What Is Prior Authorization in Healthcare? Complete Guide

Prior authorization is a utilization management process in which a health insurance plan requires providers to obtain advance approval before delivering a specific service, procedure, or medication. The payer reviews clinical documentation to determine medical necessity before authorizing coverage. Without prior authorization, the claim is denied regardless of whether the service was clinically appropriate.

Prior authorization exists at the intersection of clinical care and administrative bureaucracy, and it is one of the most time-consuming, frustrating, and financially consequential processes in American healthcare. The 2025 AMA Prior Authorization Physician Survey found that physicians and their staff spend an average of 14 hours per week completing prior authorization requests. That is nearly two full business days spent not on patient care, but on convincing insurance companies that the care a physician has already determined is necessary should be covered.

The financial impact is equally significant. The Council for Affordable Quality Healthcare (CAQH) estimates that prior authorizations cost the healthcare industry $10 billion annually in administrative expenses. Each manual prior authorization transaction costs an average of $11.17, compared to $1.89 for an electronic transaction. Yet as of 2025, only 31% of prior authorization transactions are fully electronic — the rest involve fax machines, phone calls, payer portals, and manual paperwork.

This guide covers everything about prior authorization: what it is, how the process works, which services require it, timeline expectations, the regulatory landscape including CMS 2026 interoperability rules, and how AI is fundamentally automating the process.

Quick Facts: Prior Authorization

Fact	Detail
Definition	Advance approval from a health plan before a service is covered
Also known as	Pre-authorization, pre-certification, pre-approval, prior auth, PA
Who requires it	Commercial payers, Medicare Advantage, Medicaid managed care, some traditional Medicare
Average processing time	2-14 business days (standard); 24-72 hours (urgent/expedited)
Administrative cost per transaction	$11.17 (manual) vs. $1.89 (electronic)
Industry annual cost	Approximately $10 billion (CAQH 2025)
Weekly staff time per physician	14 hours (AMA 2025 survey)
Denial rate for prior auth requests	6-10% initially denied; many overturned on appeal
CMS electronic PA mandate	January 1, 2027 (finalized in CMS-0057-F)

Why Prior Authorization Exists

Prior authorization serves a utilization management purpose: payers use it to ensure that services are medically necessary, clinically appropriate, and cost-effective before committing to coverage. From the payer perspective, prior authorization prevents unnecessary procedures, steers patients toward lower-cost alternatives when appropriate, and controls spending on high-cost services.

The clinical rationale is straightforward. Not every service ordered by a provider is necessary, and not every necessary service is performed at the optimal level. A payer may require prior authorization for an MRI to ensure that less expensive diagnostic options — such as X-ray or ultrasound — have been considered first. For medications, a payer may require step therapy, where a patient tries a lower-cost drug before a higher-cost alternative is authorized.

However, the implementation of prior authorization has expanded far beyond its original scope. What began as oversight for high-cost, high-risk procedures has grown to encompass routine services, standard medications, and established treatment protocols. The AMA reports that 94% of physicians say the prior authorization process delays access to necessary care, and 80% say it sometimes leads to treatment abandonment — patients who give up on getting the care they need because the authorization process takes too long.

How the Prior Authorization Process Works: Step by Step

The prior authorization process follows a defined sequence, though the specific requirements vary by payer, plan, and service type.

Step 1: Determine Whether Prior Authorization Is Required

Before ordering a service, the provider's office must check whether the patient's specific insurance plan requires prior authorization for that service. This is harder than it sounds. Requirements vary by:

• Payer (UnitedHealthcare may require prior auth for a service that Aetna does not)
• Plan type (an employer's HMO plan may require it when the same payer's PPO plan does not)
• Service (MRI of the knee requires prior auth, but X-ray of the knee does not)
• Setting (outpatient may require it, but inpatient may not, or vice versa)
• Geography (requirements may vary by state for Medicaid managed care plans)

Providers typically check authorization requirements through the payer's online portal, by calling the payer, or through an eligibility and benefits verification system that returns authorization requirements with the benefits response.

Step 2: Gather Required Clinical Documentation

Once the need for prior authorization is confirmed, the provider gathers clinical documentation to support medical necessity. Required documentation typically includes:

• Patient demographics and insurance information
• Requesting provider information (name, NPI, tax ID)
• Diagnosis codes (ICD-10-CM) for the condition being treated
• Procedure or service codes (CPT/HCPCS) being requested
• Clinical notes supporting medical necessity
• Relevant test results, imaging, or lab work
• History of previous treatments attempted (for step therapy requirements)
• Peer-reviewed clinical guidelines or evidence supporting the request

The documentation requirements vary by payer and service. A prior authorization for a routine MRI might require a brief clinical note and diagnosis. A prior authorization for a specialty medication might require years of treatment history, failed alternative therapies, lab results, and a letter of medical necessity.

Step 3: Submit the Prior Authorization Request

The request is submitted to the payer through one of several channels:

• Electronic submission via payer portal: The most common method today. Staff logs into the payer's website, navigates to the prior authorization section, enters the request information, uploads clinical documents, and submits. Each payer has a different portal with different workflows.
• Electronic submission via standard transaction (HIPAA 278): The X12 278 Health Care Services Review transaction is the HIPAA standard for electronic prior authorization. Adoption has been slow, but CMS regulations are mandating its use.
• Fax: Despite being 2026, many prior authorization requests are still submitted by fax. The provider completes the payer's prior authorization form, attaches clinical documentation, and faxes the package to the payer's utilization management department.
• Phone: Some payers require or accept phone-based prior authorization for certain services. A staff member calls the payer's authorization line, provides the required information verbally, and receives a determination on the call or a reference number for later follow-up.

Step 4: Payer Review and Determination

Upon receiving the request, the payer reviews the clinical documentation against their medical necessity criteria. The review process typically involves:

• Initial screening: Administrative staff verify that the request is complete and the patient has active coverage for the requested service.
• Clinical review: A nurse reviewer or clinical staff member evaluates the documentation against the payer's clinical criteria (often based on InterQual or Milliman Care Guidelines).
• Medical director review: If the initial clinical review does not support approval, the case is escalated to a physician reviewer (medical director) for a peer-to-peer review or final determination.

Step 5: Receive the Determination

The payer issues one of several determinations:

• Approved: The service is authorized. An authorization number is issued with specific details — authorized procedure, number of units, facility, valid date range, and any conditions.
• Denied: The service is not authorized. The denial includes a reason (not medically necessary, incomplete documentation, service not covered, alternative available) and information about the appeals process.
• Pended/Additional Information Requested: The payer requests additional clinical documentation before making a determination. The provider must submit the requested information within a specified timeframe.
• Partially approved: The payer authorizes a modified version of the request — fewer visits, a different medication, a different level of service.

Step 6: Link Authorization to the Claim

When the authorized service is performed, the provider must link the authorization number to the claim when it is submitted for payment. If the authorization number is missing, incorrect, or expired, the claim will be denied even though the authorization was obtained.

Prior Authorization Process Flow (Text Diagram)

Provider Orders Service
        |
        v
Check: Does the payer/plan require prior auth?
        |
   NO --+--> Proceed with service and billing
        |
   YES
        |
        v
Gather clinical documentation
        |
        v
Submit PA request (portal / 278 / fax / phone)
        |
        v
Payer receives and reviews request
        |
   +----+----+----+
   |         |         |
   v         v         v
APPROVED  PENDED    DENIED
   |         |         |
   v         v         v
Schedule  Submit     Appeal or
service   additional  peer-to-peer
   |      info        review
   v         |         |
Perform      v         v
service   Re-review  Overturn
   |         |      or uphold
   v         v         |
Submit    APPROVED     v
claim     or DENIED  If overturned,
with PA#              schedule service

Which Services Commonly Require Prior Authorization

Prior authorization requirements vary widely, but certain service categories are almost universally subject to prior auth across commercial payers and Medicare Advantage plans.

High-Cost Imaging

Advanced imaging — MRI, CT, PET scans, nuclear medicine studies — is one of the most common prior authorization categories. Payers use radiology benefit managers (RBMs) like EviCore, AIM Specialty Health, and NIA Magellan to manage imaging prior authorization.

Specialty Medications

Medications costing more than $1,000 per month almost universally require prior authorization. This includes biologics, specialty injectables, oncology drugs, and medications administered in physician offices or infusion centers (J-codes under HCPCS).

Surgical Procedures

Elective and non-emergent surgical procedures typically require prior authorization, including orthopedic procedures (joint replacements, spinal surgery), cardiac procedures, bariatric surgery, and many outpatient surgical procedures.

Durable Medical Equipment (DME)

Wheelchairs, hospital beds, CPAP machines, prosthetics, orthotics, and other durable medical equipment frequently require prior authorization, particularly under Medicare and Medicaid programs.

Behavioral Health Services

Inpatient psychiatric admissions, residential treatment, intensive outpatient programs, and extended outpatient therapy sessions often require prior authorization and concurrent review.

Genetic Testing

Genetic and molecular diagnostic testing increasingly requires prior authorization, particularly for expensive multi-gene panels and whole exome/genome sequencing.

Physical and Occupational Therapy

Many plans require prior authorization for physical therapy, occupational therapy, and speech therapy — either for the initial evaluation or after a specified number of visits.

Prior Authorization Timelines

Regulatory requirements and industry standards define expected timelines for prior authorization determinations.

Request Type	Expected Timeline	Regulatory Basis
Standard (non-urgent)	5-14 business days	Varies by state and payer
Urgent/expedited	24-72 hours	State regulations; NCQA standards
Medicare Advantage (standard)	7 calendar days (extendable to 14)	42 CFR 422.568
Medicare Advantage (expedited)	72 hours	42 CFR 422.572
Medicaid managed care (standard)	14 calendar days	42 CFR 438.210
Medicaid managed care (expedited)	3 business days	42 CFR 438.210
Prescription drugs (Part D)	72 hours standard; 24 hours expedited	42 CFR 423.568/572
CMS 2027 rule (payers on FHIR)	7 calendar days (standard); 72 hours (expedited)	CMS-0057-F

In practice, many prior authorization requests take longer than the stated timelines due to requests for additional information, administrative backlogs, and the complexity of multi-step review processes. The AMA reports that 33% of physicians have waited more than three business days for a prior authorization decision, even for urgent requests.

The Impact of Prior Authorization on Patients and Providers

Impact on Patients

Prior authorization directly affects patients in several measurable ways:

• Care delays: The AMA reports that 94% of physicians say prior authorization delays access to necessary care. The average delay is 2-5 business days, but complex requests can take weeks.
• Treatment abandonment: 80% of physicians report that patients sometimes abandon treatment due to prior authorization barriers. For chronic conditions, this abandonment can lead to disease progression and higher long-term costs.
• Clinical deterioration: 33% of physicians report that prior authorization has led to a serious adverse event for a patient, including hospitalization, life-threatening events, disability, and death.
• Financial impact: When prior authorization is denied and patients proceed with services, they bear 100% of the cost. When patients delay care awaiting authorization, their conditions may worsen, leading to more expensive treatment.

Impact on Providers

The administrative burden on providers is substantial and well-documented:

• Staff time: 14 hours per week per physician spent on prior authorization (AMA 2025)
• Staffing costs: Practices employ 2-3 FTEs per physician dedicated to prior authorization and related administrative tasks
• Revenue impact: Authorization delays cause scheduling gaps, procedure cancellations, and lost revenue. Denied authorizations result in unreimbursed services or service non-delivery.
• Physician burnout: Prior authorization is consistently cited as one of the top drivers of physician burnout and dissatisfaction with administrative burden.

CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F)

In January 2024, CMS finalized the Interoperability and Prior Authorization Final Rule (CMS-0057-F), which establishes transformative requirements for electronic prior authorization. The rule applies to Medicare Advantage organizations, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan (QHP) issuers on the Federally-facilitated Exchanges.

Key Requirements

Prior Authorization API (effective January 1, 2027):

• Payers must implement a Prior Authorization API using HL7 FHIR (Fast Healthcare Interoperability Resources) standards
• The API must allow providers to determine whether prior authorization is required, submit prior authorization requests, and receive determinations electronically
• Payers must include specific reasons for denied prior authorization requests in the API response

Decision timelines (effective January 1, 2027):

• Standard requests: 7 calendar days
• Urgent requests: 72 hours
• These timelines are shorter than many current state and contractual requirements

Prior Authorization metrics reporting (effective March 2026):

• Payers must publicly report prior authorization approval rates, denial rates, average decision timeframes, and appeal overturn rates
• This transparency is intended to expose payers with excessive denial rates or slow processing

Electronic status updates:

• Payers must provide real-time status updates on prior authorization requests through the FHIR API

What This Means for Providers

The CMS rule shifts the prior authorization process from fragmented, payer-specific portals and manual processes toward standardized, electronic, API-driven workflows. For providers, this means:

• A single electronic interface for prior authorization across multiple payers (once payers implement the API)
• Faster determinations with enforceable timelines
• Transparent denial reasons that facilitate targeted appeals
• The ability to build or adopt technology that automates prior authorization end to end

Electronic Prior Authorization (ePA)

Electronic prior authorization (ePA) replaces manual submission methods (fax, phone, portal) with automated electronic transactions. There are two primary approaches:

HIPAA 278 Transaction

The X12 278 Health Care Services Review Request and Response is the HIPAA standard for electronic prior authorization. Despite being mandated for many years, adoption has been limited due to implementation complexity, payer support gaps, and the lack of ability to attach clinical documentation to the 278 transaction. The addition of the 275 Additional Information to Support a Health Care Services Review attachment standard has improved the ability to include clinical data.

FHIR-Based Prior Authorization (Da Vinci Implementation Guides)

The HL7 Da Vinci Project has developed FHIR-based implementation guides for prior authorization that address the limitations of the 278 standard:

• Coverage Requirements Discovery (CRD): Provides real-time information about whether prior authorization is required when a provider orders a service within their EHR workflow.
• Documentation Templates and Rules (DTR): Presents the payer's documentation requirements within the provider's EHR, pre-populating available data from the patient's record.
• Prior Authorization Support (PAS): Enables electronic submission of the prior authorization request with full clinical documentation through the FHIR API.

Together, these three implementation guides create an end-to-end electronic prior authorization workflow that operates within the provider's existing EHR — eliminating the need for separate payer portals, fax submissions, and phone calls.

How AI Is Automating the Prior Authorization Process

Artificial intelligence is transforming prior authorization from one of healthcare's most labor-intensive processes into one that can be substantially automated. AI addresses multiple stages of the prior authorization workflow.

Automated Authorization Requirement Detection

AI systems integrate with payer databases and historical authorization data to automatically determine whether a specific service for a specific patient under a specific plan requires prior authorization. When a provider orders a service, the system instantly identifies the authorization requirement without staff needing to check payer portals or call payer authorization lines.

Intelligent Documentation Assembly

AI reads the patient's medical record — clinical notes, lab results, imaging reports, medication history — and automatically assembles the clinical documentation required for the prior authorization submission. Natural language processing identifies relevant clinical data points and maps them to the payer's specific documentation requirements.

Automated Submission and Follow-Up

AI-powered platforms submit prior authorization requests electronically across multiple payers using the appropriate channel for each (278 transactions, FHIR APIs, payer portals via robotic process automation, or structured fax when electronic options are unavailable). The system tracks the status of each request and follows up automatically when decisions are delayed.

Predictive Analytics for Prior Auth Outcomes

Machine learning models trained on millions of historical prior authorization decisions predict the likelihood of approval or denial before the request is submitted. This enables practices to prioritize cases likely to require additional documentation, prepare appeal materials proactively for likely denials, and set realistic patient expectations.

QuickIntell's prior authorization automation platform integrates these AI capabilities into a unified workflow that reduces manual prior authorization effort by 75-85%. The platform automatically identifies authorization requirements during scheduling, assembles clinical documentation from the patient's EHR, submits requests electronically to over 2,000 payers, tracks status in real time, and escalates only complex cases to human staff. Organizations using QuickIntell report average authorization turnaround times of 1.8 days compared to the industry average of 5-7 days, and authorization denial rates below 4% compared to the industry average of 6-10%.

Prior Authorization Best Practices for Healthcare Organizations

1. Verify Authorization Requirements at Scheduling

Do not wait until the day of service to check authorization requirements. Integrate authorization requirement checking into the scheduling workflow so that required authorizations are identified and initiated as early as possible.

2. Maintain a Prior Authorization Requirements Database

Build and maintain a database of authorization requirements by payer, plan, and service type. Update it regularly as payer requirements change. This database becomes the source of truth for your organization and eliminates the need to check individual payer portals for each request.

3. Submit Comprehensive Documentation on the First Request

The most common reason for prior authorization delays is incomplete documentation. Submit all relevant clinical information with the initial request rather than waiting for the payer to request additional information. Over-documenting is better than under-documenting.

4. Track Authorization Validity Dates

Authorizations expire. Track validity dates and ensure that authorized services are scheduled and performed within the authorized window. For services that need to be rescheduled, check whether a new authorization or extension is required.

5. Monitor Denial Patterns

Track prior authorization denials by payer, service type, and reason. Patterns reveal whether denials are driven by documentation gaps, changing payer criteria, or specific clinical reviewers. Use this data to adjust submission practices.

6. Pursue Peer-to-Peer Reviews

When a prior authorization is denied, request a peer-to-peer review with the payer's medical director. Peer-to-peer reviews overturn initial denials 50-75% of the time, according to AMA survey data. Document the conversation and the payer's stated criteria for denial.

7. Automate What Can Be Automated

Electronic prior authorization — whether through 278 transactions, FHIR APIs, or AI-powered platforms — reduces the cost per transaction from $11.17 to $1.89 (CAQH Index). At scale, the savings from automation fund the technology investment within months.

Prior Authorization Reform: Legislative Landscape

Prior authorization reform is among the most active areas of healthcare legislation at both the federal and state levels.

Federal

• CMS-0057-F (described above): Mandates electronic prior authorization, shorter decision timelines, and transparency reporting for Medicare Advantage, Medicaid managed care, and QHP plans. Key provisions effective January 2027.
• Improving Seniors' Timely Access to Care Act: Passed the House and continues to advance in the Senate. Would require Medicare Advantage plans to establish electronic prior authorization programs, make approval decisions within defined timeframes, and publicly report approval and denial data.

State-Level Reform

As of 2026, over 30 states have enacted prior authorization reform legislation addressing one or more of the following:

• Required response timelines for prior authorization decisions
• "Gold card" or "green light" programs that exempt providers with high approval rates from prior authorization requirements
• Restrictions on retroactive prior authorization denials
• Requirements for clinical peer review before denials are issued
• Prohibitions on prior authorization for emergency services

Texas (HB 3459), Michigan, and Louisiana have implemented "gold card" programs that exempt providers from prior authorization requirements for specific services if their historical approval rate exceeds 90%. These programs incentivize accurate ordering while reducing administrative burden for high-performing providers.

Frequently Asked Questions

What is prior authorization in simple terms?

Prior authorization is advance approval from your health insurance company before you receive a specific medical service, procedure, or medication. Your doctor's office submits a request with clinical documentation explaining why the service is medically necessary. The insurance company reviews the request and either approves or denies coverage. Without prior authorization for services that require it, the insurance company will not pay the claim.

How long does prior authorization take?

Standard prior authorization requests typically take 5-14 business days, though regulations are tightening these timelines. Urgent or expedited requests must be processed within 24-72 hours depending on the payer and regulatory jurisdiction. Medicare Advantage plans must respond within 7 calendar days for standard requests and 72 hours for expedited requests. Under the CMS 2027 interoperability rule, these timelines will apply to a broader range of plans.

What happens if prior authorization is denied?

If prior authorization is denied, you have the right to appeal. The first step is typically requesting a peer-to-peer review, where the ordering physician speaks directly with the payer's medical director to discuss the clinical rationale. If the peer-to-peer does not result in approval, you can file a formal appeal with additional clinical documentation. For Medicare Advantage, you have specific appeal rights under 42 CFR 422.566-590, including the right to an expedited appeal if delay could jeopardize your health. AMA data shows that 50-75% of peer-to-peer reviews and a significant percentage of formal appeals result in overturn of the initial denial.

What is the difference between prior authorization and pre-certification?

The terms are often used interchangeably but have subtle distinctions. Prior authorization is the broader term encompassing any advance approval requirement. Pre-certification typically refers specifically to the verification that a planned inpatient admission or surgical procedure meets medical necessity criteria. In common practice, both terms mean the same thing: obtaining advance approval from the payer before the service is performed. Other synonymous terms include pre-approval and pre-determination.

Do all insurance plans require prior authorization?

No, but most commercial plans, all Medicare Advantage plans, and all Medicaid managed care plans require prior authorization for at least some services. Traditional (Original) Medicare has limited prior authorization requirements, though CMS has been expanding prior authorization to certain high-cost services (such as repetitive scheduled non-emergent ambulance transports and certain durable medical equipment). Self-funded employer plans may have different prior authorization requirements depending on how the plan is designed.

What is electronic prior authorization (ePA)?

Electronic prior authorization replaces manual prior authorization methods (fax, phone, payer portals) with automated electronic transactions. The HIPAA 278 transaction standard has been available for years but had limited adoption. Newer FHIR-based approaches — developed through the HL7 Da Vinci Project — enable prior authorization to be initiated and completed within the provider's EHR workflow, with clinical documentation automatically extracted from the patient's record. CMS rule CMS-0057-F mandates FHIR-based electronic prior authorization for Medicare Advantage, Medicaid managed care, and QHP payers by January 2027.

How does AI help with prior authorization?

AI automates multiple stages of the prior authorization process: determining whether authorization is required for a specific service and plan, extracting relevant clinical documentation from the patient's record, assembling and submitting the authorization request, predicting approval likelihood, tracking request status, and generating appeal materials when requests are denied. AI-powered prior authorization platforms like QuickIntell reduce manual prior authorization effort by 75-85% and cut average turnaround times from 5-7 days to under 2 days.

What services require prior authorization?

Services commonly requiring prior authorization include advanced imaging (MRI, CT, PET scans), specialty medications and biologics, elective surgical procedures, durable medical equipment, inpatient admissions, genetic testing, physical and occupational therapy, behavioral health services, and home health care. The specific list varies by payer and plan. CMS and commercial payers publish their prior authorization requirement lists, which are typically updated quarterly or annually.