Prior Authorization: What Patients Need to Know

Prior authorization (PA) is a utilization management requirement used by health insurers and pharmacy benefit managers that conditions coverage approval on advance review of a proposed treatment, medication, or procedure. This page covers the definition and regulatory scope of prior authorization, the step-by-step mechanics of how requests move through the review process, the clinical and administrative scenarios where PA requirements most commonly arise, and the boundaries that govern insurer decision-making. Understanding this process is relevant to patients navigating delayed care, denied claims, and health insurance appeals.

Definition and scope

Prior authorization is a formal administrative process through which a health plan requires a treating provider to obtain explicit approval before furnishing a specific covered service or dispensing a specific drug. Without that approval, the insurer may deny payment even if the service is otherwise covered under the plan.

The regulatory framework governing PA varies by payer type. For commercial health plans sold on the Affordable Care Act marketplaces, the Centers for Medicare & Medicaid Services (CMS) sets baseline standards under 45 CFR Part 156. For Medicare Advantage plans specifically, CMS issued a final rule in 2024 — codified at 42 CFR Part 422 — establishing maximum PA decision timeframes: 72 hours for urgent requests and 7 calendar days for standard requests (CMS Final Rule CMS-4201-F). For Medicaid managed care, parallel requirements appear at 42 CFR Part 438.

The No Surprises Act and related federal rules introduced additional transparency obligations, including requirements that plans disclose PA criteria publicly. The Affordable Care Act patient protections framework further prohibits plans from imposing PA requirements that function as arbitrary coverage barriers for essential health benefits.

PA applies to four broad service categories:

  1. Prescription drugs — particularly specialty drugs, brand-name medications with generic equivalents, and controlled substances
  2. Diagnostic imaging — MRI, CT, and PET scans are among the most frequently PA-gated procedures
  3. Elective surgical procedures — joint replacement, bariatric surgery, and spinal procedures commonly require PA
  4. Behavioral health and substance use disorder treatment — inpatient admissions and certain outpatient modalities

How it works

The PA process follows a defined sequence with discrete decision points. The following numbered breakdown reflects the standard workflow described by the American Medical Association (AMA) in its published prior authorization reform principles.

  1. Provider initiates the request. The treating clinician submits a PA request to the insurer — electronically through an EDI transaction set (ANSI X12 278) or via insurer-specific portal.
  2. Insurer assigns review type. The plan categorizes the request as urgent or standard based on clinical urgency criteria. Urgent (expedited) reviews carry shorter statutory timeframes.
  3. Clinical reviewer evaluates the request. Initial review may be performed by a nurse reviewer. If the request does not meet criteria for approval at that level, it is escalated to a physician reviewer in the same or comparable clinical specialty.
  4. Determination is issued. The insurer issues an approval, denial, or request for additional clinical documentation. Partial approvals — covering a lesser quantity or duration — are also permitted.
  5. Notification is sent. The plan must notify both the provider and the enrollee of the determination. For denials, the notification must include the specific clinical rationale and the enrollee's right to appeal.
  6. Appeals pathway activates on denial. A denied PA triggers the plan's internal appeal mechanism, followed by external independent review if the internal appeal is exhausted. The health insurance appeals process governs those rights in detail.

A critical operational distinction exists between concurrent review (PA requested while care is actively being delivered, such as during an inpatient hospitalization) and prospective review (PA sought before care begins). Concurrent denials carry immediate consequences for ongoing care continuity and are treated differently under many state continuation-of-care statutes.

Common scenarios

PA requirements concentrate in clinical situations where insurers have identified cost variation or utilization patterns that their clinical criteria flag for review. Patients navigating chronic disease management and those in rare disease treatment pathways encounter PA barriers at disproportionately high rates.

Step therapy ("fail-first") requirements represent one of the most consequential PA variants. Under step therapy protocols, a plan requires documented failure of a lower-cost or lower-tier drug before approving the medication a prescriber has selected. As of 2023, at least 28 states had enacted step therapy override statutes requiring plans to grant exceptions under defined clinical circumstances, according to the National Alliance on Mental Illness (NAMI).

Gold carding is a contrasting framework in which physicians who have demonstrated high PA approval rates over a defined period are exempted from PA requirements for specified service types. Texas enacted a gold-carding law (Texas Insurance Code §4201.655) in 2021; Arkansas followed with a comparable statute. These exemptions do not apply universally and are plan- and specialty-specific.

In oncology and cancer patient advocacy contexts, delays from PA requirements have been documented as a clinical safety concern. The American Society of Clinical Oncology (ASCO) has formally documented cases where PA processing delays exceeded recommended treatment initiation windows.

Decision boundaries

Insurers do not have unconstrained discretion in PA decisions. Federal and state law establish outer boundaries that govern what criteria can be applied and how denials must be substantiated.

Medically necessary standard. Plans must apply a medically necessary standard that is consistent with generally accepted standards of medical practice. Under 42 CFR §422.101(b), Medicare Advantage plans cannot use PA to deny coverage for services that would be covered under traditional Medicare. CMS's 2024 rule further prohibits MA plans from applying internal criteria that are more restrictive than Medicare coverage policy.

Mental health parity. The Mental Health Parity and Addiction Equity Act (MHPAEA), enforced jointly by the U.S. Department of Labor (DOL), the U.S. Department of Health and Human Services (HHS), and the U.S. Department of the Treasury, prohibits applying PA requirements to mental health and substance use disorder benefits that are more stringent than those applied to analogous medical/surgical benefits. This parity requirement extends to the frequency, duration, and scope of PA.

Timeliness mandates. Beyond the CMS timeframes for Medicare Advantage, state insurance codes independently set PA response windows for state-regulated commercial plans. Failure to meet these windows can constitute a deemed approval in states that have enacted such provisions.

Right to external review. Under the ACA's external review provisions (45 CFR §147.136), enrollees in non-grandfathered plans have the right to independent external review of adverse benefit determinations, including PA denials. External reviewers are accredited by organizations such as URAC and are required to apply independent clinical judgment, not the insurer's proprietary criteria.

Patients and providers contesting a PA denial should consult the prior authorization guidance for patients resource for process-specific information, and review patient rights and responsibilities for the broader legal framework governing coverage disputes.

References

📜 4 regulatory citations referenced  ·  🔍 Monitored by ANA Regulatory Watch  ·  View update log

Explore This Site

Regulations & Safety Regulatory References Tools & Calculators Bmi Health Metrics Calculator