How to Resolve a CO-15 Denial: Missing or Invalid Authorization Number

:::info Quick answer A CO-15 denial indicates the prior authorization number is missing from the claim, formatted incorrectly, or doesn't match the billed provider, CPT code, or date of service. To fix it, locate the correct authorization, enter it in Loop 2300 REF*G1 (or Box 23), and submit a corrected claim. :::

You pull up a fresh batch of ERAs, spot a CO-15 denial code, and immediately check the patient's chart. The prior authorization number is sitting right there in the clinical notes. You did the work. The payer approved the service. Yet the claim was still denied for a missing or invalid authorization.

This is one of the most maddening scenarios in medical billing. Payers in 2026 are heavily reliant on automated claims adjudication systems. These systems do not look at your clinical notes; they look at specific data elements in the EDI 837 file. If the authorization number is missing from the designated field, or if a single digit in the NPI, CPT code, or date of service mismatches the authorization file on the payer's end, the system instantly generates a CO-15.

Here is exactly how to diagnose the root cause of a CO-15 denial, fix the claim, and tighten your front-end processes so it stops happening.

What the CO-15 CARC Actually Means

The official description for Claims Adjustment Reason Code (CARC) 15 is: "The authorization number is missing, invalid, or does not apply to the billed services or provider."

The "CO" prefix stands for Contractual Obligation. This is a critical detail. A Contractual Obligation means the financial liability falls on the provider, not the patient. Because you signed a contract with the payer agreeing to follow their prior authorization rules, you cannot balance-bill the patient for this denied amount. Your only options are to fix the claim, win an appeal, or write off the balance.

You will almost always see CO-15 paired with a Remittance Advice Remark Code (RARC) that provides a secondary clue. Common pairings include:

• N54: Missing/incomplete/invalid prior authorization.
• M62: Missing/incomplete/invalid treatment authorization code.
• N286: Missing/incomplete/invalid tracking number.
• MA63: Missing/incomplete/invalid authorization number.

These codes all point to the same fundamental problem: the payer's computer could not link your submitted claim to an approved authorization on their end.

The 6 Reasons Payers Send a CO-15 Denial

A prior authorization is essentially a highly specific contract for a single instance of care. It binds five elements together: the patient, the provider, the procedure, the date range, and the quantity. If any of those links break between the authorization file and the claim file, the claim denies.

1. The Void in Box 23 (Loop 2300)

The most common cause is the simplest: the authorization number literally did not make it onto the claim form. On a CMS-1500, this belongs in Box 23 (Prior Authorization Number). In electronic billing (EDI 837P), it must populate in Loop 2300, segment REF, with the qualifier G1 in element REF01 (e.g., REF*G1*AUTH123456789~). If your practice management system failed to pull the number from the patient's demographic file onto the claim, the payer will deny it immediately.

2. The CPT Code Bait-and-Switch

Physicians often change their plan during a procedure. You might obtain prior authorization for a knee arthroscopy with meniscectomy (CPT 29881). But once inside the joint, the surgeon performs a complex repair (CPT 29882) instead. When you bill the higher-level CPT code, the payer's system looks at the authorization file, sees an approval for 29881, and rejects the claim for 29882 because the authorization "does not apply to the billed services."

3. The NPI Mismatch

Getting the provider right is just as important as getting the procedure right. Large group practices often stumble here. If your front desk obtained authorization under the clinic's Group NPI, but the claim goes out billed under the individual rendering physician's Type 1 NPI (or vice versa), the payer's system will not match them up. UnitedHealthcare and Humana Medicare Advantage plans are notoriously strict about NPI matching in 2026.

4. The Expired Calendar

Authorizations have a shelf life, typically 30 to 90 days. If a patient reschedules their MRI three times and ultimately has the scan completed a week after the authorization window closes, the claim will deny. The authorization number is technically valid, but it "does not apply" to the billed date of service.

5. Exhausted Units

Physical therapy, occupational therapy, and behavioral health clinics see this constantly. The payer authorizes 12 visits. The front desk fails to count the visits accurately, and the patient comes in for a 13th session. You submit the claim with the valid authorization number, but the payer's system flags that the approved units have been exhausted. Result: CO-15.

6. Claim-Level vs. Line-Level Confusion

If you have a complex claim with multiple procedures, some payers require the authorization number at the line level (Loop 2400) rather than the claim level (Loop 2300). If you put a specific surgical authorization at the claim level, but it only applies to line item 1 and not line item 2, the payer's automated system might deny the entire claim.

Table: CO-15 Causes and Fixes

Step-by-Step Resolution for CO-15

Do not immediately file an appeal when you see a CO-15. An appeal is a request to overturn a payer's decision. If the denial happened simply because you forgot to put the authorization number on the claim, there is no decision to overturn—you just submitted a flawed claim.

Step 1: Verify the Authorization Details

Before you touch the claim, log into the payer's provider portal and pull up the authorization file. You need to verify four distinct elements:

1. Is the exact authorization number active?
2. Does the approved CPT code match your billed CPT code?
3. Does the approved NPI match your billing and rendering NPIs?
4. Does the date of service fall within the approved date range?

Step 2: Check the Clearinghouse Output

If the authorization looks perfect on the portal, check your clearinghouse portal. Look at the raw EDI data for the denied claim. Search for the REF*G1 segment. Practice management systems often drop authorization numbers during claim generation if the data was entered into a "notes" field instead of the dedicated prior authorization field in the software.

Step 3: Submit a Corrected Claim

If the authorization was valid but missing, or if you had a minor typo in the number (e.g., an extra zero), do not send an appeal. Submit a corrected claim (Claim Frequency Code 7) with the correct authorization number populated in Loop 2300. This is the fastest path to payment.

Step 4: Call to Link Mismatched Providers

If the NPI is the issue, you can sometimes avoid a formal appeal by calling the payer's authorization department. Explain that the service was authorized under Dr. Smith, but Dr. Jones ended up performing the surgery because he was on call. Ask the representative to manually link Dr. Jones's NPI to the existing authorization. Once they confirm the update, submit a corrected claim.

The CO-15 Appeal Workflow and Timeline

You must file a formal appeal if the clinical reality changed (e.g., the surgeon changed the CPT code mid-operation) or if you genuinely failed to obtain authorization but the service was an absolute medical emergency.

Under the CMS Advancing Interoperability and Prior Authorization Final Rule (CMS-0057-F), which went into full enforcement effect regarding prior auth decisions by 2026, payers face strict turnaround times for authorization reviews. However, appeals for retroactive authorizations are still heavily scrutinized.

Standard CO-15 Retro-Appeal Timeline:

• Day 1: Denial received via ERA.
• Day 1-5: Gather clinical notes. If the CPT changed during surgery, you need the operative report specifically highlighting why the change was medically necessary and could not be anticipated.
• Day 6: Submit the appeal. Clearly state in the cover letter: "Request for Retroactive Authorization Due to Intraoperative Findings."
• Day 30-45: Payer review window. Commercial payers typically take up to 45 days to review retroactive authorization appeals.
• Day 45+: If denied, request a Peer-to-Peer review. Have your physician explain the intraoperative change directly to the payer's medical director.

A note on emergency exceptions: If the service was an emergency, you do not need prior authorization. If a payer denies an emergency claim with a CO-15, your appeal must focus on the "prudent layperson" standard or emergency medical necessity, explicitly stating that prior authorization rules do not apply to emergent care.

Preventing CO-15 at the Front Desk

The most profitable way to handle a CO-15 denial code is to prevent it before the patient ever sees the doctor.

Implement Strict EDI 278 Workflows

By August 2026, many EHRs and clearinghouses fully support the X12 278 standard for electronic prior authorizations. Instead of relying on phone calls or portal checking, ensure your practice management system is configured to send 278 requests and automatically parse the 278 responses directly into the claim generation module. This eliminates copy-paste errors that leave Box 23 blank.

The 72-Hour CPT Code Check

Implement a workflow where the billing team reviews surgical schedules 72 hours in advance. Compare the scheduled CPT codes against the authorized CPT codes. If a physician has changed the surgical plan during a pre-op visit, you have 72 hours to contact the payer and amend the authorization before the procedure takes place.

Track Authorized Units Relentlessly

For therapy and recurring treatments, use the "countdown" feature in your scheduling software. If an authorization covers 10 visits, the system should hard-stop the front desk from scheduling an 11th visit without a new authorization on file. Relying on patients to remember how many visits they have used is a guaranteed way to generate CO-15 denials.

By treating the authorization number as a rigid contract that must perfectly match the NPI, CPT, and DOS on the claim, you can virtually eliminate CO-15 denials from your accounts receivable.

Frequently asked questions

Can I bill the patient for a CO-15 denial?

No. The 'CO' stands for Contractual Obligation, meaning the financial responsibility belongs to the provider. You cannot balance-bill the patient for missing or invalid prior authorizations unless you had them sign an Advance Beneficiary Notice (ABN) or equivalent waiver prior to the service specifically stating auth was not obtained.

What is the difference between CO-15 and CO-197?

CO-15 means the authorization number itself is missing, invalid, or mismatched on the claim. CO-197 means precertification/authorization was absent entirely. CO-15 often implies you might have an authorization, but you didn't put it on the claim correctly.

Where does the prior authorization number go on an electronic 837 claim?

At the claim level, the authorization number goes in Loop 2300, segment REF, with the qualifier G1 in element REF01 (REF*G1). If the payer requires line-level authorization, it goes in Loop 2400.

How do I fix a CO-15 if the surgeon changed the procedure mid-surgery?

You cannot simply submit a corrected claim because the authorization on file won't match the new CPT. You must file an appeal for a retroactive authorization amendment, including the operative report to prove the medical necessity of the intraoperative change.

Will traditional Medicare Part B issue a CO-15 denial?

Traditional Medicare requires prior authorization for very few services (like certain power mobility devices or repetitive non-emergent ambulance transport). However, Medicare Advantage (Part C) plans act like commercial payers and issue CO-15 denials frequently if their specific authorization rules aren't met.