges to return decisions within 72 hours for expedited requests and seven calendar days for standard requests beginning in 2026, and to support a prior authorization API by 2027. Electronic requests will reduce some manual work, but each payer's clinical criteria and documentation requirements remain.

Managing authorization at scale

Organizations that handle authorizations well treat them as data, not paperwork. Each approval is tied to the scheduled service, and the system alerts staff when the order, dose, visit count, or date range changes. That turns a denial discovered weeks after the service into a question answered before the patient arrives.