The Ultimate Guide to Prior Authorization and Pre-Certs

:::info Quick answer Prior authorization is a health plan's requirement that a provider obtains approval before delivering a specific service, drug, or medical device. The process involves verifying requirements, submitting clinical documentation proving medical necessity, and tracking the payer's decision to ensure the claim will be paid upon submission. :::

August 2026 is a strange time to be in healthcare revenue cycle management. We are officially living under the enforcement phase of the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F). Payers are legally required to make decisions faster. Medicare Advantage plans are under massive federal scrutiny. Yet, anyone working a denial queue knows the fax machine isn't dead, and health plans still find creative loopholes to stall approvals for expensive procedures.

Finding a single prior authorization complete guide that covers everything from the new FHIR API mandates down to fighting a Carelon peer-to-peer review isn't easy. Most resources read like they were written by an algorithm that has never touched an Availity portal.

We are going to look at exactly how authorization works right now. This covers the federal timelines you need to hold payers to, the exact steps to build a bulletproof clinical packet, and how to structure your department so authorizations stop bottlenecking your cash flow.

1. The 2026 Prior Authorization Landscape: What Just Changed

If you are still operating your auth department like it is 2023, you are leaving money on the table and letting payers get away with violations.

CMS-0057-F changed the baseline rules of engagement. As of January 1, 2026, impacted payers—which include Medicare Advantage (MA) organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, and QHP issuers on the Federally-facilitated Exchanges—must adhere to strict new turnaround times.

The New Federal Turnaround Timelines

Here is what payers are legally held to as of this year:

• Standard Requests: Decisions must be issued within 7 calendar days. (Previously, MA plans routinely stretched this to 14 days).
• Expedited/Urgent Requests: Decisions must be issued within 72 hours.
• Reason for Denial: Payers must provide a specific, actionable reason for denying a prior authorization request. They can no longer send back a vague "criteria not met" letter without citing the exact clinical guideline the patient failed to satisfy.

State-Level Gold Carding

Alongside federal rules, state legislation is forcing commercial payers to adopt "gold carding" programs. Following Texas's lead, states like Michigan, Arkansas, and Louisiana now mandate that providers with historically high authorization approval rates (usually 90% or higher over six months) are exempted from prior auth requirements for specific services.

If your practice is in a gold-card state, your billing manager needs to audit your commercial payer contracts immediately. You might be manually working authorizations for CPT codes you are legally exempt from reporting.

2. The 5-Step Prior Authorization Workflow

A high-functioning pre-cert department treats authorization like a manufacturing line. Every step must happen in the exact same sequence, every single time.

Step 1: Determination and Verification

Never guess if an authorization is required. Even if a payer didn't require an auth for CPT 22630 (Lumbar arthrodesis) last month, their medical policy could have updated on the first of the month.

Your team must check the payer's specific policy using the exact CPT codes, the primary ICD-10 diagnosis code, and the planned place of service (POS). An MRI of the brain (70553) might require auth in an outpatient hospital (POS 22) but not in a freestanding imaging center (POS 11).

Step 2: Clinical Assembly

This is where 80% of authorizations fail. Health plans use specific proprietary guidelines—like InterQual or MCG (Milliman Care Guidelines)—to determine medical necessity.

Your clinical packet must tell a story that exactly matches those guidelines. If the payer requires six weeks of failed conservative therapy before approving an epidural steroid injection (62322), your packet needs:

• The specific dates of physical therapy.
• The NSAIDs prescribed, dosage, and duration.
• Imaging reports (not just the interpretation, but the actual radiologist report).
• Clear physician notes detailing that the pain is unmanageable despite these interventions.

Step 3: Submission

In August 2026, you have three primary ways to submit an auth:

1. Payer Portals: Availity, Optum Pro, Navinet. These are standard, but require manual data entry.
2. EDI 278 Transactions: The HIPAA-standard electronic transaction for prior auth. While historically clunky, the 2026 CMS API mandates are finally forcing payers to make 278s functional within major EMRs.
3. Fax: Still alive, still terrible. If you must fax, include a heavy, bold cover sheet with the patient's ID, date of birth, and the requesting NPI right at the top.

Step 4: Tracking and Escalation

Once submitted, the clock starts. Your EMR or auth software must track the exact hour the request was sent. If a Medicare Advantage plan hits day 8 on a standard request, your team needs to escalate immediately citing CMS-0057-F violations.

Step 5: Claim Linking

The authorization number must make it onto the 837P (professional) or 837I (institutional) claim file. Specifically, it goes into Loop 2300, segment REF*G1. If your auth team gets the approval but the billing team drops the claim without that number, the claim will automatically deny with CARC 197 (Precertification/authorization absent).

3. Major Payer Quirks: TBMs and Carve-Outs

You are rarely dealing directly with the insurance company for high-dollar procedures. You are usually dealing with a Third-Party Benefit Manager (TBM).

Carelon (Formerly AIM Specialty Health)

Carelon heavily manages radiology, cardiology, and musculoskeletal (MSK) services for Anthem/Elevance and others. Their portal is highly algorithmic. If you answer one clinical pathway question incorrectly, the system automatically kicks the request to a medical director review.

Pro-tip: Never guess on a Carelon pathway. Have your physician's clinical notes open next to you. If the pathway asks if the patient has had a fever within 48 hours, and the chart doesn't explicitly say it, do not check the box just to bypass the screen. That is fraud, and Carelon routinely audits post-payment to claw back money when portal answers don't match clinical documentation.

eviCore healthcare

eviCore is notorious for strict MSK and advanced imaging rules, commonly used by Cigna and BCBS plans. They require incredibly granular clinicals. If you are requesting a joint replacement (27447), eviCore will look for the exact Kellgren-Lawrence grade on the patient's X-ray. If the radiologist didn't note the grade, eviCore will deny the request.

Pharmacy Carve-Outs and Buy-and-Bill (J-Codes)

Administering biologic drugs in-office (like Prolia or Remicade) requires dealing with pharmacy benefit managers (PBMs). You often need two authorizations: one for the drug itself (the J-code) and one for the administration (e.g., CPT 96413). Ensure you know whether the payer mandates "white bagging" (the specialty pharmacy ships the drug directly to you) or if you are allowed to buy the drug into your own inventory and bill for it.

4. Prior Auth KPIs You Need to Track Now

You cannot fix what you do not measure. If a practice administrator tells me "our authorizations take too long," I cannot help them. If they say "our average turnaround time with UnitedHealthcare is 9.2 days, and our first-pass denial rate with Humana is 18%," we have a starting point.

Here are the non-negotiable metrics for 2026:

Track these by payer, by provider, and by CPT code. You will quickly find outliers. For example, Dr. Smith might have a 40% denial rate on MRI requests because he refuses to document conservative therapy in his progress notes.

5. The Denial Playbook: Overturning Auth Rejections

When an authorization is denied, the payer will issue a letter. Read it carefully. It will specify whether this is an administrative denial or a clinical/medical necessity denial.

Administrative Denials

These happen because your team messed up.

• Wrong NPI.
• Patient's coverage terminated.
• Requested retro-authorization too late.
• Duplicate request.

Administrative denials usually cannot be appealed via clinical pathways. You simply have to correct the demographic error and submit a new request.

Medical Necessity Denials

These happen because the payer disagrees that the service is clinically required. To fight these, you must initiate an appeal or a Peer-to-Peer (P2P) review.

Winning the Peer-to-Peer

A peer-to-peer is a phone call between your attending physician and the health plan's medical director. Payers make this difficult intentionally. They offer narrow, inflexible time slots, hoping your doctor misses the call.

To win a P2P, your auth department must prep the physician:

1. Print the Payer's Policy: Highlight the exact paragraph the payer claims the patient failed to meet.
2. Provide the Cheat Sheet: Give your doctor a one-page summary stating: "The Medical Director denied this because they claim the patient didn't try physical therapy. Here are the dates the patient did PT: March 1 to April 15. The PT notes are attached."
3. Hold the Line: Payers frequently use general practitioners to conduct P2Ps for specialized surgeries. If an orthopedic surgeon is arguing with a retired pediatrician about a complex spinal fusion, your surgeon needs to politely but firmly ask for a specialty-matched reviewer.

Extenuating Circumstances: Retro-Authorizations

Getting an authorization after the service is performed is incredibly difficult, but not impossible. Payers generally allow retro-auths in three scenarios:

1. True Medical Emergencies: The patient presented to the ER and required immediate surgery to save life or limb.
2. Payer System Outages: The portal was down, and the fax lines were busy for 48 hours. (You must have screenshots showing the error codes).
3. Eligibility Corrections: The patient presented with a BlueCross card, but coverage had actually shifted to Medicaid two days prior without the patient's knowledge.

6. Staffing and Structuring Your Auth Department

Stop dumping authorizations on your front desk staff. Checking in a patient and arguing with a Carelon medical director require two completely different skill sets.

The Centralized Model

For practices with more than five providers, pull authorizations into a centralized, specialized back-office team.

The Prior Auth Specialist: This role is highly administrative. They scrub schedules 14 days in advance, verify benefits, determine auth requirements, pull notes from the EMR, and submit the initial requests via portals.

The Clinical Liaison (RN or LPN): You need a clinician on the team to translate physician jargon into payer requirements. When an auth specialist hits a wall because the notes are ambiguous, the clinical liaison steps in. They also coordinate the Peer-to-Peer scheduling and prep the doctors.

Staffing Ratios

How many auth specialists do you need? It depends heavily on your specialty.

• Primary Care/Pediatrics: 1 Auth Specialist per 8-10 providers.
• Orthopedics/Spine: 1 Auth Specialist per 3-4 providers.
• Oncology/Rheumatology (Heavy Buy-and-Bill): 1 Auth Specialist per 2 providers.

7. Looking Ahead: Technology and the 2027 Horizon

While the 2026 CMS rules enforced faster turnaround times, the 2027 phase of CMS-0057-F mandates that impacted payers must implement Prior Authorization Requirements, Documentation, and Decision (PARDD) APIs.

By 2027, your EMR should be able to query the payer's system in real-time, instantly confirm if an auth is required, suggest the exact clinical documentation needed based on the payer's rules, and submit the packet without a human logging into Availity.

Until that tech becomes ubiquitous, your defense is structural discipline. Audit your schedules proactively. Map your payer policies. Prep your physicians for peer-to-peers. Prior authorization is designed to cause attrition; out-organizing the health plans is the only way to protect your revenue.

Frequently asked questions

How long does a prior authorization take in 2026?

Under CMS rules effective in 2026, impacted payers (including Medicare Advantage and Medicaid managed care) must issue standard prior authorization decisions within 7 calendar days, and expedited/urgent decisions within 72 hours.

What is CARC 197?

CARC 197 stands for 'Precertification/authorization/notification/pre-treatment absent.' It is the standard denial code payers use when a claim is submitted for a service that required prior authorization, but no valid authorization number was included on the claim form.

What is a prior authorization gold card?

Gold carding is a program where health plans exempt specific providers from prior authorization requirements for certain services. This is typically granted to providers who maintain a historic approval rate of 90% or higher. Several states now legally mandate these programs for commercial payers.

Can I bill the patient if prior authorization is denied?

Generally, no. In-network provider contracts prohibit balance billing a patient for services denied due to lack of prior authorization. You can only bill the patient if they signed an Advance Beneficiary Notice (ABN) or a specific commercial waiver prior to the service, acknowledging they would bear the cost.

What is a peer-to-peer (P2P) review?

A peer-to-peer review is a telephone call between the requesting provider (your physician) and the health plan's medical director. It is usually the final step in the internal appeals process to overturn a clinical denial by verbally arguing medical necessity.

Does an approved prior authorization guarantee payment?

No. Every prior authorization approval includes a disclaimer that it is not a guarantee of payment. Claims can still be denied post-service due to termination of patient coverage, non-covered benefits, coding errors, or bundling edits.

What happens if we submit an authorization request but the payer's portal is down?

If a payer system outage prevents submission, you must take screenshots of the error codes and downtime notices. You can proceed with treating the patient and submit a retroactive authorization request, using the downtime evidence to bypass timely filing limits.