Prior Authorization for Insurance: The Paperwork Explained

Prior authorization for insurance is a health plan's decision, made before a service, drug or piece of equipment is provided, that it is medically necessary. The provider's office submits a request with codes and clinical notes, the plan approves, denies or asks for more, and the office tracks each request until a decision arrives.

What prior authorization for insurance means

Prior authorization for insurance is a check a health plan runs before care is delivered. The HealthCare.gov glossary entry on preauthorization defines it as a decision by the plan that a health care service, treatment plan, prescription drug or durable medical equipment is medically necessary, and notes it is "Sometimes called prior authorization, prior approval or precertification."

The request almost always comes from the provider, not the patient. The ordering practitioner's office, or the facility that will deliver the service, fills in the plan's request form, attaches the clinical notes that support it, and sends it by portal, fax, phone or an electronic transaction. The patient often hears about it only when a request is delayed or denied.

Payers require prior authorization to control whether a costly or easily overused service is delivered at all, and in what setting. From the provider's side, it is a condition of being paid. A service delivered without a required approval is likely to be denied, and the patient may not be billable for it, depending on the contract.

Two limits are worth knowing from the start. The HealthCare.gov glossary says plans can require preauthorization "except in an emergency." It also says "Preauthorization isn't a promise your health insurance or plan will cover the cost." An approval confirms medical necessity. Eligibility, benefits and the claim itself are still checked when the bill arrives.

Which services usually need prior authorization?

Services that usually need prior authorization are planned, costly or easy to overuse: advanced imaging, specialty and high-cost drugs, durable medical equipment and planned procedures. Each plan publishes its own list, and lists differ by plan, product and state, so the plan's current list is the only reliable answer for a specific patient.

Medicare fee-for-service publishes its lists openly, which makes them a useful example of how such lists look.

Planned procedures. The CMS page on prior authorization for certain hospital outpatient department services lists blepharoplasty, botulinum toxin injections, panniculectomy, rhinoplasty and vein ablation, then implanted spinal neurostimulators, cervical fusion with disc removal and facet joint interventions, added in later years.

Durable medical equipment. The CMS page on the DMEPOS prior authorization process keeps a Required Prior Authorization List of items where an approval is a "condition of payment". It names power mobility devices, pressure reducing support surfaces, many orthoses and lower limb prosthetics, and adds codes over time.

Imaging and drugs. Advanced imaging and high-cost specialty drugs are two more categories to look for on each plan's own list, and the HealthCare.gov definition names prescription drugs directly. Check drug requests separately from medical services, because the federal rule described later in this post leaves drugs out of its decision deadlines.

A practical habit: keep a one-page cheat sheet per major payer listing the services your practice orders most often and whether each needs approval, with the date you last checked the plan's list. Payers change their lists, so an undated cheat sheet goes stale without anyone noticing.

The prior authorization request lifecycle

The prior authorization request lifecycle has five states: submitted, pended, approved, denied and appealed. A request starts when the provider sends it, may pend while the plan waits for more information, ends in an approval or a denial, and a denial can be appealed. Each state has its own next action for the office.

Submit. The office sends the plan's request form with the member ID, ordering provider, service codes, diagnosis codes and supporting notes. The fields on that form and the documents that go with it are laid out field by field in the guide to prior authorization request form fields, section by section.

Pend. The plan has the request but needs something: a missing note, a test result, a different code. A pend notice usually names what it needs and a deadline to supply it. A pend that is not answered often turns into a denial.

Approve. The plan issues an approval with a reference number, the approved service and codes, a number of units or visits, and dates the approval is valid. Record every one of those details, because the claim must match them.

Deny. The plan declines the request. For many government-sponsored plans the denial now has to say why. The CMS fact sheet on the Interoperability and Prior Authorization final rule (CMS-0057-F) says impacted payers "must provide a specific reason for denied prior authorization decisions", whether the request came by portal, fax, email, mail or phone.

Appeal. The provider asks the plan to reconsider, usually with more clinical documentation or a peer-to-peer conversation between clinicians. Appeal levels and deadlines vary by plan type, and appealing a denied claim or request is covered in the revenue cycle automation category.

Prior authorization status tracking without phone calls

Prior authorization status tracking without phone calls means keeping one log of every open request, checking each payer's portal on a schedule, and calling only when the portal shows nothing new past the expected decision date. A shared log replaces sticky notes and memory, and a set next-check date stops staff from calling about requests that are not due yet.

The log needs only a handful of columns. The template below uses fictional entries; every name, number and date is made up for the example.

How to run it:

• Set "next check" when you send. Use the plan's stated decision time, or your own experience with that payer, to pick a date. Nobody looks at the request until then.
• Check portals in one sitting. Work down the log once or twice a day, sorted by next check, rather than chasing requests one at a time.
• Call only when overdue. A request past its next-check date with no portal update is the one that earns a phone call. Write the call reference number and the name of the person you spoke to in the log.
• Record pends as tasks. A pend has a deadline. Put the missing item and the date in the status so it is visible to whoever opens the log.
• Watch the expiry column. An approval valid until a date that falls before the scheduled service is a denial waiting to happen.

Requests sent by fax add one risk to the log: the fax going to the wrong number. When that happens, the steps for both sender and receiver are in the guide to what to do with a misdirected medical fax.

How long does prior authorization take?

Prior authorization takes as long as the payer's decision deadline allows, and those deadlines differ by program. CMS sets a seven calendar day limit for standard requests at Medicare Advantage, Medicaid and CHIP plans and in Medicare fee-for-service programs, with 72 hours or 2 business days for urgent ones. Commercial plans follow their own contracts and state rules.

For the payers covered by CMS-0057-F, the CMS fact sheet on the Interoperability and Prior Authorization final rule sets decisions "within 72 hours for expedited (i.e., urgent) requests and seven calendar days for standard (i.e., non-urgent) requests." Those impacted payers are Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid and CHIP managed care entities, and Qualified Health Plan issuers on the Federally Facilitated Exchanges, though the timeframe provision excludes the Exchange plans. The operational provisions generally began on January 1, 2026. The fact sheet also says "this provision does not apply to prior authorization decisions for drugs."

Medicare fee-for-service programs have their own clocks. Both the hospital outpatient department page and the DMEPOS page from CMS state a standard review time of 7 calendar days for requests submitted on or after January 1, 2025, and 2 business days for expedited requests.

The same rule schedules a Prior Authorization API for impacted payers by January 1, 2027, meant to list covered items, identify documentation requirements and carry requests and responses electronically. Until payers have built it, portals, fax and phone remain the main channels for most offices.

The clock starts when the plan receives a complete request. A request missing a required note may pend, and a pend can restart the wait. The fastest decisions go to complete requests.

Prior authorization paperwork errors that lead to denials

Prior authorization paperwork errors that lead to denials are mostly avoidable: missing clinical notes, wrong or mismatched codes, approvals that expired before the service, and services that changed after approval. Each one is a gap between what the request said and what the plan needed or what was later billed.

Missing clinical notes. The request form says the service is needed, but the attached notes do not show why. Plans look for documented history, failed earlier treatments and test results. Attach the notes that answer the plan's published criteria, not the whole chart.

Wrong codes. A CPT or HCPCS code that does not match the ordered service, or a diagnosis code that does not support it, leads to a denial or a pend. A common version is a code typed with one digit transposed.

Codes that change between approval and claim. The surgeon approved for one procedure performs a related one, or the MRI ordered without contrast is done with contrast. The claim then carries a code the approval does not cover. Check the approved codes against the scheduled service the day before, and contact the plan if the plan of care changed.

Expired approvals. Approvals have a start and end date and sometimes a unit count. A service rescheduled past the end date, or a therapy course that runs beyond its approved visits, falls outside the approval.

Wrong member or plan. The patient changed plans, or the request went under a family member's member ID. Verify eligibility before submitting, not after the denial.

No record of what was sent. When a plan says it never received a request, the office needs the fax confirmation or portal receipt. Keep both with the log entry.

Code mismatches often surface only when the claim goes out. Schema Care pulls diagnosis and procedure codes from CMS-1500 and UB-04 claims into fields a reviewer can hold up against the approval letter, with low-confidence fields sent to a person first. The fictional EOB threshold demo shows how that review threshold behaves on a sample page.