What is prior authorization? A clinic guide

Prior authorization, which plans also call preauthorization or precertification, is a health plan’s requirement that a clinic get approval before delivering a specific service, procedure or drug. The plan reviews the request against its own coverage criteria. If the approval is missing, the plan may deny payment for the service, so check before the visit, not after.

What is prior authorization, and who requires it?

The AMA describes it as a health plan cost-control process that requires physicians and other health care professionals to get advance approval from a health plan before a specific service is delivered, so the service qualifies for payment coverage. The payer decides, and each plan sets its own rules.

• Commercial plans keep their own lists of services that need approval, and the lists change. One national payer’s commercial list (January 2025 edition) says it changes periodically and that specific state rules may apply. It also notes that site of service can be part of the review for some codes.
• Medicare Advantage plans may require it. Medicare.gov says that in most cases Original Medicare does not require approval, while a Medicare Advantage plan may. Original Medicare does use it for a limited set of items and services, which CMS lists on its prior authorization initiatives page.
• Medicaid and CHIP programs and plans have their own requirements, and states differ.

What gets reviewed varies, but it is usually specific procedures, imaging, equipment and drugs. The same service can need approval under one plan and not another, so the answer is always plan-specific.

What is the prior authorization process, step by step?

This is the process from the clinic’s side. The AMA’s tips to minimize delays follow the same arc: check requirements first, document consistently, pick the most efficient channel, follow up, and appeal in an organized way.

1. Check whether it is required. Look up the service under the patient’s specific plan, using the payer’s portal or published list. Do this when the service is scheduled, using the plan you confirmed in your insurance verification process.
2. Gather the clinical documentation. Typically the order, the relevant visit notes, test or imaging results, prior treatments tried, and the diagnosis and procedure codes. The AMA argues that plans should clearly tell clinicians what supporting documentation each request needs, which suggests it is not always clear. Ask the plan, and keep a checklist per service.
3. Submit through the channel the plan accepts. That may be a payer portal, an electronic transaction, fax or phone. CMS lists the X12 278 as the HIPAA standard for referral certification and authorization, though a given plan may steer you to its own portal. Save the confirmation or reference number.
4. Track the request. Record the date submitted and a follow-up date. If the plan asks for more information, answer quickly and note the date.
5. Record the decision. For an approval, note the authorization number, approved service, dates and units. CMS says the new Prior Authorization API must communicate an approval together with the date or circumstance under which the authorization ends, so check yours for an end date and schedule inside it.
6. Appeal if the denial is wrong. Read the denial notice for the reason and the appeal deadline. The AMA advises an organized, concise appeal with supporting clinical information, including any data missing from the first request.

Some plans also require a referral for a specialist or service. See referral management for clinics for that side.

Why do prior authorization requests get delayed or denied?

These are common causes, not statistics. Your payer’s denial reasons are the real guide.

• Nobody checked. The visit was booked first and the requirement found later.
• Wrong or outdated coverage. The request went to a plan the patient no longer has.
• Missing or mismatched documentation. The note does not show what that plan’s criteria ask for.
• Details differ from what was approved. A different service, provider or date than the approval covers.
• The request sat. It was submitted and nobody followed up. The AMA’s advice is to follow up regularly, because a request can be lost at one of many steps.
• The plan’s criteria were not met. Appeal only when the record supports it.

What changed in the federal rules?

CMS finalized the Interoperability and Prior Authorization rule, CMS-0057-F, and it was published in the Federal Register on February 8, 2024. It does not cover every plan. CMS’s fact sheet names the “impacted payers”: Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan issuers on the federally facilitated exchanges. Original Medicare and employer-sponsored group plans are not on that list.

• Decision timeframes. Impacted payers, excluding the exchange issuers, must send decisions within 72 hours for expedited (urgent) requests and seven calendar days for standard requests. CMS gives a compliance date starting January 1, 2026, and for some programs the start follows the plan year or rating period. The regulations count from when the plan receives the request. They still allow extensions of up to 14 days in some situations, such as when more information is needed, so do not assume a hard seven days.
• Denial reasons. Impacted payers must give a specific reason for a denied request, regardless of how the request was sent. That makes a denial easier to fix or appeal.
• Public reporting. Payers post certain prior authorization metrics on their websites each year, and CMS set March 31, 2026 for the first set.
• APIs in 2027. Payers must build a Prior Authorization API, with CMS saying primarily by January 1, 2027. It is meant to let software see whether approval is needed, what documentation is required, and the status: approved, denied with a reason, or more information needed. The rule does not require clinics to use it, and whether you can depends on your software and each payer’s rollout.
• Drugs. The 2024 rule covers items and services, not drugs. CMS proposed an extension in April 2026 (CMS-0062-P), with a proposed compliance date of October 1, 2027. As of this writing the Federal Register lists it only as a proposed rule, not a final one, so confirm its status on cms.gov before relying on it.

Payer type	72-hour and 7-day decisions	Specific denial reason	Prior Authorization API
Medicare Advantage	Yes	Yes	Yes, primarily by Jan 1, 2027
Medicaid and CHIP (fee-for-service and managed care)	Yes	Yes	Yes, primarily by Jan 1, 2027
Marketplace issuers on the federal exchanges	No, excluded from this rule (other rules may set their own times)	Yes	Yes, primarily by Jan 1, 2027
Original Medicare, employer-sponsored plans	Not in this rule	Not in this rule	Not in this rule

States add their own rules. The AMA keeps a state law chart, and your payer contract may say more. Treat this section as a summary and confirm what applies to each plan.

What is a short prior authorization checklist for a clinic?

1. Keep a list, by payer and plan, of the services that need approval, with the portal or channel for each.
2. Verify coverage first, then check the requirement before the date is set.
3. Use a documentation checklist per service so requests go out complete.
4. Log the submission date, channel and reference number, plus a follow-up date.
5. Record the decision: authorization number, dates, units and any conditions.
6. Save every denial reason and the appeal deadline.
7. Recheck the approval a few days before the visit.
8. Review denials monthly for patterns, such as one payer or one service.

Frequently asked questions

What is prior authorization in simple terms?

It is the plan’s yes before the service, not after. The clinic asks the plan to approve a specific service, the plan reviews it against its criteria, and the answer comes back as approved, denied or more information needed.

Does prior authorization guarantee payment?

Not always. An approval usually has conditions such as dates, units and the approved service, and coverage still has to be active. Read the approval for its limits and ask the payer if anything is unclear.

How long does prior authorization take?

It depends on the plan. For the payers in the federal rule above, decisions are due in 72 hours when urgent and seven calendar days when standard, with exceptions, and the exchange issuers are excluded. Other plans and state laws set their own times.

Who is responsible for requesting it, the clinic or the patient?

It depends on the plan and your participation agreement. In many cases the ordering clinic submits the request, but check your contract and the plan’s manual instead of assuming.

Where Clinicrung fits

Clinicrung is being built as an AI back office for independent clinics and medical groups. For prior authorization, it would work through the repetitive parts: checking whether a payer lists a requirement, assembling the documents your staff chooses, tracking open requests and flagging the ones that stall. Your staff approve what is sent and handle exceptions and appeals. It is not a medical product and does not diagnose or decide what care a patient needs. Ask any tool, including ours, exactly how it handles patient information. Join the pilot to help shape it.

This guide is general information, not medical, legal or billing advice. Payer rules, federal rules and state laws change and differ by plan, so check with the payer and your compliance advisor.