Prior Authorization Requirements in Medical Billing

Prior authorization (PA) is a payer-imposed administrative requirement that mandates advance approval before a provider delivers a specific service, procedure, or medication. This page covers the definition and regulatory framing of prior authorization, the step-by-step mechanism by which approvals are requested and adjudicated, common clinical and billing scenarios where PA applies, and the decision boundaries that determine when a service is approved, denied, or subject to peer review. Understanding these requirements is foundational to reducing claim denials and maintaining compliant revenue cycle operations.

Definition and scope

Prior authorization is a utilization management tool used by health insurers, managed care organizations, and government payers to evaluate whether a proposed service meets coverage criteria before the service is rendered. The Centers for Medicare & Medicaid Services (CMS) defines prior authorization in the context of Medicare Advantage and Part D plans as a coverage condition requiring beneficiary or provider-initiated approval (CMS, Medicare Managed Care Manual, Chapter 4).

The scope of PA requirements spans:

• Prescription drugs — particularly specialty biologics and non-preferred formulary agents
• Diagnostic imaging — MRI, CT, PET scans above defined frequency thresholds
• Surgical and procedural services — elective and semi-elective procedures classified by payer medical policy
• Durable medical equipment (DME) — as governed by HCPCS Level II code requirements (see HCPCS Level II Codes)
• Behavioral health services — including inpatient psychiatric admissions and certain outpatient therapy modalities
• Home health and post-acute care — particularly skilled nursing facility admissions

The American Medical Association (AMA) tracks PA burden annually; its 2023 Prior Authorization Physician Survey found that 94% of responding physicians reported PA-related care delays (AMA, 2023 AMA Prior Authorization Survey).

PA requirements are distinct from concurrent review (utilization management conducted during an active admission) and retrospective review (post-service coverage evaluation). All three are governed under utilization management frameworks, but only prospective PA functions as a prerequisite for claims submission.

How it works

The prior authorization process follows a defined sequence of administrative and clinical steps. The exact workflow varies by payer, but the core structure is consistent across commercial, Medicare Advantage, and Medicaid managed care plans.

1. Identification — The provider's billing or clinical staff identifies that the planned service requires PA by consulting the payer's coverage policy or using an eligibility verification system.
2. Documentation assembly — Clinical documentation supporting medical necessity is compiled: diagnosis codes (ICD-10-CM), the proposed procedure or service (CPT or HCPCS code), clinical notes, prior treatment history, and relevant lab or imaging results.
3. Submission — The PA request is submitted via the payer's portal, electronic transaction (ANSI X12 278 Health Care Services Review transaction set), fax, or phone. CMS's interoperability final rule published in May 2024 (CMS-0057-F) requires certain payers to implement FHIR-based PA APIs by January 1, 2026, standardizing electronic submission pathways.
4. Payer adjudication — The payer reviews the request against its medical policy criteria, which may reference external evidence-based guidelines (e.g., MCG Health criteria, InterQual criteria). Turnaround time requirements are regulated: under federal Medicaid managed care regulations at 42 CFR § 438.210, standard decisions must be rendered within 14 calendar days; urgent decisions within 72 hours.
5. Determination — The payer issues an approval (with an authorization number), a denial, or a request for additional information (pend status).
6. Appeals — A denial triggers appeal rights under the plan's internal grievance process and, for Medicare Advantage, the CMS-established appeals framework (42 CFR Part 422, Subpart M).

Authorization numbers must be captured and entered on claim forms — Field 23 on the CMS-1500 form or the appropriate loop in the 837P electronic transaction — before submission to avoid automatic denial.

Common scenarios

Prior authorization requirements cluster around five clinically and financially significant service categories:

Specialty pharmaceuticals — Biologics and biosimilars for conditions such as rheumatoid arthritis, psoriasis, or inflammatory bowel disease routinely require PA along with step therapy documentation proving that lower-cost agents were tried first.

Advanced imaging — Radiology procedures such as MRI of the spine, cardiac PET, and whole-body CT frequently require PA through a radiology benefits manager (RBM) delegated by the primary insurer. Reference Radiology Billing Reference for CPT-level detail.

Surgical procedures — Elective orthopedic procedures (total knee arthroplasty, rotator cuff repair), bariatric surgery, and spinal fusion surgeries are among the highest-volume PA categories in commercial insurance. Missing PA for these services is a leading driver of post-service claim denials.

Mental health and substance use disorder (SUD) services — Inpatient psychiatric admissions and residential SUD treatment require PA and are subject to the Mental Health Parity and Addiction Equity Act (MHPAEA) (29 U.S.C. § 1185a), which restricts payers from applying more restrictive PA criteria to behavioral health than to comparable medical-surgical benefits. See Mental Health Billing Codes for coding context.

Home health and DME — Medicare Fee-for-Service operates a prior authorization model for certain DME items under its durable medical equipment program, with a list of items subject to Required Prior Authorization published by CMS on a rolling basis.

Decision boundaries

The boundary between services that require PA and those that do not is established at four levels:

1. Federal regulatory floors
Medicare Fee-for-Service (Parts A and B) uses prior authorization for a defined subset of services; it does not apply universally. CMS's Prior Authorization Program for certain hospital outpatient department services was established under the Protecting Access to Medicare Act of 2014 (PAMA) (Pub. L. 113-93). Medicaid PA requirements are state-administered within federal guardrails at 42 CFR § 440.230.

2. Payer medical policy
Each payer publishes coverage determination documents specifying which CPT/HCPCS codes require PA, under what clinical conditions, and for which patient populations. These policies may reference commercial criteria sets such as MCG or InterQual but are not federally standardized.

3. Approval vs. denial criteria
An approval requires documented medical necessity — defined by CMS as services "reasonable and necessary for the diagnosis or treatment of illness or injury" (Section 1862(a)(1)(A) of the Social Security Act). A denial occurs when submitted documentation fails to meet the payer's coverage criteria, when a less intensive alternative exists per payer policy, or when a service falls under a categorical exclusion. Note that the Social Security Fairness Act of 2023 (Pub. L. 118-310), enacted January 5, 2025, repealed the Windfall Elimination Provision (WEP) and Government Pension Offset (GPO) under the Social Security Act. While this legislation does not directly alter PA criteria, it modifies the underlying Social Security Act framework that CMS references for benefit coverage definitions, and affected providers serving newly eligible or reclassified Social Security beneficiaries should verify updated payer coverage policies for those populations.

4. Expedited vs. standard review
When the standard 14-day review period would seriously jeopardize the patient's health, providers may request expedited review. Medicare Advantage plans are bound by the same 72-hour standard applied to standard Part D coverage determinations (42 CFR § 422.568).

The distinction between a PA denial and a claim denial is operationally significant: a PA denial precedes service delivery and triggers a pre-service appeal, while a claim denial occurs post-submission and routes through the medical billing appeals process. Conflating these two workflows is a documented source of revenue cycle inefficiency. For broader context on how PA fits within the end-to-end reimbursement cycle, see Revenue Cycle Management Overview.

References

• Centers for Medicare & Medicaid Services — Medicare Managed Care Manual, Chapter 4
• CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F)
• 42 CFR Part 438 — Medicaid Managed Care (eCFR)
• 42 CFR Part 422 — Medicare Advantage (eCFR)
• Social Security Fairness Act of 2023, Pub. L. 118-310 (enacted January 5, 2025)