- The AMA's physician surveys put the prior authorization burden at about 13 hours a week per practice, and most physicians report that it delays care.
- Since January 2026, payers covered by CMS-0057-F must answer standard requests within 7 calendar days and expedited ones within 72 hours.
- From January 2027 those payers must offer a FHIR Prior Authorization API, so electronic requests can replace fax, phone and portals.
- The biggest win for a practice is catching the requirement at the moment of ordering, not after the denial.
Prior authorization is the step between a provider's decision and the patient's care where a payer must agree first. For practices it is one of the most time-consuming parts of the revenue cycle, and one where small process changes save hours every week.
The size of the problem
The American Medical Association surveys physicians about prior authorization every year. Its results are consistent: physicians and their staff spend about 13 hours a week on prior authorization, the large majority say it delays access to care, and 78% of physicians report that patients abandon a recommended treatment because of it.
For a billing team, prior authorization creates two kinds of cost. The first is the time spent on each request: finding out it is needed, gathering notes, filling in the payer’s form or portal, following up. The second is the denial when it is missed: the visit happened, the claim goes out, and it comes back unpaid.
Where the time goes today
| Step | Manual process | With automation |
|---|---|---|
| Finding out auth is needed | After the visit, or after a denial | Flagged when the service is ordered, from the patient's plan |
| Building the request | Re-typed from the chart into a portal or fax | Prepared from the signed note and history for staff to review |
| Sending it | Fax, phone or one portal per payer | Sent electronically and tracked in one place |
| Payer asks for more | Phone tag and missed messages | Request appears in the work queue with the chart attached |
| Knowing the status | Calling the payer | One list across all payers, with due dates |
| Using the approval | Number on a sticky note | Number, dates and visit count carried onto the claim |
The CMS prior authorization rule: two dates
The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), finalized in January 2024, applies to Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan issuers on the Federally Facilitated Exchanges.
- From January 1, 2026: impacted payers must send decisions within 72 hours for expedited (urgent) requests and 7 calendar days for standard requests, give a specific reason when they deny, and publicly report prior authorization metrics.
- From January 1, 2027: impacted payers must offer a Prior Authorization API built on HL7 FHIR, so an EHR can ask whether authorization is required, see what documentation the payer needs, and submit the request electronically. They must also share prior authorization information (other than for drugs) through their Patient Access API.
HHS also announced it will not enforce the older HIPAA transaction standard against covered entities that use an all-FHIR prior authorization API, which removes a long-standing obstacle to electronic requests.
The rule also adds an electronic prior authorization measure to the Promoting Interoperability category for MIPS clinicians. In practical terms: the payers you bill most are now on a clock, and electronic prior authorization is becoming the expected way to work.
What good prior authorization software does
When you evaluate an EHR or billing system, these are the capabilities that change the workload:
- It knows before the visit. Services that commonly need authorization are flagged when ordered, based on the patient’s plan, not discovered on the remittance.
- It builds the request from the chart. Diagnosis, prior treatments, test results and the note are pulled in automatically; staff review instead of retype.
- It tracks every request in one list, across payers, with due dates and the payer’s questions attached.
- It carries the approval onto the claim: authorization number, valid dates and remaining visits, with a warning before a visit is scheduled outside them.
- It is ready for payer APIs as they come online in 2027, so requests can move electronically instead of by fax.
Writing a clinical justification that gets approved
Most requests that are denied are not denied because the care is wrong, but because the request does not show the payer’s criteria were met. Before submitting, check the payer’s published criteria for the service and make sure the request answers each one:
- The diagnosis, stated specifically, with its code.
- Why this service, now: the symptoms, findings or results that make it necessary.
- What has already been tried, for how long and with what result. Many policies require a trial of a simpler treatment first.
- What will change with the result or the treatment, in one sentence.
- Supporting documents, labeled: the relevant note, results and imaging reports, not the whole chart.
When the answer is no
A denial of a prior authorization request is not final. The options, in the order most practices use them:
- Read the specific reason. Under the CMS rule, impacted payers must now give one. Often a missing document is all that stands between the denial and an approval.
- Ask for a peer-to-peer review. The ordering clinician speaks with the plan’s reviewing physician; many denials are reversed in this conversation when the clinical picture is explained.
- Resubmit with what was missing, if the reason was incomplete information.
- Appeal formally within the deadline in the plan’s provider manual when you disagree with the decision itself.
Record each step and its date on the request, so the patient’s care and the claim do not stall while the request is in limbo.
Gold carding and other relief
Some states have passed “gold card” laws that exempt clinicians with a strong record of approvals from prior authorization for certain services, and some payers run similar programs voluntarily. If your practice has a high approval rate for a service, ask your largest payers whether such a program applies; tracking your own approval history makes that conversation possible.
A simple playbook for this quarter
- List your top 20 services by volume and mark which payers require authorization for each.
- Make “authorization required?” part of ordering, not billing.
- Keep one shared list of open requests with due dates; review it daily.
- Track denials caused by missing authorization separately, and fix the step that let each one through.
- Ask your EHR vendor how they will use payer Prior Authorization APIs in 2027.
