Prior Authorization: How the Approval Process Works for Patients

Prior authorization is a cost and utilization management requirement used by health insurers and pharmacy benefit managers that compels providers to obtain advance approval before delivering specific services, procedures, or medications. The requirement applies across commercial plans, Medicaid managed care, and Medicare Advantage, affecting tens of millions of coverage decisions each year. Understanding how the process is structured, where decisions are made, and what rules govern appeals is essential for patients navigating complex care episodes.

Definition and scope

Prior authorization (PA)—also called pre-authorization, pre-certification, or prior approval depending on the plan—is a formal insurer review mechanism that conditions coverage on prospective clinical justification. The Centers for Medicare & Medicaid Services (CMS) defines it within the context of utilization management as a process by which a health plan determines whether a requested service meets its medical necessity criteria before the service is rendered (CMS Prior Authorization and Pre-Claim Review).

The requirement applies to four broad categories of services:

1. Prescription drugs — particularly specialty biologics, brand-name medications with generic equivalents, and controlled substances
2. Inpatient hospital admissions — elective procedures and planned surgeries
3. High-cost outpatient procedures — advanced imaging (MRI, CT, PET), radiation therapy, and surgical interventions
4. Post-acute and durable equipment — home health, skilled nursing facility placement, and durable medical equipment coverage

PA does not apply universally. Preventive care services mandated under the Affordable Care Act, emergency services covered under federal Emergency Medical Treatment and Labor Act (EMTALA) protections, and routine primary care visits are typically exempt from pre-approval requirements. For a structured overview of which plan types impose PA obligations most broadly, see the health insurance coverage types reference.

How it works

The prior authorization workflow follows a defined sequence involving the treating provider, the insurer's medical review staff, and—where applicable—external clinical reviewers.

Step 1 — Identification of the requirement. The provider's billing or clinical staff checks the insurer's online portal or coverage policy documents to determine whether the proposed service requires PA. This check typically occurs at the point of ordering.

Step 2 — Submission of the request. The ordering provider submits clinical documentation to the health plan. Standard submission materials include the diagnosis code (ICD-10), the procedure or drug code (CPT or NDC), supporting clinical notes, and a statement of medical necessity. CMS issued rules under the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F, published January 2024) requiring most payers to implement application programming interfaces (APIs) that streamline electronic PA submission (CMS-0057-F Final Rule).

Step 3 — Plan review. A clinical reviewer—often a nurse or pharmacist at the first level—applies the plan's medical necessity criteria, which may be derived from proprietary guidelines or published criteria such as those from MCG Health or InterQual. If the first-level reviewer cannot approve the request, it escalates to a physician reviewer.

Step 4 — Decision issuance. The plan must issue a decision within federally or state-mandated timeframes. For Medicare Advantage, CMS requires standard decisions within 14 calendar days and expedited decisions within 72 hours when the standard timeframe could seriously jeopardize the patient's health (42 CFR § 422.568).

Step 5 — Approval, denial, or modification. An approval confirms coverage subject to plan terms. A denial must include the specific clinical rationale and instructions for appeal. A modification may approve a lower-cost alternative.

The explanation of benefits eob guide explains how approved and denied PA decisions appear on post-service benefit statements.

Common scenarios

Three scenarios account for the majority of PA activity across insurance markets:

Specialty drug authorization. A physician prescribing a biologic for rheumatoid arthritis or a GLP-1 receptor agonist for obesity must document that the patient meets diagnosis criteria and, in many cases, that a step therapy protocol has been followed—meaning a lower-cost drug was tried first. Step therapy requirements are governed at the state level by statutes in more than 30 states and at the federal level for Medicare Advantage under CMS guidance (CMS Step Therapy for Part B Drugs).

Inpatient surgical procedures. Elective orthopedic surgery—total knee replacement, for example—commonly requires PA from commercial and Medicare Advantage plans. The provider must submit operative planning notes, imaging results, and documentation of failed conservative treatment. Failure to obtain PA before an elective inpatient admission can result in full claim denial, shifting costs to the patient. This intersects with surprise medical billing protections when out-of-network providers are involved in an otherwise authorized stay.

Behavioral health services. Mental health residential treatment, intensive outpatient programs, and applied behavior analysis (ABA) therapy for autism spectrum disorder frequently trigger PA requirements. The Mental Health Parity and Addiction Equity Act (MHPAEA) constrains how insurers apply PA to behavioral health relative to comparable medical-surgical benefits. The behavioral health parity law reference covers parity standards in greater detail.

Decision boundaries

Not all PA denials are final. Federal and state law establish structured review rights that create distinct decision tiers:

Internal appeal. The patient or provider may request reconsideration by the plan. For Medicare Advantage, the first-level appeal must be decided within 60 days for standard requests or 72 hours for expedited cases (42 CFR § 422.578).

External independent review. If the internal appeal is denied, federal law under the Affordable Care Act (ACA) §2719, codified at 45 CFR § 147.136, requires non-grandfathered individual and group plans to offer external review by an Independent Review Organization (IRO) accredited by the Utilization Review Accreditation Commission (URAC) or a comparable body (45 CFR § 147.136).

State-level protections. Many states impose stricter timelines and mandatory IRO standards beyond federal floors. California, New York, and Texas each maintain independent external review statutes that predate ACA requirements and may provide broader appeal rights.

Peer-to-peer review. Outside the formal appeal chain, the treating physician may request a direct clinical conversation with the plan's medical director. This process is informal but can reverse denials before a formal appeal is filed. It carries no guaranteed timeline under federal regulation.

For information on navigating grievances when PA denials are unresolved, the healthcare complaint and grievance process page outlines formal complaint pathways. Patients seeking to understand what rights govern their interactions with insurers throughout this process can reference the patient rights and responsibilities resource.

References

• Centers for Medicare & Medicaid Services — Prior Authorization and Pre-Claim Review
• CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) Fact Sheet
• 42 CFR § 422.568 — Medicare Advantage Organization Determination Timeframes (eCFR)
• 42 CFR § 422.578 — Medicare Advantage Appeal Timeframes (eCFR)
• 45 CFR § 147.136 — Internal Claims and Appeals and External Review (eCFR)
• CMS Step Therapy for Part B Drugs — HPMS Memo, August 2018
• U.S. Department of Labor — Mental Health Parity and Addiction Equity Act (MHPAEA)
• Utilization Review Accreditation Commission (URAC)