Prior Authorization in Medical Billing: Process and 2026 Rules

By Awais Afzal, Healthcare Operations & Data Analyst · Published February 23, 2026 · Updated October 14, 2026

Prior authorization in medical billing is a payer's approval, requested before a service, that a practice needs on file or the claim may be denied. The work is checking the payer's rule, sending clinical documentation, tracking the decision and matching the authorization number to the claim. From 2026, covered payers owe decisions in 72 hours or 7 days.

This guide is for practice owners and billing managers. It covers the process, the numbers worth citing, which rules apply to which patients, and how to run the work without losing requests. We rebuilt it from an earlier version, removing figures that had no named source.

What is prior authorization in medical billing?

Prior authorization is a payer’s advance approval for a specific service, drug or device. Without it, the payer may deny the claim even when the care was appropriate and the patient was covered. The approval is tied to the patient, the service, the provider and usually a date range, so a claim that does not match it can still be denied.

It sits at the front of the revenue cycle. The work happens before the visit, but the money is only decided after the claim goes out. That gap is why prior authorization belongs to billing as much as to clinical staff. If the approval is missing or does not match the claim, the billing team inherits the denial.

There are three things a practice needs to know for every payer: which services need approval, what the payer wants to see in the request, and how long a decision is supposed to take. Those answers differ by payer, by plan and by service, so a single office-wide rule does not work. The sections below cover the workflow first, then the 2026 rules that are changing the timelines for some payers.

How does the prior authorization process work, step by step?

The process has six steps, and most delays come from the first three. A request that starts with the wrong payer rule or thin documentation will be slow no matter how fast the staff submit it.

1. Confirm the plan and the rule. Verify active coverage and the plan type, then check the payer’s current list of services that need approval. Lists change, so use the payer portal or a call, not last year’s cheat sheet.
2. Decide whether this order needs approval. Match the exact service, code, site of service and diagnosis against the payer’s rule. Record where you found the answer and the date.
3. Assemble the clinical documentation. Collect the notes, test results, failed conservative treatments and the provider’s reason for the order. Payers decide on what is in the request, not on what the chart could have shown.
4. Submit through the payer's required channel. Use the portal, electronic transaction or fax the payer specifies. Keep the confirmation or reference number.
5. Track the request to a decision. Give each open request an owner and a follow-up date. An unanswered request is a scheduled procedure at risk.
6. Record the result on the account. Save the authorization number, approved service, dates and units where billing can see them, then confirm the claim matches. If the decision is a denial, route it to appeal.

Eligibility comes first because an approval for a patient whose coverage has lapsed is worthless. For a deeper look at that step, see our guide to patient insurance verification and our piece on automating eligibility verification.

Why does prior authorization cost practices so much time?

Physicians report it is a heavy, constant workload. In the American Medical Association’s 2025 Prior Authorization Physician Survey, released May 13, 2026, 1,000 practicing physicians reported an average of 13 hours of physician and staff time a week spent on prior authorization, and 95% said it delays access to necessary care (AMA, 2026).

The same survey reports that 79% of physicians said patients abandon treatment because of authorization problems, and 26% reported a serious adverse event such as hospitalization, permanent impairment or death linked to it. These are physician-reported survey figures, not claims data.

For a practice manager, the practical cost is staff time and schedule disruption. Every hour spent on hold or re-faxing records is an hour not spent on collections, scheduling or patient calls.

How often are prior authorization requests denied?

It depends on the payer and the program, and reliable public numbers are limited. The best federal-data analysis available covers Medicare Advantage. KFF found that in 2024 these plans made nearly 53 million prior authorization determinations, denied 7.7% of them, and that only 11.5% of denied requests were appealed. Of those appeals, 80.7% were fully or partially overturned (KFF, 2024 data).

Read that carefully. It does not mean 80.7% of all denials are wrong. It means that among the small share of denials that practices and patients appealed, most were reversed in full or part. Appealing is worth the effort when your documentation supports the request.

Physicians describe a harsher picture. In the AMA survey, 32% said their requests are often or always denied, and 74% said denials have increased over the past five years (AMA, 2026). Those figures reflect experience across payers and are not the same measure as KFF’s Medicare Advantage rate.

The old version of this post also quoted several percentages for denial causes and the effect of EHRs on turnaround without naming a source. We removed them. If you see a statistic about why requests are denied that does not name a publisher and a year, do not repeat it. Your own denial log, grouped by payer and reason, is more useful than any national average. Our denial management guide explains how to build it, and our denial management services page describes how we support appeals.

Which 2026 rules change prior authorization timelines?

The main federal change is the CMS Interoperability and Prior Authorization final rule (CMS-0057-F). From 2026, covered payers must answer urgent requests within 72 hours and standard requests within 7 calendar days, and must give a specific reason when they deny one (CMS fact sheet, 2024). It applies to some payers, not all, so check which one your patient has.

Source: CMS, CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) fact sheet (2024)

The next table shows who the CMS rule reaches, and who it does not. This is where many practices get confused, because the 72-hour and 7-day clocks do not apply to every patient in the waiting room.

Source: CMS fact sheet on CMS-0057-F (2024); Congressional Research Service overview of WISeR (2026)

Traditional Medicare has its own change. The Wasteful and Inappropriate Service Reduction (WISeR) model started January 1, 2026 and runs through December 31, 2031 in Arizona, New Jersey, Oklahoma, Ohio, Texas and Washington. CMS contractors review selected services, and providers and beneficiaries cannot opt out (Congressional Research Service). The service list includes steroid injections for pain, nerve stimulation and destruction of nerve tissue, among others, and CMS may change it.

That list matters to pain practices in those states, since several of the services are pain procedures. If this is your specialty, our pain management billing page covers the specialty’s workflow. Check the current service list and your Medicare Administrative Contractor’s guidance before you schedule.

What requires prior authorization, and what does not?

There is no universal list. Each payer publishes its own, and it can change during the year. Categories that commonly appear on payer lists include advanced imaging, certain outpatient procedures, durable medical equipment and specialty drugs, but the exact services, codes and thresholds depend on the plan. Treat any generic list, including ours, as a prompt to check the payer’s current rule.

Emergency care is one clear exception. Group health plans and issuers of group or individual coverage must cover emergency services in an emergency department without any prior authorization determination (42 U.S.C. 300gg-111). Follow-up care after stabilization is different, so check the plan’s rule for post-emergency services.

Medication approvals follow a separate path, with their own forms and step-therapy rules. We cover that workflow in our guide to expediting medication prior authorization.

How should a practice organize prior authorization work?

Pick one owner per request, one place to see status, and one rule for follow-up. The staffing model matters less than whether those three things exist. The table compares the common options.

Whichever model you choose, protect three habits. Check coverage before you start the request, write down who submitted what and when, and compare the final authorization to the claim before it is billed. Our guide to clean claims explains why that last check prevents rework, and our front desk and revenue cycle article shows how front-end errors reach billing.

If prior authorization is backing up, our prior authorization services are one way to add capacity. Our team works with the EHR you already use and your own payer logins. Our practice management system that tracks claims by stage can give each claim an owner, hold or flag it for review, and keep an audit log, so a claim waiting on an approval does not get lost.

What should you do when a prior authorization is denied?

Read the denial reason, compare it with what you submitted, and decide whether to resubmit, request a peer-to-peer review or appeal. Start from the reason, because under the CMS rule a covered payer must now state one.

1. Log the denial with the payer, service, reason and date, so patterns show up.
2. Check for a simple fix: missing record, wrong code or wrong site of service. Those can often be corrected and resubmitted.
3. If the reason is medical necessity, ask the provider for a letter and any supporting studies or guidelines, and consider asking for a peer-to-peer conversation if the payer offers one.
4. File the appeal inside the payer’s deadline and keep proof of the filing date.
5. Tell the patient and the scheduler early, so a procedure is not booked on an unapproved request.

Do not let denied requests sit. KFF’s data shows that appeals that are filed often succeed, yet most Medicare Advantage denials are never appealed (KFF, 2024 data).

Our recommendations

1. Keep a payer rule sheet with dates. For your top ten payers, record which services need approval, the submission channel and the date you last confirmed it. Review it every quarter.
2. Check coverage before every request. An approval for a patient whose coverage has lapsed is worth nothing. Verify first, then start.
3. Give every request an owner and a follow-up date. An open request without a name next to it is the one that fails. Review the open list daily.
4. Track the deadlines that apply to each patient. Know which patients fall under the 72-hour and 7-day limits and which do not, and escalate when a covered payer misses them.
5. Match the claim to the approval before billing. Compare the authorization number, service, dates and units on the claim. Mismatches are cheap to fix before submission and expensive after.
6. Appeal more than you think you should. With so few denials appealed, a consistent appeal habit is one of the cheaper ways to recover revenue. Start with the denials where your documentation was strong.

Bottom line

Prior authorization will not disappear in 2026, but the rules are getting clearer for some payers, and the practices that benefit are the ones that track every request. If requests are stalling, virtual medical assistants for medical practices can take on submission and follow-up in your EHR and payer portals. Use our revenue calculator to estimate what delays cost, or start with a free audit.

Frequently asked questions

What is prior authorization in medical billing?

It is a payer’s advance approval for a service, drug or device. The practice requests it before delivering the service, then records the authorization number and matches it to the claim. If the approval is missing, expired or does not match the service, the payer can deny the claim, even if the patient was covered.

Who is responsible for getting prior authorization, the provider or the patient?

In most cases the ordering provider’s office requests it, because the payer needs clinical documentation. Contracts and plan rules vary, so check your payer agreement. Even when the office submits the request, tell the patient what was requested and what to expect, since a denial affects their schedule and costs.

How long does prior authorization take?

It depends on the payer. Under the CMS rule, covered payers must decide urgent requests within 72 hours and standard requests within 7 calendar days, generally from 2026. Other payers set their own turnaround, so ask each one for its published timeframe and track requests against it rather than assuming.

Does the CMS prior authorization rule apply to every insurer?

No. CMS-0057-F covers Medicare Advantage organizations, state Medicaid and CHIP programs, Medicaid and CHIP managed care, and qualified health plan issuers on the federal exchanges. Commercial employer plans and traditional Medicare are not on that list, though traditional Medicare has a separate WISeR test in six states.

Do emergency services need prior authorization?

Generally no. Federal law requires group health plans and group or individual issuers to cover emergency department services without a prior authorization determination. Care after the patient is stabilized can be treated differently, so check the plan’s rule for post-emergency services before scheduling follow-up.

What happens if a prior authorization request is denied?

Read the denial reason, then decide whether to fix and resubmit, ask for a peer-to-peer review or file an appeal within the payer’s deadline. Log every denial by payer and reason so you can see patterns. Many denials are missing information that the practice can supply.

Sources

1. CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) fact sheet — CMS (2024)
2. AMA survey: Prior authorization reform pledge falls short with physicians — American Medical Association (2026)
3. Medicare Advantage Insurers Made Nearly 53 Million Prior Authorization Determinations in 2024 — KFF (2024 data)
4. Overview of the Medicare Wasteful and Inappropriate Service Reduction (WISeR) Model — Congressional Research Service (2026)
5. 42 U.S.C. 300gg-111 — Cornell Legal Information Institute (U.S. Code) (current)