Prior Authorization Explained: Why Your Insurance Wants Approval First

By the Editorial Team. Reviewed and updated on August 19, 2026.

This article is educational and independent. It is not medical, legal, insurance, or financial advice. Coverage rules, appeal rights, and billing protections vary by plan, by state, and by individual circumstance. Confirm details with your plan documents, your state insurance department, or the official sources named in this article.

Start Here

Prior authorization is the reason an MRI your doctor ordered on Tuesday can sit in limbo until the following week, and the reason a pharmacy sometimes hands your prescription back with a shrug instead of a bag. Your doctor said you need it. The plan says: prove it first.

Here is the scene this article is written for. Your orthopedist orders a knee MRI. The front desk says “we’ll get it authorized” and you leave assuming it is handled. Two weeks later you are in the scanner. Six weeks after that, an Explanation of Benefits (EOB) arrives showing the plan paid nothing, with a remark code meaning “no approval on file.” Nobody called you. The machinery just quietly failed.

That failure is preventable, and preventing it takes one phone call, made at the right moment, by you. This article covers what the approval process is for, which services trigger it, who files the paperwork, how fast plans must answer under the 2026 federal rules, what an approval actually promises, and where the process breaks down.

What Prior Authorization Means and Why Plans Use It

Prior authorization — also called preauthorization, precertification, or just “prior auth” — is a requirement that your health plan approve a service, medication, or piece of equipment before you receive it, as a condition of paying for it. The federal glossary definition at HealthCare.gov contains the single most useful sentence on the subject: preauthorization is not a promise your plan will cover the cost. Hold that thought.

Why does the requirement exist? It is a cost-control and utilization-management tool. Plans use it to check, before money is spent, that a service meets their definition of medical necessity, that a cheaper appropriate option was considered first, and that the care is happening in the least expensive appropriate setting. The industry term for this family of checks is utilization review: prior auth before the care, concurrent review during it, retrospective review after it.

Both of these are true at once: some requests really are duplicative or better handled a cheaper way, and review catches that; and the process adds delay and paperwork to care a doctor already decided was needed, with the failures usually landing on the patient. You do not have to pick a side. You just have to know how the machine works, because you are the only participant with no formal role in it and full financial exposure to its mistakes.

What Commonly Requires Approval First

Every plan publishes its own list, usually buried in the plan document or a separate prior-auth list on the member website. The pattern is consistent across the industry: routine and cheap rarely needs an auth; planned, expensive, or easily overused usually does.

Category	Typical examples	Usually needs approval first?
Office visits and preventive care	Primary care visits, annual physicals, scheduled screenings	Rarely
Advanced imaging	MRI, CT, PET scans	Very commonly
Planned (elective) surgery	Joint replacement, spinal procedures, bariatric surgery	Almost always
Specialty drugs	Biologics, injectables, infusions, high-cost brand medications	Almost always, often with step therapy attached
Durable medical equipment (DME)	CPAP machines, power wheelchairs, hospital beds, glucose monitors	Commonly, above a dollar threshold
Home health and skilled care	Home nursing, skilled nursing facility admissions, some therapy courses	Commonly
Non-emergency hospital admissions	Any planned inpatient stay	Almost always
Emergency care	ER visits, emergency admissions	No — though plans typically require notification within a day or two of an admission

This table is illustrative and describes common patterns as of 2026, not any specific plan. Mental health services run through the same machinery, though that topic deserves its own article elsewhere. Two habits follow: treat any scheduled service involving a machine bigger than an X-ray, an operating room, or a drug that arrives refrigerated as auth-likely until proven otherwise, and never assume last year’s answer still holds — plans change their lists every January and sometimes mid-year.

Who Actually Submits the Request — and What Your Job Is

Here is the part that surprises people: for in-network care, you almost never file the request yourself. The ordering provider’s office does it — a surgery scheduler, referral coordinator, or pharmacy benefits team gathers your chart notes, attaches the procedure and diagnosis codes, and submits the package through a portal, fax line, or electronic channel.

So what is your job? Verification. The classic failure in this system is not a denial. It is an authorization everyone assumed someone else obtained. The office thought the hospital was handling it, the hospital thought the office was, and the appointment happened anyway. Scanners do not check paperwork. Claims departments do, months later.

Your verification routine, for every scheduled service that might need approval:

1. At scheduling, ask the provider’s office directly: “Does this need prior authorization under my plan, and is your office submitting it?”
2. A few days before the appointment, call your plan, ask whether an authorization is on file, and get the auth number, approved codes, approved facility, and date range.
3. Write it all down, with the date of the call and the representative’s name or reference number.
4. If the plan has nothing on file, call the provider’s office back the same day and do not attend the appointment until that changes.

Ninety seconds on the phone. It prevents the single most common way this process turns into a four-figure bill.

How the Decision Gets Made

Once a request lands at the plan, it moves through a standard pipeline. Knowing the stages helps you ask precise questions when something stalls.

1. Intake and coding check. The plan confirms you are a covered member, the service is a covered benefit, and the request carries usable procedure codes (CPT or HCPCS) and a diagnosis code. Requests die quietly here over clerical gaps.
2. Criteria match. A reviewer — often a nurse, sometimes software in the first pass — compares the clinical documentation against the plan’s written medical necessity criteria. Did you try six weeks of physical therapy first, if the criteria call for that? The review is against a checklist, not against your pain.
3. Approval or escalation. Requests that clearly meet criteria get approved, often at the nurse or automated layer. The rest escalate to a physician reviewer; under most plan rules and many state laws, only a clinical peer can deny.
4. Peer-to-peer, if offered. Around the time of a denial, your ordering doctor can usually request a peer-to-peer review — a phone call with the plan’s physician reviewer. A meaningful share of denials get reversed in that call when the treating doctor supplies context the paperwork lacked.
5. The determination letter. The decision arrives in writing: an authorization number and validity window if approved, a reason and appeal instructions if denied. A denial here is formally a pre-service adverse benefit determination — a phrase worth using in any appeal, because it signals you know which rulebook applies.

One more concept before timelines: an approval is always bounded. It covers specific codes, at a specific facility or provider, within a specific date window. Each boundary is a place the process can later fail.

Timelines: Standard, Expedited, and the 2026 Federal Rules

How long can the plan take? It depends on the plan type and the urgency. For employer group health plans, federal claims-procedure rules under ERISA (the Employee Retirement Income Security Act) set the outer limits: generally 15 days for a pre-service decision, with a possible extension, and 72 hours when the request is urgent.

The bigger recent change came from the Centers for Medicare & Medicaid Services (CMS). The CMS Interoperability and Prior Authorization final rule requires, for plan years beginning in 2026, that Medicare Advantage plans, Medicaid and CHIP managed care plans and state programs, and marketplace plans on the federal exchange decide standard requests within 7 calendar days and expedited requests within 72 hours, give a specific reason when they deny, and publicly report approval rates, denial rates, and turnaround times. Automated electronic submission channels phase in during 2027. As of 2026, in other words, “we have 14 days” is simply wrong for tens of millions of people, and a denial letter that only says “not medically necessary” is thinner than the rule allows.

Request type	Who it applies to	Decision deadline	Notes
Standard — CMS-regulated plans	Medicare Advantage, Medicaid/CHIP managed care, federal marketplace plans	7 calendar days	Effective for plan years starting in 2026
Expedited — CMS-regulated plans	Same plans as above	72 hours	When a delay could seriously jeopardize health
Standard pre-service — employer plans	ERISA-governed employer coverage	Generally 15 days	One extension possible with notice; state law may be stricter for fully insured plans
Urgent pre-service — employer plans	ERISA-governed employer coverage	72 hours	Urgency judged by a prudent-layperson standard or your doctor’s say-so
Concurrent (ongoing care)	Most plan types	Often 24 hours for urgent continued-stay requests	Extending care already underway

Timelines here are illustrative summaries of federal frameworks as of 2026; some states impose faster clocks, and your plan documents control the details. Two practical points. If your situation is urgent, say the word “expedited” explicitly and have your doctor say it too — the fast clock generally starts only when the request is flagged that way. And if a deadline passes with no answer, ask for the status in writing; a blown deadline is a fact you can cite in a complaint to your state insurance department.

What an Approval Actually Promises — and What It Doesn’t

An authorization number feels like a guarantee. It is not one, and plans say so in the fine print of the approval letter itself. Payment requires three separate things to line up:

• The authorization — for the right codes, right provider, right facility, right dates.
• Network status — everyone who bills separately (surgeon, facility, anesthesiologist, radiologist, pathologist) is in-network, or protected by surprise-billing rules if not.
• A covered benefit — the service exists in your plan, you were still enrolled on the date of service, and no benefit limit was hit.

An auth checks only the first box. If your coverage terminated the week before surgery, the approval means nothing. If the approved facility’s radiology group is out-of-network, the facility claim can pay while the professional claim does not. And you still owe your deductible and coinsurance on approved care — approval decides whether the plan pays its share, not how much your share is. If a gap appears between what was authorized and what got paid, our walkthrough of what to do when a health insurance claim is denied covers that road in detail.

When the Answer Is No

A pre-service denial is not the end of the request. It is the start of a sequence.

• Read the letter for the actual reason. “Not medically necessary,” “insufficient documentation,” and “step therapy required first” are different problems with different fixes. Under the 2026 CMS rule, regulated plans must state a specific reason.
• Ask for the criteria. You are entitled to the clinical criteria the plan applied. An appeal that answers the plan’s own checklist point by point is a different animal from a letter that says the doctor disagrees.
• Peer-to-peer first. Fast, informal, and it reverses a real share of denials — particularly ones caused by missing context.
• Then the formal appeal path. Internal appeal, then external review by an independent review organization (IRO) whose decision binds the plan. The mechanics and deadlines live in the claim-denial article linked above. The federal overview of appeal rights is at HHS.gov, and Medicare’s own process is at Medicare.gov.

One timing note: pre-service appeals move on the faster pre-service clocks, and truly urgent cases can run internal and external review at the same time.

Emergencies and Retroactive Authorization

Plans cannot require approval before emergency care. The prudent-layperson standard protects the decision to go to the ER, and federal law adds billing protections for emergency services even out-of-network — covered in our plain-English guide to No Surprises Act protections.

What plans do require is notification. If an emergency turns into an inpatient admission, most plans want to be told within 24 to 48 hours, and coverage after stabilization runs through concurrent review. When care had to happen before anyone could ask — a weekend admission, a procedure change mid-surgery — the fix is retroactive authorization: the provider submits the clinical justification after the fact, within a window the plan defines (often 14 to 90 days). If a bill for emergency-origin care carries an authorization-related denial code, do not pay it reflexively. Ask the provider whether a retro-auth was submitted, and the plan whether one was received. This is routinely fixable and routinely not fixed because nobody asks.

Gold Carding, Briefly

A growing number of states and plans run “gold card” programs: providers whose requests are approved at a very high rate — commonly 90 percent or more over a look-back period — earn an exemption from filing them for certain services. For you the effect is mostly invisible, except that things move faster. Gold-carding does not remove your verification step, though; the service still generates a claim, and the other two legs of the payment stool — network status and covered benefit — still have to hold.

Where People Get Tripped Up

Denials for medical necessity get the headlines, but most of the money patients lose to this process leaks out through four administrative mismatches.

• The expired window. The approval was valid for 60 days; the surgery got rescheduled to day 74. Nobody re-upped the auth, and the claim denies even though the identical service was approved. Whenever a date moves, the office must extend or reissue the authorization first.
• The wrong code. The request said CPT 73721 (MRI lower extremity without contrast) and the radiologist performed the with-contrast version, or the surgeon converted the procedure mid-operation. The claim code no longer matches the authorized code. Offices can usually amend the auth — before the claim is filed is the cheap moment; after, it becomes an appeal.
• Facility versus professional mismatch. Hospital services often generate two auth tracks and two claims: the facility’s and the professionals’. An approval naming the hospital does not automatically cover the surgeon’s separate claim, or vice versa. When you verify, ask whether the authorization covers both.
• The out-of-network performer. The authorization is real, but the provider who performs the service is not in-network — a different surgeon covers the case, or the reading radiologist is non-participating. The auth stands; the network problem creates a new one. Surprise-billing rules limit some of this exposure at in-network facilities, but the cleanest protection is asking, before the date of service, whether every billing provider is in-network.

Notice the common thread: none of these are disagreements about whether you needed the care. They are paperwork geometry, and paperwork geometry is fixable — best before the appointment rather than after the bill.

A Worked Example (Illustrative Composite, Not a Real Person)

The following is a fictional composite built to show the mechanics. It does not describe any real person, plan, or facility, and the numbers are illustrative.

Marcus, 46, has an employer PPO with a $2,000 deductible and 20% coinsurance. In March his doctor orders a lumbar MRI after eight weeks of documented physical therapy. The office submits the request; the plan approves it in five days, valid April 1 through May 31, for CPT 72148 at a named imaging center.

Life intervenes. Marcus postpones twice and has the scan on June 9 — nine days after the window closed. In July the EOB lands: plan paid $0, remark code for no valid authorization on the date of service, patient responsibility $1,480 at the center’s billed rate.

What he does, in order. First, he calls the imaging center’s billing office with one question: “The plan approved this scan; the date slipped past the window. Will you submit a date-extension or retroactive request?” The center — which wants the plan’s payment far more than it wants to chase Marcus — agrees to refile. Second, he calls the plan, confirms the original approval is on record, and has the representative document that a provider date-extension request is the standard route. Third, he sends the center a portal message summarizing both calls, creating a paper trail.

Three weeks later a corrected authorization posts, the claim reprocesses, and the EOB shows the contracted rate of $640, applied to his deductible. Marcus still pays $640 — the deductible was always going to be his — but not $1,480, and the amount now counts toward his out-of-pocket maximum. Had the refile been refused, his next moves would have been a formal appeal citing the original approval, then a state insurance department complaint. He never needed them, which is the usual ending when the care was already approved once.

Your Pre-Service Checklist

Run this before any scheduled imaging, surgery, specialty medication, equipment order, or home-health start. Ten minutes, in writing.

• [ ] Ask the ordering office: does this need approval, and who is submitting the request?
• [ ] Ask the plan: is an authorization on file? Get the auth number, approved codes, provider and facility, and date range.
• [ ] Ask whether the approval covers both the facility claim and the professional claim.
• [ ] Confirm every provider who bills separately is in-network — surgeon, facility, anesthesia, radiology, pathology.
• [ ] If the appointment date changes, confirm the authorization window still covers it before you go.
• [ ] Ask who amends the auth, and how fast, if the procedure changes on the day.
• [ ] For medications: ask whether step therapy applies and whether your prescriber documented the failed alternatives.
• [ ] If your coverage is changing, confirm you will still be enrolled on the date of service — an approval from a plan you have left is worthless. Weighing continuation coverage between jobs? Our breakdown of what COBRA continuation coverage really costs can help.
• [ ] Keep one folder — auth letters, EOBs, call notes with dates and names. Every dispute in this article is won with it.

Free Help That Is Not Selling Anything

Everything below is free, and none of it is selling a plan or a service.

• Your plan’s member services line. Two scripts do most of the work: “Is there an authorization on file for [service] on [date], and can you read me the approved codes, provider, and date range?” and “This request is urgent — please flag it for expedited review.”
• The ordering provider’s office. The prior-auth coordinator or surgery scheduler files these all day. Ask for that person by role.
• Your state Department of Insurance (DOI). Takes complaints about state-regulated plans, including blown deadlines, and a complaint routinely gets a stalled request moving.
• State Consumer Assistance Programs (CAPs). Federally seeded programs in many states that help with denials and appeals at no charge.
• Medicare and Medicaid channels. 1-800-MEDICARE and State Health Insurance Assistance Programs (SHIPs) for Medicare; your state Medicaid agency or managed-care ombudsman for Medicaid.
• Hospital financial counselors. If an authorization failure has already become a bill you cannot pay, hospital charity care programs exist by law at nonprofit hospitals and are badly underused.

Frequently Asked Questions

What is prior authorization in health insurance?

A plan requirement that certain services, drugs, or equipment be approved before you receive them, as a condition of the plan paying. It is a form of utilization review: the plan checks the request against its medical necessity criteria before the money is spent.

Is an authorization the same as a referral?

No. A referral is your primary care doctor directing you to a specialist, required by some plan designs (mainly HMOs). An authorization is the plan itself approving a specific service. Satisfying one never automatically satisfies the other.

How long does a decision take?

Under the CMS rule effective for 2026 plan years, Medicare Advantage, Medicaid managed care, and federal marketplace plans must decide standard requests within 7 calendar days and expedited ones within 72 hours. Employer plans generally run on the ERISA clock: about 15 days standard, 72 hours urgent.

Does an approval mean my insurance will definitely pay?

No, and approval letters say so. Payment also requires that you are still enrolled on the date of service, the service is a covered benefit, and the billing providers are in-network or protected by surprise-billing rules. Approved care still runs through your deductible and coinsurance.

What happens if I get the service without the required approval?

The claim will usually deny. For in-network care, many plan-provider contracts make a missed auth the provider’s problem, not yours — the provider may have to write it off or pursue a retroactive request. Do not simply pay an auth-related denial; ask the provider what they are doing to fix it.

Can an authorization expire before I use it?

Yes. Approvals carry a validity window, commonly 30 to 90 days. If your procedure gets rescheduled past it, the office needs to extend or reissue the approval before the new date, or the claim will deny despite the earlier yes.

What is a peer-to-peer review?

A phone conversation between your ordering doctor and the plan’s physician reviewer, usually offered around the time of a denial. It is the fastest lever after a no, and a real share of denials get reversed there.

What is step therapy and how does it relate?

Step therapy — sometimes called fail-first — is a condition attached to many drug approvals: the plan wants documentation that you tried a cheaper alternative first. Your prescriber documenting the earlier trials, and why they failed or are inappropriate, is what moves the request through.

Does Medicare have prior authorization?

Original Medicare uses it sparingly — a defined list of items, certain DME and some hospital outpatient procedures among them. Medicare Advantage plans use it broadly, one of the most practical differences between the two, and those plans are squarely covered by the 2026 turnaround and transparency rules.

Where do I complain if the plan misses its deadline?

Your state Department of Insurance for state-regulated plans, 1-800-MEDICARE for Medicare Advantage, or the Department of Labor’s benefits advisors for employer plans. A documented blown deadline is one of the easier complaints to make stick.

Final Thoughts

Prior authorization sits between you and a large share of scheduled medical care, and the honest summary is this: the approvals usually come through, and the disasters are mostly logistical — the auth nobody filed, the window nobody re-checked, the second claim nobody matched to the first. All of them have the same antidote. Before any scheduled service, call your plan, get the authorization number and its boundaries, and write them down. You will feel slightly paranoid doing it. Do it anyway. The person who verified is the person the system cannot surprise.

This article is for general informational purposes only and does not constitute medical, legal, insurance, or financial advice. It is not an evaluation of any individual claim or bill. Health coverage rules, appeal rights, billing protections, and assistance programs vary by plan, by state, and by individual circumstance, and they change over time. This site is independently operated. It is not an insurance company, broker, or advisor, a healthcare provider, a law firm, a government agency, or an advocacy organization, and it does not represent anyone. Reading this article creates no professional relationship of any kind. Always confirm current requirements with your plan documents, a licensed professional in your state, or the official government sources cited above before making any decision.