What is prior authorization? It is the process where a health plan has to approve a service, procedure, or drug before the patient gets it, or the plan won’t pay. It’s sometimes called pre-authorization or pre-certification. For a physician practice, it’s an administrative step that sits before the claim, and missing it is one of the most common reasons claims get denied.
How Does Prior Authorization Work?
The basic flow is the same across most payers:
- The physician orders a service that the patient’s plan lists as requiring authorization.
- The practice submits a request with clinical notes, diagnosis codes, and the CPT or HCPCS codes for the planned service.
- The payer reviews it against its medical policy and approves, denies, or asks for more information.
- If approved, the practice gets an authorization number with an approved code set, number of units, and date window.
- The claim is billed with that authorization attached, and it has to match what was approved.
Each plan keeps its own list of services that need authorization, and the lists change. Advanced imaging, specialty drugs, elective surgery, and durable medical equipment are common categories.
How Much Work Does Prior Authorization Create?
In an AMA survey of 1,000 physicians done in late 2024, practices reported an average of 39 prior authorization requests per physician per week. Physicians and their staff spent about 13 hours a week on them, and 40% of physicians had staff working only on prior authorizations.
That’s why authorization isn’t just a clinical issue. It’s a staffing cost, and when it’s done badly it becomes a denial cost too.
What Did CMS Change in 2026?
The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) set new requirements for Medicare Advantage plans, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan issuers on the federal exchanges. Starting January 1, 2026:
- Decision timeframes: 72 hours for expedited requests and 7 calendar days for standard requests. This applies to all of those payers except the exchange QHP issuers.
- Specific denial reasons: payers must give a specific reason when they deny a prior authorization.
- Public reporting: payers must post certain prior authorization metrics on their websites every year.
The rule also requires those payers to build a Prior Authorization API by January 1, 2027. Drugs are excluded from all of these provisions. Commercial employer plans aren’t covered by this rule, so their timelines depend on state law and the plan contract.
Where Practices Lose Money on Prior Authorization
- No authorization on file because nobody checked the payer’s current list.
- The service changed. The approved CPT code doesn’t match what was performed, or more units were billed than approved.
- The approval expired before the date of service.
- Wrong payer. Authorization was obtained from the primary plan when the secondary or a carved-out benefit manager owns that service.
These problems usually start with eligibility verification that confirms coverage but never checks authorization rules. Once the denial comes in, it follows the workflow in our prior authorization denials guide.
Frequently Asked Questions About Prior Authorization
What is prior authorization in simple terms?
It is approval from a health plan before a patient receives a service. Without it, the plan can refuse to pay the claim for services on its prior authorization list.
How long does prior authorization take?
For Medicare Advantage, Medicaid, and CHIP plans covered by CMS-0057-F, decisions are due within 72 hours for expedited requests and 7 calendar days for standard requests, starting January 1, 2026. Other payers follow their own contracts and state law.
Is prior authorization the same as a referral?
No. A referral is a primary care physician’s sign-off to see a specialist, usually required by HMO plans. Prior authorization is the payer’s own approval of a specific service.
Do drugs fall under the new CMS prior authorization rules?
No. CMS-0057-F excludes prior authorization decisions for drugs from its timeframe, denial-reason, and API requirements.
What OmniBridge Actually Does
We check authorization requirements at scheduling, track approval windows and approved codes, and match the claim to the authorization before it’s billed. Mismatches get caught at our desk instead of in a denial.
If prior authorization is eating your staff’s week, request a free practice audit and we’ll show you where the time and denials are coming from.
