Prior Authorization for Medical Services: Process and Requirements

Prior authorization — the requirement that a patient's physician obtain insurer approval before delivering certain services — sits at one of the most consequential intersections in American healthcare: between clinical judgment and coverage decisions. This page examines how the process is structured, what triggers it, and where the rules governing it come from. The stakes are concrete: delays or denials affect whether a patient receives an MRI, a specialty drug, or a surgical referral on the timeline their condition demands.

Definition and scope

Prior authorization (PA), sometimes called pre-authorization or pre-certification, is a utilization management tool through which health plans verify medical necessity before agreeing to cover a specific service, procedure, or prescription. It is not a clinical veto — the physician retains the right to recommend treatment — but it is a financial gatekeeping mechanism that can determine whether the plan will pay.

The scope of PA requirements is broad and largely insurer-defined, though regulatory floors exist. Under the Affordable Care Act (ACA), insurers in the individual and small-group markets must cover a defined set of essential health benefits, but PA can still apply to how and from whom those benefits are accessed. Medicare Advantage plans are governed by 42 CFR Part 422, which requires that PA criteria be based on clinical evidence and that decisions not be made "arbitrarily." Medicaid PA rules are set at the state level within federal parameters established by the Centers for Medicare & Medicaid Services (CMS).

The National Alliance on Mental Illness (NAMI) has documented that PA requirements disproportionately affect mental health and substance use disorder services — a pattern that intersects with the Mental Health Parity and Addiction Equity Act (MHPAEA), which prohibits more restrictive PA criteria for behavioral health than for comparable medical or surgical services.

For a broader view of how regulatory requirements shape access across service categories, the regulatory context for medical services provides a useful parallel frame.

How it works

The prior authorization process follows a recognizable sequence, though timelines and documentation requirements vary considerably across payers.

  1. Identification — The ordering provider or their administrative staff identifies that a planned service appears on the insurer's PA-required list.
  2. Submission — A request is submitted to the insurer, typically including clinical notes, diagnosis codes (ICD-10), procedure codes (CPT), and documentation of medical necessity. Requests may be submitted by phone, fax, or — increasingly — through electronic portals.
  3. Review — The insurer assigns a medical reviewer, often a nurse reviewer for initial screening and a physician reviewer for complex or borderline cases.
  4. Decision — The insurer issues an approval, denial, or request for additional information. For urgent requests, federal Medicaid rules require a decision within 3 business days (42 CFR § 438.210); for standard requests, up to 14 calendar days is permitted.
  5. Appeal — If denied, the provider or patient may request an internal appeal, then an external independent review under state or federal law.

A 2022 report by the American Medical Association (AMA) found that physicians in their practice spend an average of 13 hours per week on PA-related work — a figure that has driven significant federal legislative attention, including the proposed Improving Seniors' Timely Access to Care Act.

Common scenarios

Prior authorization is not uniformly required across all services. Payers typically concentrate PA requirements on higher-cost or higher-variability categories.

Specialty pharmaceuticals represent one of the most common PA triggers. Biologics, brand-name drugs with available generics, and medications requiring step therapy protocols (where the patient must try a less expensive drug first) routinely require PA.

Imaging services — particularly MRI, CT, and PET scans — are flagged for PA by most major commercial plans when ordered outside an emergency context. The rationale is reduction of unnecessary imaging; the practical effect is often a delay of days to weeks.

Specialty referrals — including referrals to orthopedics, neurology, and oncology — may require PA under plans using a gatekeeper model, particularly HMOs and certain Medicaid managed care organizations.

Inpatient admissions and surgical procedures frequently trigger PA, especially for elective procedures. The contrast with emergency care is significant: services provided in a genuine emergency are generally exempt from prospective PA requirements under federal law, though retrospective review may still occur.

The insurance coverage for medical services landscape across these categories is detailed in the broader site index.

Decision boundaries

Understanding where PA approval ends and denial begins requires reading the insurer's own coverage criteria, which must be disclosed upon request under ERISA § 503 for employer-sponsored plans. Insurers typically apply clinical criteria from organizations such as InterQual or MCG Health — both of which publish proprietary evidence-based guidelines that payers license and adopt.

A denial is not the end of the road. The ACA established the right to an internal appeal followed by an external independent review for most non-grandfathered commercial plans. For Medicare Advantage, the process runs through the Office of Medicare Hearings and Appeals (OMHA). For Medicaid, state fair hearing processes apply.

The critical distinction in most PA disputes is between medical necessity (does the patient need this service?) and coverage design (does the plan cover this service at all?). A denial on medical necessity grounds is appealable with clinical documentation; a denial based on coverage exclusion generally requires a different legal avenue.

References