The Prior Authorization Process, Explained

Prior authorization (also called precertification, preauthorization, or prior approval) is a payer's requirement that a provider obtain pre-service approval before delivering specific services. The payer reviews the planned service against its medical necessity criteria — typically Milliman Care Guidelines (MCG), InterQual, or proprietary medical policy — and either approves, denies, or requests additional documentation. An approved PA generates an authorization number that must be included on the resulting claim, usually in Loop 2300 REF*G1 of the 837P (or in Box 23 of the paper CMS-1500). Without an approved PA on file before the date of service, the claim is denied with CARC 197 (precertification/notification absent) and is generally not appealable to the patient under most contracts — the provider absorbs the loss.

The CMS Interoperability and Prior Authorization Final Rule, issued January 17, 2024, applies to Medicare Advantage organizations, Medicaid managed care plans, CHIP managed care plans, state Medicaid and CHIP fee-for-service programs, and Qualified Health Plan issuers on the federally-facilitated exchanges. The rule requires impacted payers, except QHP issuers on the federally-facilitated exchanges, to respond to expedited prior authorization requests within 72 hours and standard requests within 7 calendar days. All impacted payers must also provide a specific reason for any denial, build and maintain a FHIR-based Prior Authorization API, and publicly report PA metrics annually; none of this applies to drugs. Compliance dates are generally January 1, 2026 for the operational requirements (response times, denial reasons, public metrics) and January 1, 2027 for the FHIR API, and the exact dates vary by payer type. Notably, the rule does not apply to commercial group plans not on the federal exchanges — many large commercial payers remain governed only by state-level prompt-decision laws.

The X12 278 is the EDI transaction standard for prior authorization request and response, defined under HIPAA at 45 CFR 162.1302. The 278 Request carries patient identifiers, ordering provider NPI, rendering provider NPI, requested service (CPT/HCPCS), diagnosis codes, and supporting clinical information. The 278 Response returns approval, denial, or pended status with a certification number when approved. Despite being a HIPAA-mandated standard, real-world adoption is uneven — many payers still require fax submissions, web portal entry, or proprietary forms, and a significant share of PAs are still processed manually rather than through the 278. The CMS Final Rule requires impacted payers to offer a FHIR-based Prior Authorization API from January 1, 2027, and CMS's fact sheet says HHS will not enforce the HIPAA 278 standard against covered entities that implement an all-FHIR API instead; covered entities may also still offer a 278-only transaction.

PA requirements vary by payer but cluster around predictable service categories. Advanced imaging — CT, MRI, PET, nuclear medicine — is required by nearly all commercial payers and Medicare Advantage plans, typically via radiology benefits managers like eviCore, AIM Specialty Health, or HealthHelp. Elective surgical procedures including joint replacement, spinal fusion, bariatric surgery, bunionectomy, and most cosmetic procedures. High-cost specialty drugs (biologics, infusions, oncology drugs). Genetic testing, particularly multi-gene panels and pharmacogenomic testing. Behavioral health and mental health services above specific thresholds (60-minute psychotherapy CPT 90837 for some payers, intensive outpatient programs, partial hospitalization). Durable medical equipment over specific dollar thresholds. Certain physical therapy regimens beyond a specific number of visits. Medicare Fee-for-Service has historically required PA for fewer services than commercial payers but has been expanding the list — its hospital outpatient department program began with five services on July 1, 2020, added two spinal procedures on July 1, 2021 and added facet joint interventions on July 1, 2023.

Practices that clear PAs reliably operate the same workflow. At scheduling, the front-office staffer or scheduler runs a benefits check (270/271 or payer portal) that returns whether PA is required for the planned service. If PA is required, the request is submitted through the payer's preferred channel within 24 hours of scheduling — earlier is better because elective procedures should be scheduled with PA already in hand. Submitted PAs are tracked in a dashboard with the request date, expected response date, and current status. Pended PAs (payer requested more information) are worked daily until cleared. When the PA is approved, the authorization number is captured in the practice management system attached to the encounter. Every claim that requires a PA is checked against the captured authorization number before submission. Practices that miss any step in this chain — most commonly the capture step — produce a measurable CARC 197 denial pattern.

Five failure patterns produce most CARC 197 denials. First, the PA was never requested — usually because the scheduling team did not check whether the service required PA. Second, the PA was requested but not yet approved when the service was delivered, and the payer denied it on adjudication despite the pending status. Third, the PA was approved for a different CPT code than what was ultimately performed (frequently in surgery — the planned procedure differs from the documented procedure). Fourth, the PA expired before the service date — most PAs are valid for 60-90 days. Fifth, the PA number was not captured on the claim, even though it was approved. The fifth failure is the most preventable and the most common — the data exists, it just didn't flow to the 837. A claim scrubbing edit that flags PA-required CPT codes without an authorization number on the claim eliminates this failure entirely.

When a PA is denied, the provider has two recovery pathways. First, the formal appeal — submit additional documentation to the payer and request reconsideration. Appeals follow the payer's published timeline; for Medicare Advantage, the plan has 30 calendar days (extendable by up to 14 in some cases) to resolve a standard reconsideration of a denied service or item request or send the case file to the independent review entity (42 CFR 422.590). Second, peer-to-peer review — the ordering physician speaks directly with the payer's medical director to discuss medical necessity. Peer-to-peer is the usual route when a clinically complex denial turns on medical necessity. The reviewer is not always a true peer, though: in the AMA's 2025 physician survey (1,000 physicians), only 16% of physicians participating in peer-to-peer reviews reported that the health plan's “peer” often or always has the appropriate qualifications. The downside is the physician time cost, plus scheduling overhead.