Prior Authorization in Healthcare: How It Works and Why It Matters

Prior authorization (PA) is a cost and utilization management process used by health insurers and pharmacy benefit managers that requires a provider to obtain approval from a payer before delivering a specific service, medication, or procedure. This page covers the definition and regulatory scope of prior authorization, the step-by-step mechanism through which approvals are sought and granted or denied, the clinical contexts where PA requirements are most common, and the boundaries that distinguish approved, denied, and exempt requests. Understanding how PA operates is essential for interpreting insurance coverage, medical billing and coding basics, and patient rights in healthcare.

Definition and scope

Prior authorization is a payer-imposed requirement that mandates prospective approval for covered services before those services are rendered. The Centers for Medicare & Medicaid Services (CMS) defines PA as a process through which a health plan determines, in advance, whether a requested item or service is medically necessary and covered under the beneficiary's plan. The requirement applies across commercial insurance, Medicare Advantage, Medicaid managed care, and self-funded employer plans governed by the Employee Retirement Income Security Act of 1974 (ERISA).

Federal regulation of PA timelines and procedures became more explicit with the Interoperability and Prior Authorization Final Rule published by CMS in January 2024 (CMS-0057-F), which applies to Medicare Advantage organizations, Medicaid managed care plans, and health plans in the individual and small group markets. That rule established mandatory decision timelines: 72 hours for urgent requests and 7 calendar days for standard requests.

PA scope varies by plan type:

• Commercial/fully insured plans — regulated by state insurance commissioners and subject to state-specific PA mandates
• Medicare Advantage — regulated by CMS under 42 CFR Part 422
• Medicaid managed care — regulated by CMS under 42 CFR Part 438 and administered by state Medicaid agencies
• Self-funded ERISA plans — primarily governed by federal law; state PA mandates generally do not apply

The American Medical Association's (AMA) 2023 Prior Authorization Physician Survey found that 94% of physicians reported that PA sometimes, often, or always delays care, establishing the process as a documented point of friction in care delivery.

How it works

The prior authorization process follows a defined sequence with distinct decision points. While the specific steps differ by payer and service type, the standard framework is consistent across health insurance types:

1. Physician or provider identifies the need — The treating clinician determines that a specific procedure, medication, durable medical equipment, or specialist referral is clinically indicated.
2. PA request submission — The provider or office staff submits a PA request to the payer, typically including a Current Procedural Terminology (CPT) code, supporting clinical documentation (notes, lab results, diagnostic imaging), and often the patient's diagnosis code (ICD-10-CM).
3. Payer review — A payer-designated reviewer — often a registered nurse or pharmacist at the initial tier — evaluates the request against the plan's clinical criteria, which are frequently derived from nationally recognized sources such as InterQual (owned by Change Healthcare/Optum) or Milliman Care Guidelines.
4. Medical necessity determination — If the initial reviewer cannot approve the request, it escalates to a physician reviewer. Payers use written clinical criteria that must, under 42 CFR § 438.210, be based on individual medical necessity and not solely on cost.
5. Decision notification — The payer issues an approval, denial, or modification. Denials must include a written explanation citing the clinical criteria applied, per requirements under the ACA (45 CFR § 147.136).
6. Appeals process — Denied PA requests trigger appeal rights. Internal appeals must be exhausted before external independent review, which is mandated for non-grandfathered plans under the ACA. Medicare Advantage enrollees have appeal rights under 42 CFR § 422.566–422.619.

Gold carding is a reform mechanism adopted in at least 27 states as of the AMA's 2023 tracking, by which providers with high PA approval rates are exempted from PA requirements for specific services — creating a contrast with standard PA: standard PA applies universally to all providers, while gold carding creates an exemption class based on demonstrated compliance history.

Common scenarios

Prior authorization is applied most frequently in five clinical domains:

Specialty pharmaceuticals — Biologic agents for conditions such as rheumatoid arthritis, Crohn's disease, and psoriasis routinely require PA. Step therapy ("fail first") protocols may require a patient to trial and fail a lower-cost drug before the plan approves the prescribed agent, a practice governed by state step-therapy laws in at least 30 states (NCSL tracking).

Diagnostic imaging — High-cost imaging studies, particularly MRI, CT, and PET scans, are subject to PA under most commercial and Medicare Advantage plans. Diagnostic imaging and lab services represent one of the highest-volume PA categories by request count.

Surgical procedures — Elective and semi-elective surgeries, including joint replacement, bariatric procedures, and spinal surgery, typically require PA. Procedures performed at ambulatory surgical centers are subject to the same PA requirements as hospital-based procedures under most plan designs.

Mental health and substance use disorder treatment — Mental health services and substance use disorder services involve PA for residential treatment, intensive outpatient programs, and certain psychiatric medications. The Mental Health Parity and Addiction Equity Act (MHPAEA) of 2008, enforced jointly by the Department of Labor, HHS, and the Treasury, prohibits applying more restrictive PA requirements to behavioral health benefits than to comparable medical or surgical benefits.

Durable medical equipment (DME) — Wheelchairs, CPAP devices, home oxygen, and prosthetic limbs require PA under Medicare Part B (42 CFR § 410.38) and most commercial plans.

Decision boundaries

PA decisions fall into three categories — approval, denial, and modification — and each carries defined procedural consequences.

Approval grants authorization for the specific service, typically with an authorization number valid for a defined period (30–365 days depending on the service type). Approval is service-specific; authorization of a procedure code does not constitute approval for a different code even if clinically related.

Denial is categorized by the basis of the determination:

Modification occurs when a payer approves a different level of service than requested — for example, approving outpatient rather than inpatient hospitalization. Modifications carry the same appeal rights as denials under the ACA's internal claims and appeals regulations (45 CFR § 147.136).

Emergency services represent the clearest exemption boundary. Under the Emergency Medical Treatment and Labor Act (EMTALA), providers cannot delay emergency stabilization pending PA. The ACA further prohibits payers from requiring PA as a precondition for emergency services, meaning post-service review of medical necessity is the applicable mechanism rather than prospective authorization.

Chronic disease management programs and care coordination and case management services operate in a hybrid zone: initial PA may be required for certain interventions, but ongoing case management services are frequently carved out of PA requirements under value-based contract arrangements and accountable care structures described under value-based care models.

The No Surprises Act of 2020 (Public Law 116-260), effective January 2022, added a continuity-of-care requirement: when a patient's provider leaves a plan network mid-course-of-treatment, plans must continue coverage at in-network cost-sharing for an active treatment episode for up to 90 days, regardless of PA status under the new network arrangement.

References

• Centers for Medicare & Medicaid Services (CMS) — Interoperability and Prior Authorization Final Rule (CMS-0057-F)
• CMS — EMTALA Overview