The prior authorization process is the sequence a medical practice follows to get a health plan’s approval before it delivers a service, orders a drug, or schedules a procedure. In practical terms it runs in seven steps: verify eligibility, confirm the payer’s clinical criteria, assemble the documentation, submit through the payer’s required channel, track the request against the decision clock, respond to any request for more information, then record the determination and appeal if it is denied.
Two things changed the math on this in 2026. Federal rules now cap how long certain plans can take to answer, and the plans themselves made a set of voluntary commitments with dates attached. Both are covered below, along with what a practice should actually change in its own workflow.
Practice Management Consultancy advises independent practices on payer strategy, credentialing, and the operational side of the prior authorization process. We run a clinic ourselves, so the guidance here is written from the manager’s chair rather than the vendor’s.
What is the prior authorization process?
Prior authorization is a payer’s requirement that a service be approved in advance as medically necessary and covered under the patient’s benefit. The prior authorization process is your practice’s side of that requirement: the steps your staff take to obtain, document, and defend that approval.
It is worth naming what it is not. An approval is not a payment guarantee. Coverage still depends on eligibility on the date of service, benefit limits, and the plan’s own claim edits. It is also not the same as credentialing. Credentialing establishes that your provider may participate with the plan at all, which is a separate track with its own timeline.
The terminology varies by plan. Precertification, preauthorization, prior approval, and prospective utilization review usually describe the same thing. A few plans distinguish “predetermination,” a non-binding opinion on coverage, from a binding authorization. Read the plan’s own definition rather than assuming.
Who typically initiates the prior authorization process?
The ordering or rendering provider’s practice initiates the prior authorization process in almost every case. The patient is rarely the submitting party for medical services, though for pharmacy benefits a dispensing pharmacy often triggers the request back to the prescriber.
That matters for accountability. Because the request originates with you, a missed authorization is generally your write-off, not the patient’s balance. Practices that treat the prior authorization process as “the front desk’s paperwork” rather than a defined clinical and administrative workflow tend to discover the gap only after the claim is already denied.
What are the 7 steps in the prior authorization process?
Map the prior authorization process as a numbered workflow with an owner at each step. Practices that write it down catch failures at step two instead of at the denial.
- Verify eligibility and check the requirement. At scheduling, confirm active coverage and check the plan’s current authorization list for the planned CPT or HCPCS code. Requirement lists change quarterly, so a rule you learned last year is not evidence.
- Pull the plan’s clinical criteria. Find the specific medical policy the reviewer will apply, including any conservative-care or step-therapy requirement, and note exactly which findings the policy asks you to document.
- Assemble the packet. Diagnosis and procedure codes, the clinical note that maps to the criteria, prior treatment history, imaging or test results, and the ordering provider’s attestation. Incomplete documentation is the most common avoidable cause of a delay.
- Submit through the channel the payer requires. Portal, electronic transaction, or fax, depending on the plan. Capture the reference number, the submission timestamp, and the name of anyone you spoke with.
- Track against the decision clock. Log every open request with its due date so nothing sits unworked. A weekly aging report is the minimum.
- Respond to requests for more information immediately. Payers frequently pause the clock pending records. Build a same-day turnaround habit, and have the ordering provider ready for a peer-to-peer review when the reviewer asks for one.
- Record the determination, then appeal if needed. File the approval number and its expiration in the chart and on the encounter. If the answer is no, read the stated reason, correct the gap, and appeal inside the plan’s window.
Steps one and two are where the leverage in the prior authorization process is. Everything downstream is cheaper when the request goes out complete and matched to the policy the reviewer will actually use.
How long does a payer have to decide?
For plans covered by the CMS Interoperability and Prior Authorization final rule (CMS-0057-F), the answer since January 1, 2026 is 72 hours for expedited requests and 7 calendar days for standard requests, with the possibility of an extension to as much as 14 days. Those timeframes apply to covered items and services and exclude drugs.
The important limit on those prior authorization process deadlines is scope. The rule reaches Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and issuers of qualified health plans on the federally facilitated exchanges. It does not reach commercial and self-funded employer plans, which continue to follow state law and your contract. Check which bucket a plan sits in before you quote a deadline to a patient.
| Requirement | Who it applies to | Effective |
|---|---|---|
| 72 hours expedited, 7 calendar days standard (drugs excluded) | MA, Medicaid and CHIP FFS, Medicaid and CHIP managed care, FFE qualified health plans | January 1, 2026 |
| Specific reason must be given for every denial | Same impacted payers | January 1, 2026 |
| Annual prior authorization metrics reported to CMS, plus public posting by Medicaid programs | Same impacted payers | Reporting begins 2026 |
| Prior Authorization, Provider Access, and Payer-to-Payer FHIR APIs | Same impacted payers | January 1, 2027 |
| Voluntary plan commitments: narrowed authorization lists, 90-day continuity of care when a patient switches plans, clearer determinations | Participating plans, including commercial coverage | January 1, 2026 |
| Voluntary plan commitments: standardized electronic submission framework, at least 80% of complete electronic approvals answered in real time | Participating plans | 2027 |
What changed in the prior authorization process in 2026?
Three federal provisions reshaping the prior authorization process took effect on January 1, 2026 for impacted payers. Decision timeframes shortened to the limits above. Every denial must now come with a specific reason given to the provider. And payers began publicly posting prior authorization metrics, including approval and denial rates, appeal outcomes, and average decision times, on their own websites. This applies to every impacted payer, not just Medicaid plans, and the first postings were due March 31, 2026 covering 2025 data.
The application programming interface requirements are the 2027 half of the same rule. Impacted payers must stand up a Prior Authorization API, a Provider Access API, and a Payer-to-Payer API, and update the Patient Access API, by January 1, 2027 for Medicare Advantage organizations and state Medicaid and CHIP fee-for-service programs. Managed care plans and exchange issuers follow on their first rating or plan year beginning on or after that date. The practical promise is that your system will be able to ask a payer what documentation a given service requires instead of your staff hunting for it.
Separately, on June 23, 2025 a group of health plans announced voluntary commitments through AHIP. Those include demonstrated reductions in the scope of services requiring authorization by January 1, 2026, a 90-day transition during which a new plan honors an existing authorization for benefit-equivalent in-network services when a patient changes coverage mid-treatment, clearer explanations of determinations for fully insured and commercial coverage by January 1, 2026, a standardized electronic submission framework targeted to be operational by January 1, 2027, and a goal that in 2027 at least 80% of complete electronic authorization approvals are answered in real time.
Treat the voluntary commitments as leverage, not as law. They are useful language to quote back to a plan representative, and they belong in your notes when a contract comes up for renewal.
What does the prior authorization process cost a practice?
The American Medical Association’s 2025 Prior Authorization Physician Survey, released in May 2026 and based on 1,000 practicing physicians, puts hard numbers on the burden. Physicians complete an average of 40 prior authorizations per week, and the work consumes an average of 13 hours of physician and staff time each week.
Two in five physicians (40%) employ staff dedicated exclusively to authorization tasks. Nearly one in three (32%) report that requests are often or always denied. More than nine in 10 (94%) say prior authorization contributes to burnout, and 95% say it delays access to necessary care. Nearly four in five (79%) report that patients abandon treatment because of authorization challenges.
Put that against your own payroll. Thirteen hours a week of mixed physician and staff time is roughly a third of a full-time position per physician, before you count the clinical time lost to peer-to-peer calls. That is the number worth carrying into a payer contract negotiation, and the number that makes a serious look at practice overhead worth the afternoon.
Who should own the prior authorization process in your practice?
Ownership of the prior authorization process should sit with one named role, not be distributed across whoever has a free minute. In a small practice that is usually a designated authorization coordinator who also handles referrals. Past roughly four providers, the volume generally justifies a dedicated position.
The clinical side still needs a defined part. Someone with clinical training has to translate the note into the plan’s criteria language, and the ordering provider has to be reachable for peer-to-peer reviews on short notice. Block that time rather than treating it as an interruption.
Write the role into the job description and into onboarding so it survives turnover. Our guides to medical practice staffing and physician onboarding cover how to structure that handoff.
How do you make the prior authorization process faster?
Most delay is self-inflicted or preventable. These are the levers that move the prior authorization process the most, in rough order of return.
- Check the requirement at scheduling, not at check-in. A same-week discovery is a cancelled appointment. A three-week lead time is a solved problem.
- Keep a payer criteria library. One shared document per major plan, with the medical policy link, the required documentation, the submission channel, and the current turnaround you observe. Review it quarterly.
- Standardize the clinical note. Build templates that prompt for the elements the policy requires, so the documentation is captured during the visit rather than reconstructed afterward. Your EHR configuration does most of this work if you set it up deliberately.
- Use the electronic channel wherever the plan offers one. Fax submissions are slower to acknowledge and harder to prove.
- Log every request with a due date. A simple tracker with submission date, reference number, payer deadline, and status beats memory and beats a shared inbox.
- Escalate on a schedule. When a plan passes its own deadline, cite the deadline, the reference number, and the applicable rule. Documented escalation works far better than a general complaint.
- Ask about gold carding. Some plans exempt providers with consistently high approval rates from authorization on specific services. If your approval rate is strong, raise it at contract renewal.
- Appeal more than you think you should. Read the specific denial reason the plan is now required to give, fix that gap, and refile within the window.
None of this requires new software. It requires a written workflow, one accountable owner, and a manager who reviews the aging report every week. The same discipline that shortens authorization turnaround also shortens patient wait times, because both are scheduling problems wearing different clothes.
How does prior authorization connect to contracting and credentialing?
The prior authorization process sits downstream of two decisions you make long before a patient books. The first is which plans you participate with and on what terms. The second is whether your providers are fully enrolled with those plans.
Contract terms are negotiable in ways many practices never test. Turnaround commitments, notice requirements before a plan expands its authorization list, and gold-carding eligibility can all be raised at renewal. Our guide to payer contract negotiation strategies covers how to prepare for that conversation with your own data.
Enrollment gaps produce denials that look like authorization problems but are not. A provider who is not yet loaded under the group, or whose CAQH profile has lapsed attestation, will generate rejections no prior authorization process can fix. Keep insurance credentialing and Medicare provider enrollment current, and work from a standing physician credentialing checklist.
Finally, keep the patient-facing side clean. Estimates and financial conversations should reflect what the plan actually approved, and should account for your obligations under the No Surprises Act. Fold the prior authorization process into your written compliance program so the standard survives staff turnover.
Which prior authorization metrics should you track?
Five numbers tell you whether the prior authorization process is under control. Review them monthly alongside your other medical practice KPIs.
- Median turnaround, by payer. From submission to determination. Track the median and the worst case, and compare each plan against its own regulatory or contractual deadline.
- First-pass approval rate. Approvals without a request for additional information. A low rate points at documentation, not at the payer.
- Rework rate. The share of requests that need a resubmission, an appeal, or a peer-to-peer review. This is where staff hours disappear.
- Appeal overturn rate. A high overturn rate means the plan’s first answer is unreliable and you should appeal more aggressively.
- Services delivered without a required authorization. The direct write-off. This should be near zero, and any instance deserves a root-cause review.
Frequently asked questions about the prior authorization process
How long does prior authorization take?
For plans covered by CMS-0057-F, 72 hours for expedited requests and 7 calendar days for standard requests since January 1, 2026, with a possible extension to as much as 14 days. Commercial and self-funded employer plans are not covered by that rule and vary by state law and contract, so confirm the applicable standard per plan rather than quoting a single number.
Is prior authorization the same as precertification?
In most plans, yes. Precertification, preauthorization, and prior approval generally describe the same requirement. Predetermination is different in some plans and is a non-binding coverage opinion rather than an authorization, so read the plan’s own definitions.
Does an approval guarantee payment?
No. An authorization confirms medical necessity for the requested service, but payment still depends on eligibility on the date of service, benefit limits, correct coding, and timely filing. Verify eligibility again on the day of service, especially for authorizations obtained weeks in advance.
What should a practice do when a payer misses its deadline?
Escalate in writing with the reference number, the submission timestamp, and the deadline you are citing. For plans covered by CMS-0057-F, cite the applicable timeframe directly. Keep the record, because a pattern of missed deadlines is useful evidence at contract renewal and in a complaint to the state insurance regulator or the plan’s regulator.
Can the prior authorization process be automated?
Partly, and more so from 2027. The CMS-0057-F Prior Authorization API is intended to let a practice’s system query documentation requirements and submit requests electronically, and participating plans have committed to a standardized electronic framework on a similar timeline. Until then the realistic gains come from workflow design rather than technology.
Getting help with the prior authorization process
Most practices do not have a prior authorization process problem so much as a workflow and contracting problem that shows up as authorizations. The fix is usually a written process, a named owner, a payer criteria library, and a harder conversation at renewal.
Practice Management Consultancy works with independent practices on exactly that: payer contracting, credentialing, compliance, and the operational design behind them. We are consultants and practice operators, not a billing service, so the deliverable is a process your own team runs.
To talk it through, contact us at contact@practicemanagementconsultancy.com or (706) 909-3271, or read more about our consulting services.
Sources: the CMS Interoperability and Prior Authorization final rule (CMS-0057-F) as published in the Federal Register; the American Medical Association’s 2025 Prior Authorization Physician Survey; and the health plan commitments announced through AHIP on June 23, 2025. This article is general operational guidance and is not legal advice.
Disclosure: our team operates and manages the medical practice referenced in first-person examples on this site.
Want a second opinion on this?
We run a clinic ourselves, so these decisions cross our desk every week. If you want to talk one through for your own practice, request a short call. We reply within one business day.
