Prior authorization is the step where a health plan decides whether a proposed service is covered and medically necessary before the practice delivers it. It sounds like paperwork, and some of it is, but treating it as paperwork alone is how practices lose revenue. A request can be approved and still cause a denial later if the approved service, provider, facility, codes, units, or dates do not match what was actually delivered. An approval is also not a payment guarantee. Eligibility, benefits, network status, coding, medical necessity, and claim requirements still have to line up.
This guide covers the full process from the clinician’s order to the paid claim, the 2026 federal timelines practices must know, what to do when a request is denied, how to track authorizations so none expire unnoticed, and when outsourcing makes sense. It is written for practices, not for payers, and every deadline and statistic below is stated with its scope, because prior authorization rules vary by payer, plan, state, and service. Never rely on a general timeline without checking the payer’s current policy for that specific plan and code.
The Prior Authorization Workflow, Step by Step
A clean workflow has nine steps. Skipping one, usually the eligibility check or the documentation check, is what creates most preventable denials.
- Order and document first. The clinician orders the service and documents the diagnosis, clinical rationale, prior treatments, failed alternatives, and supporting evidence. Staff should not shorten or paraphrase clinical notes to fit a form. If the payer’s criteria ask for a specific fact, such as how long symptoms lasted or what conservative treatment was tried, that fact needs to be in the record, not added later from memory.
- Check eligibility, coverage, and the authorization requirement as three separate questions. Is the patient eligible, meaning is the policy active on the service date? Is the service covered under that plan? And does that plan require prior authorization for this code and diagnosis? A yes to the first two does not answer the third. Check the specific plan and product, not just the insurer name. A Medicare Advantage HMO, a Medicare Advantage PPO, a commercial PPO, a Medicaid managed care plan, and a Marketplace plan from the same insurer can have different requirements. Check whether the ordering provider and the rendering provider are in network, whether authorization is needed for the facility, the professional service, or both, and whether the service falls under the medical benefit or the pharmacy benefit.
- Check the payer’s own requirements. Confirm the payer’s medical policy, required forms, clinical criteria, and submission channel, whether portal, fax, electronic transaction, or clearinghouse. The strongest documentation is documentation aimed at that payer’s criteria, not a general description of the patient’s history. For services a practice requests often, keep payer-specific documentation checklists so nothing routine is missed.
- Prepare and submit the request, then log the confirmation immediately. Include patient demographics and member ID, plan information, ordering and rendering provider information, facility information, requested procedure and diagnosis codes, requested date of service, number of visits or units, clinical documentation, requested urgency, and contact details for the clinical team. Check that the requested service, provider, location, and units match the actual order. Save the confirmation, portal acknowledgment, or fax receipt, and record the submission date and time, submission method, reference number, documents submitted, and expected response deadline. A submission confirmation is not an approval. Keep statuses separate: not submitted, submitted, received by payer, pending clinical review, additional information requested, approved, partially approved, denied, withdrawn, and expired.
- Monitor the request and answer information requests promptly. Check the payer portal and other channels regularly. If the payer asks for more documentation, identify exactly what is missing, get it from the clinician if needed, submit it, save the new confirmation, and keep tracking the original request. Silence from a payer is not approval, and a request left waiting for missing records is a request that will stall.
- Verify the determination in full. There are three main outcomes. If approved, verify the authorization number, approved service and codes, authorized provider and facility, approved visits or units, effective date, expiration date, and any conditions. If partially approved, for example six physical therapy sessions when twelve were requested, decide whether to proceed with the approved portion, request reconsideration, arrange a peer-to-peer discussion, or file an appeal. If denied, get the written denial, identify the specific reason, the policy or criterion applied, whether the denial is clinical or administrative, whether missing documentation can be supplied, whether a peer-to-peer review is available, and the appeal deadline.
- Communicate the result to everyone who acts on it. Tell the treating physician, the scheduling team, the patient when appropriate, the billing team, the referral coordinator, and any outside facility. Scheduling must use the authorization’s actual service and validity dates, not the date the patient prefers or the next open slot outside the window.
- Deliver the service and bill with the authorization number on the claim. After delivery, watch the claim for authorization-related denials. An authorization that was valid on the service date but billed with the wrong code, provider, or facility can still deny.
- Close the loop. Update the record with the actual service date, services delivered, units consumed, and authorization number used, and note whether another authorization will be needed. File the submission, the determination, supporting documentation, and later correspondence in the patient record and in the authorization tracker.
CMS-0057-F in 2026: The Decision Timelines Practices Must Know
The CMS Interoperability and Prior Authorization Final Rule, known as CMS-0057-F, sets new medical prior authorization decision times for impacted payers. These timelines took effect Jan 1, 2026, and they apply to medical items and services, not to prescription drugs.
| Request type | Decision deadline for impacted payers |
|---|---|
| Standard, non-urgent request | Within 7 calendar days |
| Expedited, urgent request | Within 72 hours |
Impacted payers are Medicare Advantage organizations, Medicaid managed care plans, Medicaid fee-for-service programs, CHIP managed care entities, and CHIP fee-for-service programs. The clock starts when the impacted payer receives the request, and it runs in calendar time, not business hours. Checking coverage requirements does not start the clock. The deadlines are maximum response periods. CMS expects decisions as expeditiously as the patient’s medical condition requires, so a payer should not treat seven days as a target for a patient who needs a faster answer.
Two more 2026 requirements matter for practices. Beginning in 2026, impacted payers must give a specific reason for a denied medical prior authorization decision, regardless of whether the request came through a portal, fax, email, mail, or phone. Impacted payers must also publicly report prior authorization metrics each year, with the first set due by March 31, 2026. The rule’s FHIR-based Prior Authorization API requirements, which are meant to make it easier to check whether authorization is needed, identify required documentation, and submit requests electronically, generally take effect Jan 1, 2027. A related electronic prior authorization measure for clinicians applies to the 2027 performance period.
Practices that also handle credentialing should keep the two timelines separate in their heads. Credentialing timelines answer a different question, how long payer enrollment takes, while the timelines here answer how long a payer has to decide an authorization request. Our payer-by-payer credentialing timelines explain the enrollment side in detail.
What the Timelines Do Not Cover
The new timelines are not universal deadlines for every health plan, and presenting them that way would mislead readers.
First, drugs are excluded from CMS-0057-F. Prescription drug prior authorization runs under separate rules. Part D drug decisions, for example, run on a separate clock of 72 hours for a standard request and 24 hours for an expedited request. Do not apply the medical timelines to a drug request.
Second, traditional Medicare fee-for-service and commercial employer plans are not subject to these CMS-0057-F timelines in the same way. State law or other payer rules may set separate deadlines for those plans, so check the plan and the state.
Third, Qualified Health Plans on federally facilitated exchanges are a special case that is easy to get wrong. CMS-0057-F includes those issuers in some interoperability and public reporting provisions, but it did not change their prior authorization decision time requirements. Practices should not automatically apply the new 7 day and 72 hour deadlines to federally facilitated Marketplace plans. Existing federal and state requirements continue to govern those plans.
Fourth, extensions are program-specific, not automatic. A standard decision may be extended by up to 14 additional calendar days in programs that allow an extension when more information is needed, but whether an extension applies, and under what conditions, depends on the program rules for that plan. Urgent requests do not get the same extension treatment. When a payer invokes an extension, record the reason, the date the practice was notified, and the revised deadline, and do not assume the extra time applies to every plan.
Finally, state prior authorization laws still matter. A state may set its own deadlines, forms, or appeal rules on top of the federal framework. Before publishing internal payer playbooks, verify the current state law for the states where the practice sees patients.
When a Prior Authorization Is Denied: Peer-to-Peer and Appeals
A denial is an actionable event, not the end of the process. Our complete denial management guide covers the full denial workflow that follows an unsuccessful peer-to-peer discussion or appeal. The first job is to read the denial properly. Get the full written denial, not just a portal status. Identify the exact reason, the medical policy or criterion the payer applied, and whether the problem is clinical or administrative. An administrative error, such as a wrong member ID or procedure code, should be fixed at the source before any clinical argument is made. A clinical denial needs a clinical answer.
A peer-to-peer review is a direct clinical discussion between the treating or ordering clinician and a physician or other qualified reviewer acting for the insurer. Its purpose is to let the treating clinician explain why the requested service is medically necessary and address the specific reason for denial. It is most useful when the denial turns on medical necessity, interpretation of clinical guidelines, a specific treatment criterion, insufficient documentation, or whether alternative treatments have been exhausted. It is less useful when the denial is a coding or eligibility error that a corrected submission would fix.
The typical sequence runs like this. The practice receives the denial and pulls the denial letter and the relevant clinical policy. The authorization team requests the peer-to-peer through the payer’s designated channel. The payer schedules the discussion, and the practice confirms the date, time, reviewer, and contact details. The treating physician prepares, the discussion takes place, the payer communicates the outcome, and the practice documents the result and gets written confirmation where available. Possible outcomes are approval, a maintained denial, a request for more documentation, or a modified approval for a different service, dose, or duration.
If the peer-to-peer does not overturn the denial, the practice moves to the formal appeal or reconsideration process for that program. Medicare Advantage follows its plan reconsideration process with independent review where applicable. Medicaid managed care follows the plan’s adverse benefit determination and appeal process, with a state fair hearing where applicable. Commercial and Marketplace plans follow their internal appeal procedures and applicable external review requirements. The practice should also verify the capacity in which it is appealing, whether as provider representative, authorized patient representative, or another authorized role. Denial management as a whole, from root cause to appeal, is a separate workflow from authorization intake, and mixing the two up is how appeal deadlines get missed.
One caution applies across all of these paths. A peer-to-peer request should never be assumed to suspend or extend the formal appeal deadline. Unless the insurer confirms otherwise in writing, keep preparing and filing the written appeal inside its own deadline. This matters most when a payer offers only a short peer-to-peer window.
How to Prepare for a Peer-to-Peer Call
Preparation decides most peer-to-peer calls before the physician picks up the phone. Do not enter the conversation with only a general understanding of the patient. Build a short preparation packet.
From the authorization team, the packet needs the complete denial letter, the payer’s medical policy and applicable clinical criteria, the authorization reference number, the patient and requested service details, the peer-to-peer scheduling deadline, the payer reviewer’s contact information, and the appeal deadline with submission instructions.
From the clinical team, it needs the relevant office visit notes, medical history, diagnostic and laboratory results, previous treatment history, results of conservative treatment, clinical findings that support the requested service, and any guidelines or peer-reviewed support that apply. The packet should also state plainly why alternatives are unsuitable or have already failed, with dates, and what harm delay would cause where that is clinically true.
On the call itself, a concise structure works best. Introduce the patient and the requested service briefly. Address the actual denial reason first, not the case in general. If the denial says the patient has not completed an adequate trial of conservative treatment, state precisely what conservative treatment was completed and what happened. Explain medical necessity from the patient’s actual findings. Address alternatives that were already tried and why further alternatives would be inappropriate. Explain the consequences of delay where clinically appropriate. Then ask for a specific determination: does the clinical information satisfy the applicable criteria, and will the initial denial be overturned?
After the call, record the reviewer’s name and credentials, the date and time, the clinical rationale discussed, the decision, and any written approval or determination. Calendar any remaining appeal deadline the same day.
Payer policies on peer-to-peer reviews change, and practices should check the current policy for each payer rather than relying on past experience. As one example of why this matters, some Medicare Advantage workflows now limit peer-to-peer reconsideration for certain inpatient and post-acute care determinations, with reconsideration running only through formal appeals. That kind of change is payer-specific and date-specific, so verify it for the payer in front of you before assuming a peer-to-peer will reopen the decision.
Tracking Prior Authorizations So None Expire Unnoticed
A practice can obtain an authorization and still lose money on it if the authorization expires before the service is delivered, or if the approved visits run out first. Tracking is therefore a revenue job, not a filing job. Every authorization needs one record in one central system, whether that is an electronic health record module, a practice management system, a dedicated authorization platform, or, for a small practice, a controlled spreadsheet with real ownership. A spreadsheet can work at low volume, but it should not become the permanent solution for a high-volume practice without automation and controls.
Each record should carry the patient name and record number, insurance company and plan type, requested service and codes, diagnosis code, ordering and rendering provider and facility, submission date, payer reference number, authorization number, authorization status, approval date, effective date, expiration date, approved visits or units, visits or units used, next follow-up date, assigned owner, and notes on payer communications and restrictions.
Two expiry controls matter, and both must be tracked together. Record the expiration date and the remaining visits or units, because whichever comes first controls. A physical therapy authorization for twelve visits with ten completed has two visits left, even if the expiration date has not passed. The same logic applies to occupational therapy, speech therapy, behavioral health, infusion treatments, recurring imaging, and durable medical equipment rentals and supplies.
Set alerts before expiration. A practical pattern many practices use is alerts at 30, 14, and 7 days before expiration, plus an alert when only a few visits remain. Those intervals are suggested practice intervals, not federal deadlines, and payer-specific validity periods vary, so set the alerts to fit the practice’s scheduling lead time. Flag any authorization that expires before its scheduled service date, and do not schedule a service outside the approved window without a new authorization or an extension.
Run a daily pending authorization work queue, reviewed every business day, with one accountable owner per case and a next action date for each. Useful queue categories are new orders awaiting a requirement check, cases ready to submit, cases submitted awaiting payer receipt, cases pending a decision, cases awaiting additional information, cases approaching expiration, denied cases awaiting a peer-to-peer or appeal decision, approved but unscheduled cases, partially approved cases, and expired cases awaiting a reauthorization decision. A request should never sit in a shared inbox with no owner.
Track peer-to-peer requests and appeals separately from the original authorization, because their deadlines and documentation differ. Record the denial reason, peer-to-peer date, appeal deadline, appeal outcome, and resubmission date in their own fields. A weekly report by payer covering volume, approval and denial rates, turnaround time, expiring authorizations, and aging pending requests will show payer-specific problems far earlier than a single practice-wide approval rate. One metric worth watching on its own is the share of approved authorizations that expire unused, which often reveals scheduling problems that an approval rate hides. Expired authorizations hit accounts receivable directly, because care delivered after an authorization expires or runs out of units usually counts as no authorization, and the patient generally cannot be billed for it under the contract.
When to Outsource Prior Authorization vs Keep It In-House
There is no universally correct answer here. The right choice depends on authorization volume, specialty complexity, staffing capacity, turnaround requirements, and how much control the practice needs over clinical decisions. For many growing practices, a hybrid model is the most practical answer: outsource routine administrative work, keep clinical decisions in-house.
Keeping prior authorization in-house usually works best when volume is low to moderate and predictable, staff already understand the payer mix, physicians and clinical staff are readily available for documentation and peer-to-peer discussions, authorization work is closely tied to patient scheduling, and the services require highly specialized clinical knowledge. The advantages are direct control, immediate communication with clinicians, greater visibility into pending cases, and easier coordination with scheduling. The risks are staff interruptions, training burden, dependence on individual employees, coverage gaps during leave or turnover, difficulty scaling during high-volume periods, and inconsistent follow-up without a dedicated process.
Outsourcing becomes worth considering when volume is high, variable, or growing faster than staffing, when staff spend a disproportionate share of their time on portals, phone calls, and faxes, when requests stay pending because follow-up fails, when denial management is inconsistent, when payer-specific documentation requirements are hard to maintain, or when administrative work is pulling staff away from patient-facing work. It can also help practices that need extended coverage or specialized payer or specialty expertise they do not have in-house. The advantages are scalable staffing, payer-specific expertise, extended hours, and performance reporting. The risks are less direct control, the need for strict data security and business associate oversight, and possible delays if the vendor cannot reach the ordering clinician for a peer-to-peer discussion.
Separate administrative work from clinical decision-making, whichever model is chosen. Good candidates for outsourcing are eligibility and benefit checks, authorization requirement verification, portal and fax submissions, document collection, submission confirmations, status follow-ups, expiration monitoring, and routine reporting. Clinical control should stay with the practice for determining medical necessity, clinical documentation, treatment decisions, peer-to-peer discussions, clinical appeal arguments, decisions about alternative treatments, and urgent patient care escalation. A practice can outsource administrative execution without surrendering clinical oversight.
Before signing a vendor, define the metrics up front: turnaround time, approval rate, denial rate, and appeal success rate. Require HIPAA compliance and a signed Business Associate Agreement. Clarify in writing who handles peer-to-peer discussions, appeals, and patient communication, and who is responsible for errors and missed deadlines. Ask about data access restrictions, audit rights, incident notification, subcontractor controls, and data return and destruction at the end of the contract. Pilot with one payer or specialty before a full rollout, and track order to submission time, submission to decision time, approval rate, denial rate, appeal success rate, and staff hours saved during the pilot.
To judge the financial case honestly, calculate the practice’s own cost per completed authorization: total prior authorization labor and operating costs, including salaries, benefits, payroll taxes, training, software, management overhead, overtime, and rework from incomplete submissions, divided by completed authorizations. Compare that figure with total vendor cost, meaning vendor fees plus internal oversight costs. Watch the quote carefully for setup fees, minimum monthly volumes, per-submission versus per-completed-authorization pricing, resubmission fees, denial management charges, peer-to-peer coordination fees, after-hours charges, electronic health record integration costs, and contract termination fees. No outside dollar benchmark is used here, because no source in this research gave a usable, verified industry cost figure, and a vendor quote that looks cheap per submission can become expensive once resubmissions and denial work are added.
What the Denial and Appeal Numbers Actually Show
Denial statistics are quoted loosely in a lot of practice content, and the loose quoting is the problem. A denial rate, an appeal rate, and an appeal overturn rate measure three different things. A 12 percent denial rate means 12 percent of submitted requests were denied. An 11.5 percent appeal rate means 11.5 percent of denied requests were appealed. An 80 percent overturn rate means 80 percent of appealed denials were reversed, not 80 percent of all denials. Always check the year, the plan type, the denominator, and whether a figure covers initial denials, appealed denials, or overturned appeals. Never convert an appeal overturn rate into an overall improper denial rate, and never blend survey percentages, claims figures, and study estimates into a single denial rate.
With that discipline, here are the figures that held up across sources, each with its scope.
| Source and scope | What it found |
|---|---|
| KFF, Medicare Advantage, 2024 | About 52.8 million determinations. About 4.1 million fully or partially denied, a 7.7 percent denial rate. Of denied requests, 11.5 percent were appealed. Of appealed denials, 80.7 percent were fully or partially overturned. |
| HHS OIG, Medicare Advantage post-acute care, June 2024, 19 plans | Skilled nursing facility: 12 percent of admission requests denied, 18 percent of denials appealed, 95 percent of appealed denials approved. Long-term care hospital: 65 percent denied, 36 percent appealed, 36 percent of appealed denials approved. Inpatient rehabilitation facility: 54 percent denied, 31 percent appealed, 43 percent of appealed denials approved. |
| HHS OIG, Medicare Advantage, 2022 study sample | 13 percent of sampled denied prior authorization requests met Medicare coverage rules and likely would have been approved under traditional Medicare. This is a study sample finding, not a rate for all Medicare Advantage denials in any later year. |
| HHS OIG, Medicaid managed care, 2019 | About one in eight prior authorization requests denied across the managed care organizations studied. This is a 2019 Medicaid managed care figure, not a 2026 rate. |
Two lessons follow from this table. First, most Medicare Advantage denials in 2024 were never appealed, even though appeals succeeded at a high rate when they were filed. That gap is an operational opportunity: a denial that is never reviewed cannot be overturned. Second, post-acute care shows how much the service type matters. Skilled nursing facility denials were far less common than long-term care hospital or inpatient rehabilitation denials, yet appealed skilled nursing denials were approved at a much higher rate. A practice should therefore track its own denial and appeal rates by payer and by service type, rather than comparing itself to a single national denial rate that does not exist.
No American Medical Association survey percentages are used in this article. Two research sources reported different AMA figures for delays, outcomes, abandonment, and weekly hours, so those percentages are held out until they can be verified directly against the AMA survey. They are physician-reported survey results in any case, not measured claims denial rates, and they should never be presented as one.
Frequently Asked Questions
How long does a standard prior authorization take in 2026?
For impacted payers under CMS-0057-F, a standard medical request must be decided within 7 calendar days and an expedited request within 72 hours, from Jan 1, 2026. The clock starts when the payer receives the request and runs in calendar time. Those deadlines do not apply to every plan, so check the plan type and state rules for the request in front of you.
Does the 7 day rule apply to every health plan?
No. It applies to the impacted payers named in CMS-0057-F: Medicare Advantage, Medicaid managed care and fee-for-service, and CHIP managed care and fee-for-service. It does not apply to prescription drugs, it does not apply to traditional Medicare fee-for-service or commercial employer plans in the same way, and it did not change the decision timelines for Qualified Health Plans on federally facilitated exchanges. State law may set separate deadlines.
What should a practice do first when a prior authorization is denied?
Read the full written denial and identify the exact reason before doing anything else. If the problem is administrative, such as a wrong code or member ID, fix it at the source. If the problem is clinical, gather the documentation that answers that specific reason, check whether a peer-to-peer review is available, and note the appeal deadline the same day. Do not resubmit the same request unchanged.
How long does a practice have to request a peer-to-peer?
There is no single national peer-to-peer deadline. The window is payer-specific, and research sources cite different common ranges, so no single number should be relied on. Capture the deadline from the denial notice immediately, track peer-to-peer requests separately from appeals, and never assume a peer-to-peer extends the formal appeal deadline unless the payer confirms it in writing.
What happens if an authorization expires before the service?
Care delivered after an authorization expires, or after its approved visits or units run out, usually counts as no authorization, and the patient generally cannot be billed for it under the contract. Prevent this with a central tracker, alerts before expiration, a units-remaining alert, and a daily review of approved but unscheduled cases. If a service cannot be delivered inside the window, seek a new authorization or an extension before delivery, not after.
When does outsourcing prior authorization make sense?
Outsourcing makes sense when volume outgrows staffing, follow-up and denial management become inconsistent, or payer-specific expertise is missing in-house. It makes less sense when volume is low and predictable, clinical complexity is high, and physicians need to stay close to documentation and peer-to-peer decisions. In most growing practices the workable answer is hybrid: outsource intake, submission, follow-up, and tracking, and keep clinical decisions, peer-to-peer discussions, and appeal strategy in-house. Pilot with one payer or specialty and judge the vendor on turnaround, approval, denial, and appeal success rates, plus staff hours saved.
Verified Nov 2026. Timelines and statistics in this guide are stated with their plan type, year, and denominator. Payer policies and state laws change, so verify the current policy for each payer and plan before relying on a general timeline.
