The Prior Authorization Process in 2026: Steps, Timelines, CMS Rules and How to Stop Auth Denials

Few tasks frustrate practices more than prior authorization. The patient is ready, the clinician has a plan, and then everything waits on a payer decision that can take days — or comes back denied because one document was missing.

In 2026, that process is changing. New federal requirements set clearer decision deadlines and denial explanations for many plans, and electronic authorization is becoming the expected route rather than the exception. Practices that understand the rules and track every request can cut delays significantly.

This guide explains the prior authorization process step by step, what the 2026 CMS rule does and does not cover, how long authorization typically takes, and how to avoid prior authorization denials before they happen.

What Is Prior Authorization in Medical Billing?

Prior authorization — also called pre-authorization or precertification — is approval obtained from a payer before a service is delivered, confirming that the service meets that plan's coverage and medical necessity criteria.

The practice submits clinical information, the plan reviews it against its policies, and it issues an approval, a denial, or a request for more information. An approval usually carries an authorization number, a validity date range, and limits on units or visits.

Authorization is most common where care is high-cost or frequently reviewed — including cardiology, pain management, gastroenterology, advanced imaging, and surgical procedures. Neximed Billing includes real-time eligibility checks and prior authorization verification before service in its billing workflow for practices across 30+ specialties.

What prior authorization is not

An approval is not a guarantee of payment.

A payer can authorize a service and still deny the claim if coverage lapsed, the billed codes do not match the authorized codes, the authorization expired, or the claim documentation does not support what was billed. Authorization, accurate coding, and valid coverage on the date of service must all line up.

It is also different from eligibility verification, which confirms active coverage and benefits, and from a referral, which is permission from another provider. A claim may need all three.

Which Services Commonly Need Prior Authorization?

Requirements vary by payer, plan, and employer group — there is no universal list. Practices most often need to check:

• Advanced imaging: MRI, CT, and PET scans
• Surgeries and procedures: Elective procedures, many orthopaedic and sports medicine procedures, and pain management injections; endoscopy in some plans
• Specialty drugs and infusions: High-cost injectables and infusions, often with step-therapy requirements
• Durable medical equipment: Power wheelchairs, hospital beds, continuous glucose monitors, and other higher-cost items
• Therapy services: Physical, occupational, and speech therapy, often after an initial number of visits
• Behavioral health: Inpatient treatment, intensive outpatient programs, and psychological testing
• Hospital admissions: Inpatient stays, skilled nursing, rehabilitation, and home health

Plans revise these lists regularly. A service that needed no authorization in January may need one by July — never rely on memory.

The Prior Authorization Process, Step by Step

1. Verify eligibility and benefits

Confirm active coverage, the correct payer and plan, and whether the rendering provider is in network. Starting an authorization for the wrong plan wastes the whole effort.

2. Determine whether authorization is required

Check the payer's current requirements for the exact procedure codes, diagnosis, place of service, and plan type. Document who confirmed the requirement — or that none was needed — and when.

3. Gather documentation supporting medical necessity

Assemble progress notes, relevant imaging or lab results, prior conservative treatment and its outcome, and the clinical rationale. Reviewers approve what the documentation proves, not what the practice knows to be true. This step is where most delays begin.

4. Submit the request

Submit electronically where possible — through the payer portal or the HIPAA 278 transaction — and by fax only when a payer still requires it. Electronic submission creates a timestamped record and usually routes faster.

5. Record the reference number and track it

Log the submission date, method, reference or case number, and expected decision date, then follow up before that date passes. Untracked requests are the ones that sit unanswered while appointments slip.

6. Review the decision carefully

The payer will approve, deny, or ask for more information. Check approvals line by line: authorized codes, units, provider, facility, and validity dates must match what was requested. A mismatched approval is a future denial if no one catches it.

7. Use peer-to-peer review when offered

If a request is denied or pended, the ordering clinician may be offered a peer-to-peer conversation with a payer medical reviewer. It is often the fastest route to overturn a denial based on incomplete information, but the window is short — prepare the clinical summary in advance.

8. Include the authorization number on the claim

Bill only what was authorized and submit promptly. Neximed's workflow submits claims within 24 hours, which helps keep billing inside the authorization's validity window. Its full workflow is described in its medical billing services.

The 2026 CMS Rule: What Changed on January 1, 2026

The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) introduced requirements applying from January 1, 2026, to impacted payers: Medicare Advantage organizations, Medicaid and CHIP fee-for-service programs and managed care plans, and Qualified Health Plan issuers on the Federally Facilitated Exchanges.

The key changes for practices:

• Standard decisions within 7 calendar days for non-urgent requests
• Expedited decisions within 72 hours for urgent requests
• A specific reason for every denial, so practices know exactly what to correct, supply, or appeal
• Public reporting of prior authorization metrics — approvals, denials, appeals, and average decision times — which practices can use when advising patients and evaluating plan participation

What the rule does not cover

The rule is narrower than many headlines suggest. It does not apply to every commercial plan — plans outside the impacted categories are not bound by these requirements, though some follow similar practices voluntarily or under state law. It also does not cover drugs in the same way it covers medical services and items. Always check the specific plan's rules rather than assuming the CMS deadlines apply.

What arrives in 2027 — and what to do now

From January 1, 2027, impacted payers must operate FHIR-based APIs, including a dedicated Prior Authorization API, alongside Patient Access, Provider Access, and Payer-to-Payer APIs. Practices should act now: ask high-volume payers how they are implementing electronic prior authorization, favor electronic submission over fax wherever supported, and confirm your systems will be able to connect. Teams already submitting and tracking electronically will have a far smoother transition.

How Long Does Prior Authorization Take?

The ranges below reflect typical practice experience, not guarantees, and vary widely by payer. The biggest factor a practice controls is submission quality: a complete request is usually decided on first review, while an incomplete one restarts the clock with every information request.

For impacted payers, the 2026 CMS deadlines now cap standard and expedited times. Other plans may follow state rules or contract terms.

The human cost is real. In the AMA prior authorization physician survey, physicians consistently report that authorization delays disrupt care and cause patients to abandon recommended treatment. That is why this is clinical workflow, not just paperwork.

Why Authorizations Get Delayed or Denied

Most prior authorization denials are preventable. Common causes include:

• Missing or thin documentation that does not show medical necessity or prior conservative treatment
• Wrong codes, or procedure, diagnosis, provider, or facility details that do not match the plan's records
• No authorization obtained, because the team assumed a familiar service did not need one
• Expired authorizations after a service was rescheduled, with no extension requested
• Step-therapy or site-of-care rules not addressed in the first submission
• Untracked requests where no one owned follow-up
• Eligibility problems — terminated coverage or a different primary payer — discovered too late

How to Avoid Prior Authorization Denials: A Practical Checklist

This prior authorization checklist for medical practices builds a system that does not depend on memory:

Denied? Appeal or Peer-to-Peer?

Read the specific denial reason first — for impacted payers in 2026, it must now be stated clearly.

Choose peer-to-peer review when the denial rests on incomplete or misunderstood clinical information and the ordering clinician can explain the case directly. Act the same day; the window is short.

Choose a formal appeal when peer-to-peer is unavailable or unsuccessful, when the issue is policy interpretation, or when you have additional evidence — new results, specialist notes, or proof of failed alternatives. Neximed's team handles denial appeals, building each one around the payer's stated reason rather than resubmitting the same information. Keep the authorization number, denial letter, and submission records together: appeals are won on documentation.

Building Authorization Into Your Revenue Cycle

Authorization works best as a defined stage of your revenue cycle management: eligibility checked in real time, authorization verified before service, claims submitted within 24 hours, and denials appealed promptly. That is the workflow Neximed Billing — HIPAA compliant, with offices in Kalispell, Montana, and Portland, Oregon — follows for the practices it supports.

If delays are holding up schedules or denials are erasing earned revenue, the fix is usually process, not effort. Start with the checklist above and tighten the step that fails most often.

Frequently Asked Questions

External References

• CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) — Centers for Medicare & Medicaid Services
• AMA prior authorization physician survey — American Medical Association
• CAQH Index on electronic prior authorization adoption — CAQH