Staff prior authorization by splitting it: providers keep clinical documentation and peer-to-peer calls, while trained administrative staff check requirements, submit, track and record approvals. That staff can be in-house, a virtual medical assistant or a fully outsourced team. Measure your volume first, then require a Business Associate Agreement, individual logins and your time zone.
Prior authorization is a daily queue in most practices, and it often lands on whoever has a free minute. This guide to prior authorization staffing covers what the work involves, how to measure it, how in-house staff, a virtual medical assistant (VMA) and full outsourcing compare, what CMS changed for 2026 and 2027, and what to require from a vendor. For the request process itself, see our prior authorization guide for healthcare providers.
Key takeaways
- Most prior authorization work is administrative; documentation, peer-to-peer calls and clinical appeals need a provider.
- Physicians averaged 40 requests and 13 hours of physician and staff time a week in the AMA’s 2025 survey.
- CMS-0057-F decision clocks (72 hours, 7 days) have covered Medicare Advantage, Medicaid and CHIP since 2026; APIs follow January 1, 2027.
- Require a signed BAA, individual role-limited logins and your practice’s time zone from any vendor.
What does prior authorization work actually involve?
Prior authorization is a chain of tasks, not one form. Most of it is administrative: checking whether a request is needed, assembling records, submitting, tracking and recording the approval. A clinician handles the documentation, peer-to-peer calls and the clinical case in an appeal.
The volume is large. In the AMA‘s 2025 survey of 1,000 practicing physicians (fielded in December 2025, published May 2026), physicians averaged 40 prior authorizations a week, taking 13 hours of physician and staff time. Forty percent of physicians employ staff who work only on prior authorization, and the phone was the most common way to complete requests for medical services.
Knowing whether a request is needed is work in itself. In the same 2025 survey, 62% of physicians said it is difficult to tell whether a medical service needs prior authorization, and 63% said the same for prescription drugs.
| Step | What it involves | Who can own it | Common failure |
|---|---|---|---|
| Check if required | Payer, plan, code and site of service checked | Administrative staff or a VMA | Requirement missed |
| Gather documentation | Notes, imaging and prior treatments pulled from the chart | Provider documents; staff assemble | Request for more information |
| Submit the request | Portal, phone, fax or electronic transaction | Administrative staff or a VMA | Wrong form, code or urgency flag |
| Track to a decision | Status checks, information requests, escalation before the visit | Administrative staff or a VMA | Visit date arrives first |
| Peer-to-peer review | Physician discusses the case with the plan’s reviewer | Provider only | Call missed or held too late |
| Record the approval | Authorization number, codes, units and dates entered | Administrative staff or a VMA | Approval does not match codes billed |
| Denials and appeals | Reason logged; appeal filed before the deadline | Staff file; provider supplies the clinical case | Deadline passes |
Workflow summary, not statistics. Volume and submission methods: AMA 2025 Prior Authorization Physician Survey (published 2026).
Medication requests add their own steps, covered in our guide to expediting prior authorization for medication. When a service was delivered before approval, see our retro authorization guide.
How do you measure your prior authorization workload?
Log every request for two weeks before you change staffing. Count requests, minutes and outcomes by payer and channel; that log shows how many hours need covering and which payers cause the most rework.
- Request: payer and plan, service or drug, ordering provider, visit date.
- Channel: portal (and which one), phone, fax or electronic.
- Time: minutes on the first submission and on each follow-up.
- Dates: ordered, submitted, information requested, decided.
- Outcome: approved, denied (with the stated reason), withdrawn, or still pending on the visit date.
Channel matters. The 2024 CAQH Index (calendar-year 2023 data) found providers and staff spent 24 minutes per authorization request by phone, fax or email and 16 minutes through a health plan portal. Its estimated provider labor cost per medical prior authorization was $12.88 manual, $8.93 by portal and $5.38 fully electronic.
Portals add load. In a March 31, 2026 MGMA Stat poll (252 responses), 61% of practices said staff access seven or more payer portals a week, with eligibility checks and prior authorizations named most often as drivers. If one person also verifies insurance, log those calls separately (see our insurance verification guide).
A quick sizing illustration, not a benchmark
A three-physician practice matching the AMA’s 2025 averages would handle about 120 requests and 39 hours of physician and staff time a week. Some of that is physician time you cannot hand off, so size staff from your own log.
Count appeals too. In the AMA’s 2025 survey, 32% of physicians said requests are often or always denied. Asked why they skip some appeals, 59% said past experience told them it would fail and 52% cited insufficient practice staff or time. See our denial management guide for the appeal side.
Then review weekly: days from order to submission, days to decision, the share decided before the visit, denials by stated reason, and appeals filed versus appeals due. To line these up with billing numbers, see our guide to revenue cycle KPIs.
See where your prior authorization hours go
Our free practice audit reviews your authorization workflow and denial reasons, and shows which tasks to keep in-house or hand off.
Get a Free Practice AuditIn-house staff, a virtual medical assistant or full outsourcing: which fits?
Choose by volume, payer mix and how much control you want. In-house suits steady volume; a virtual medical assistant adds trained capacity inside your own systems; full outsourcing hands a vendor the whole queue, including follow-up and reporting.
| Factor | In-house staff | Virtual medical assistant (VMA) | Fully outsourced service |
|---|---|---|---|
| Who does the work | Your employees, on site | A remote assistant in your EHR and payer portals | A vendor team, sometimes in its own system |
| Control over priorities | Highest; you set the queue | High; you set scope and hand-offs | Shared; set by contract |
| Coverage for absences | Gaps unless cross-trained | Vendor provides backup | Vendor covers the queue |
| Clinical input | Provider documents and takes peer-to-peer calls | Same; clinical tasks routed to the provider | Same; no vendor replaces the provider |
| Hours and time zone | Your office hours | Your practice’s hours and time zone | Vendor hours; confirm they match yours |
| HIPAA set-up | Workforce training and access policies | BAA, individual logins, role-limited access | BAA, subcontractor and audit terms |
| Cost structure | Salary, benefits, training, turnover | Service fee; ask what is included | Per-request, monthly or bundled fee |
| Usually fits | Stable volume, long-tenured coordinator | Overloaded front desk; practice keeps control | Practices wanting one vendor to own the queue |
Decision guide based on common operating models; no sourced statistics.
When in-house works
In-house works when volume is steady and one experienced coordinator knows your payers. The risk is concentration: when that person is out, requests stall, and front-desk staff covering between patients make the errors described in our article on how front desk staff affect the revenue cycle.
When a virtual medical assistant works
A VMA fits when the work is real but your front desk has no room for it. The assistant works your queue in your EHR, on your hours, and hands clinical pieces to your providers, as our virtual medical assistant services describe. A VMA is administrative, not a virtual nurse; see our guide to virtual nursing assistants for clinical remote roles.
When full outsourcing works
Full outsourcing fits practices that want one vendor accountable for the queue, follow-up and reporting. Ask whether the vendor works in your systems or its own, and how approvals reach your schedule and claims. Some practices pair it with end-to-end revenue cycle management so authorization and billing data come from one team.
“Prior authorization is a tracking job before it is a typing job. Whoever you hire, someone has to own every open request until the patient is seen.”
— Awais Afzal, Healthcare Operations & Data Analyst
Add prior authorization capacity without adding a desk
Our virtual medical assistants submit, track and follow up on prior authorizations inside your existing EHR, on your practice's time zone, and route clinical questions to your providers.
See Virtual Medical Assistant ServicesWhat does CMS-0057-F change for prior authorization staff?
Since 2026, Medicare Advantage, Medicaid and CHIP payers covered by the CMS Interoperability and Prior Authorization Final Rule must decide most non-drug requests within 72 hours (expedited) or 7 calendar days (standard) and give a specific reason for each denial. Prior authorization APIs follow on January 1, 2027.
The final rule (CMS-0057-F), published February 8, 2024, covers Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid and CHIP managed care, and Qualified Health Plan issuers on the Federally-Facilitated Exchanges. The CMS fact sheet (2024) excludes those exchange plans from the decision timeframes, and the final rule’s prior authorization policies do not apply to drugs. Employer-sponsored commercial plans and traditional Medicare are not on the list.
| Requirement | Applies to | Date | What it means for your staff |
|---|---|---|---|
| 72-hour (expedited) and 7-calendar-day (standard) decisions | MA, Medicaid and CHIP; not exchange plans or drugs | Generally January 1, 2026; managed care by rating period | Flag urgency correctly; chase late decisions |
| Specific reason for each denial | Impacted payers; non-drug items and services | Beginning in 2026 | Log reasons; fix the pattern |
| Public prior authorization metrics | All impacted payers, on their websites | First set by March 31, 2026, then annually | Compare payer numbers with your log |
| Prior Authorization API | Impacted payers | January 1, 2027 | Less portal re-keying where your EHR connects |
| MIPS electronic prior authorization measure | MIPS eligible clinicians | Finalized for 2027; July 2026 proposal: optional in 2027, required in 2028 | Ask your EHR vendor about API support |
| Drug prior authorization (CMS-0062-P) | Proposed: MA, Medicaid, CHIP and exchange plans | Proposed; comments closed June 15, 2026; drug rules proposed for October 1, 2027 | No change yet; watch for a final rule |
Sources: CMS-0057-F fact sheet (CMS, 2024); 89 FR 8758 (Federal Register, 2024); CMS-0062-P briefing slides and e-prior authorization rulemaking summary (CMS, 2026). Proposed items may change.
The API must list which items and services need approval, show documentation requirements and return the decision, with a specific reason for any denial. It helps only if your EHR and your payers both support it.
Faster clocks have not reached most practices yet. In an MGMA Stat poll of September 1, 2026 (178 responses), 44% of medical group leaders said payer prior authorization turnaround was slower in 2026 than in 2025, 40% said about the same, 7% said faster and 9% were unsure.
Insurers have made voluntary promises too. In a June 23, 2025 pledge announced by HHS and CMS, health plans committed to cut the volume of medical services needing prior authorization by January 1, 2026 and to offer real-time approvals for most requests by 2027. Only one in three physicians in the AMA’s 2025 survey expected the pledge to make a meaningful difference.
For staffing, the rule changes skills more than headcount: complete requests with the right urgency flag, logged denial reasons, and a clear owner for follow-up and exceptions, even after APIs cut re-keying.
Pending items: check before you act
CMS-0062-P is still a proposal (CMS status page, briefing slides), and the 2027 Physician Fee Schedule final rule may change the MIPS measure timing (CMS rulemaking summary). Check the CMS-0057-F page before acting on any date.
What should you require from any prior authorization vendor?
Require a signed Business Associate Agreement before anyone sees patient data, individual role-limited logins, a written scope with clinical hand-off points, coverage on your practice’s time zone and weekly reporting you can check against your own log.
Under HHS guidance, a vendor handling protected health information for your practice is a business associate and needs its own agreement with any subcontractor before sharing that information. 45 CFR 164.502 requires written satisfactory assurances before disclosure and applies the minimum necessary standard to business associates. 45 CFR 164.504(e) lists required contract terms, including safeguards, reporting uses the contract does not allow, and return or destruction of data at termination where feasible.
Define the prior authorization role before the first login: HHS expects policies naming who needs access and to which categories of information. The Security Rule at 45 CFR 164.312 requires unique user identification and audit controls, which shared logins defeat.
Questions to ask before you sign
- Will you sign our Business Associate Agreement before any access? Which subcontractors touch our data?
- Will each person have an individual EHR and portal login, limited to the prior authorization queue?
- Where does each assistant work, and will they cover our hours in our time zone?
- Which tasks stop at a hand-off: clinical questions, peer-to-peer calls, appeal letters?
- What do you report weekly: submitted, pending, decided, denied by reason, appeals due?
- At contract end, how are accounts closed and our data returned or destroyed?
Our own set-up: role-based access, audit logging and encrypted (HTTPS) connections in our portal, and we put a Business Associate Agreement in place before accessing patient data. Your practice’s time zone governs every RCM Finder staff member, onshore or offshore. For your side, use our HIPAA compliance checklist for medical practices.
Our recommendations
- Log two weeks before you hire. We start every prior authorization review with a log of payer, service, channel, minutes and outcome. It shows whether you need more hours, better tools or one clear owner.
- Split the work by license, not job title. Providers keep documentation, peer-to-peer calls and the clinical case in appeals. Checks, submissions, tracking and approval entry go to administrative staff, in-house or virtual.
- Work the queue by visit date. Sort open requests by the patient’s visit date, not the submission date, and escalate anything still pending as the visit approaches.
- Read the reason on every denial. Impacted payers now have to state a specific reason. Log it by payer and service so a repeated reason becomes a checklist item, not another appeal.
- Never share a login. Every person, employee or vendor, needs their own EHR and portal login limited to the queue. It protects patients and keeps your audit trail intact.
Bottom line
Prior authorization becomes staffable once you can see it. Measure the queue, keep clinical work with providers and give the administrative work one owner, whether that is an employee, a virtual medical assistant or a fully outsourced team. If authorization and billing data need to meet in one place, see our end-to-end revenue cycle management service.
Frequently asked questions
Which prior authorization tasks can non-clinical staff handle?
Non-clinical staff, in-house or virtual, can check whether a request is needed, assemble the records your provider has documented, submit through portals, phone or fax, track status and enter approvals so scheduling and billing match. Each person works in your EHR under their own login. Clinical decisions, documentation and peer-to-peer calls stay with your providers.
Can a virtual assistant handle peer-to-peer reviews or appeal letters?
Not the clinical part. A peer-to-peer review is a conversation between your physician and the plan’s reviewer, and an appeal needs the provider’s clinical argument. A virtual assistant can schedule the call, prepare the file, track the appeal deadline and submit the appeal once the provider has written or approved it.
Is a remote prior authorization assistant allowed under HIPAA?
HIPAA lets practices use vendors that handle patient information as business associates, provided a Business Associate Agreement is in place and the vendor safeguards the data. Ask for individual logins, access limited to the prior authorization queue, audit trails and written confirmation of where each person works, and check your payer contracts for any offshore terms. This is general information, not legal advice.
Do the 2026 prior authorization deadlines apply to every insurer?
No. Under CMS-0057-F, the 72-hour expedited and 7-calendar-day standard timeframes apply to Medicare Advantage, Medicaid and CHIP payers, generally from January 1, 2026. Exchange plans are excluded from the timeframes, drugs are out of scope, and employer-sponsored commercial plans are not covered by the rule. Track each payer’s real turnaround in your own log.
How many prior authorization staff does a practice need?
It depends on your volume, payers and channels. In the AMA’s 2025 survey, physicians averaged 40 prior authorizations and 13 hours of physician and staff time a week, but your mix may differ. Log requests and minutes for two weeks, subtract the time only physicians can do, and staff the remaining hours with cover for absences.
Should we fully outsource prior authorization or add a virtual assistant?
Add a virtual assistant if you want to keep control of priorities and the work happens in your own EHR. Fully outsource if you want a vendor to own the queue, follow-up and reporting, often alongside billing. Either way, keep clinical work with providers and require a Business Associate Agreement before access. Our free practice audit can help you compare.
Get your free practice audit
Tell us about your practice. A member of our operations team replies within one business day.
- A review of your recent claims, denials and A/R aging
- Where your front desk and prior authorizations slow payment
- A prioritized fix list you keep, whether or not you hire us
Pricing is quoted after the audit, based on your volume and the services you choose. Prefer to talk? Call +1 (302) 556-2288.
Sources
- Only 1 in 3 doctors trusts insurers’ prior authorization promises — American Medical Association (2026)
- 2025 AMA prior authorization physician survey (survey data) — American Medical Association (2025 survey, published 2026)
- 2024 CAQH Index Report — CAQH (2024 (calendar-year 2023 data))
- How many payer portals is too many? Most practices already know their answer — MGMA (2026)
- Fewer than 1 in 10 practices see faster prior auth turnarounds in 2026 — MGMA (2026)
- Medicare and Medicaid Programs; Patient Protection and Affordable Care Act; Advancing Interoperability and Improving Prior Authorization Processes (CMS-0057-F) — Federal Register (National Archives) (2024)
- CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) fact sheet — CMS (2024)
- CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) — CMS (2026 (page modified October 8, 2026))
- 2026 CMS Interoperability Standards and Prior Authorization for Drugs Proposed Rule (CMS-0062-P) — CMS (2026 (page modified October 8, 2026))
- Overview of the 2026 CMS Interoperability Standards and Prior Authorization for Drugs Proposed Rule (CMS-0062-P), briefing slides — CMS (2026)
- Electronic Prior Authorization: Industry Commitments & Finalized and Proposed Rulemaking — CMS (2026)
- HHS Secretary Kennedy, CMS Administrator Oz Secure Industry Pledge to Fix Broken Prior Authorization System — CMS (2025)
- Business Associates — HHS Office for Civil Rights (2026 (content last reviewed July 30, 2026))
- 45 CFR 164.502 — Uses and disclosures of protected health information: general rules — eCFR (National Archives) (2026)
- 45 CFR 164.504 — Uses and disclosures: organizational requirements — eCFR (National Archives) (2026)
- Minimum Necessary Requirement — HHS Office for Civil Rights (2013 (page modified 2026))
- 45 CFR 164.312 — Technical safeguards — eCFR (National Archives) (2026)
Disclaimer: This article is general educational information for medical practice owners and managers. It is not legal, compliance, coding or billing advice. Prior authorization rules, timeframes and contract terms vary by payer, plan and state and change often, and some federal provisions described here are proposed, not final. Confirm requirements with each payer and qualified advisors before acting.
