Prior Authorization in Medical Billing: What It Is and How It Works

Prior authorization is permission, not payment.

Prior authorization (also called pre-authorization, pre-certification, or PA) is a health plan's approval of a specific service, test, procedure, or drug before it is provided. The plan reviews the request against its coverage rules and medical necessity criteria, then returns an approval with an authorization number, approved codes, and a date range, or a denial with a reason. CMS describes preauthorization as a process through which a request for provisional affirmation of coverage is submitted before the item or service is furnished, which is the formal way of saying the same thing: the payer gets to review the plan before the patient receives the care.

What prior authorization actually is

At its core, prior authorization is a coverage check that runs before the service instead of after it. The payer asks three questions: is this service covered under the patient's plan, is it medically necessary, and is there a cheaper option that would work as well. If the answers line up, the plan approves it and issues an authorization number. If they do not, it denies the request and says why.

The part most people miss is what the approval does not do. An approved authorization is not a promise of payment. The claim can still be denied if the patient's coverage ended between the approval and the visit, if the codes on the claim differ from what was approved, if the approval window expired, or if the plan's other rules were not met. That is why authorization checks and eligibility checks are done together: the auth says the payer agreed to the plan, and eligibility says the patient is still covered right now.

Why payers do it

Payers call prior authorization utilization management, which is their term for making sure the care they pay for is necessary and cost-effective. The intent is to catch unnecessary procedures, duplicate tests, and expensive treatments that have cheaper alternatives before the bill exists. Plans steer toward evidence-based care and alternatives like generic drugs or lower-cost diagnostic centers.

You can think of it as the payer doing its homework before agreeing to the expense, rather than arguing about it after the fact. Whether it works as intended for patients and practices is a separate argument. The 2024 numbers from the Kaiser Family Foundation give a sense of scale: Medicare Advantage insurers fully or partially denied 4.1 million prior authorization requests that year.

What typically requires prior authorization

Every plan keeps its own list, and the lists change during the year, so there is no universal catalog. But the same categories show up again and again:

• Diagnostic imaging: MRIs, CT scans, and other high-cost imaging.
• Specialty consultations: cardiology, neurology, oncology, and other specialist visits.
• Hospital admissions: inpatient stays for specific procedures or treatments.
• Certain medications: expensive drugs, drugs with side effects or abuse risk, drugs that interact badly with other drugs, and drugs with cheaper equivalents.
• Durable medical equipment: items like CPAP machines and nebulizers.

One important distinction: Traditional Medicare requires prior authorization only for selected services, while Medicare Advantage, Medicaid managed care, and commercial plans tend to use it much more widely. The requirements for any given patient come down to their specific plan, and the most reliable source is the plan's own published authorization list.

The prior authorization process, step by step

The process runs through the same six steps wherever you do it. Here is the whole path:

1. Verify eligibility and check whether the service needs authorization. The front desk or eligibility staff confirms the patient's coverage is active, then checks the plan's list to see whether the ordered service needs authorization. This check happens at scheduling, before anything else moves.

2. Gather clinical documentation. The ordering physician's office collects the notes, diagnosis codes, prior treatment history, and the medical necessity justification the payer will ask for. A common reason for an otherwise reasonable request to be denied is documentation that never quite makes the case.

3. Submit the request. The authorization specialist sends the request through the payer's portal, an electronic prior authorization (ePA) system, by phone, or by fax, depending on what the payer accepts. Keep a trail either way: the authorization number, the date and time of the call, the name of the authorizing representative, or a screenshot of the portal approval.

4. Track and follow up. After submission, someone monitors the request, answers the payer's requests for more documentation, and escalates urgent cases. Requests die quietly when nobody owns this step.

5. Receive the determination. The payer returns an approval (with the authorization number, approved codes or units, and a validity window) or a denial with a reason. Both belong in the record.

6. Hand off to billing. The billing team logs the authorization number against the service so it lands on the claim at submission. A missing or mistyped auth number turns an approved authorization into a denied claim.

Who is responsible for getting pre authorization

The ordering provider's office usually initiates the request. If a physician orders an MRI, the doctor's office makes the case to the payer with the clinical documentation. For hospital services, the facility's staff often handles the request instead. Either way, the submitter is the provider side, not the payer and not (usually) the patient.

The tracking work falls to front-office or billing staff. They are the ones on the payer portals and phone lines, checking statuses and logging authorization numbers. Practices that struggle with the volume sometimes hand this to their billing service, which can run authorizations by phone or through the portals like any in-house team.

Prescriptions are the exception. When a medication needs authorization, the pharmacist or the patient flags the requirement, and the prescriber's office submits the request. The patient doesn't build the clinical case. They're usually just the one who notices the prescription is stuck.

In practice, responsibility lives wherever the practice put it. The requests that fall apart are the ones nobody was clearly assigned. Practices that handle prior authorization well put one name on tracking and treat the authorization number like money, because functionally it is.

How long does prior authorization take

It depends on the payer, the service, and the submission method, and timelines vary too much to generalize precisely. A few patterns hold broadly:

• Urgent or expedited requests move faster than standard ones under payer and state rules. If the patient's health would be jeopardized by waiting, the practice can ask for expedited review.
• Portal and electronic submissions generally turn around faster than phone or fax requests, partly because the paperwork is structured and partly because nothing gets lost on hold.
• Medications often take the longest, especially when the payer wants several rounds of clinical documentation.

Submit early, submit through the payer's fastest channel, and do not let the request sit. The wait is shortest when the first submission is complete, because every round of "we need more documentation" restarts the clock.

Prior authorization vs referral

The two terms get used interchangeably, but they are different approvals from different parties. A referral is the primary care physician's written order sending the patient to a specialist. A prior authorization is the payer's approval for the service itself. HealthCare.gov defines a referral as a written order from a primary care physician asking the patient to see a specialist or get certain medical services. The authorization comes from the insurance plan.

One does not substitute for the other. A patient can have a valid referral and still need a prior authorization for the procedure the specialist orders, and an approved authorization does not satisfy a referral requirement.

When authorization goes wrong

Authorization failures tend to fall into a few groups. No request was made because nobody checked whether the service needed one. The approval covers a different code, provider, location, or date range than what was billed. The approved visit count ran out before the plan of care ended. The approval expired between the request and the date of service. Or the authorization number never made it onto the claim.

The painful part: a claim can be denied even when the service was medically necessary and the documentation is flawless, simply because the administrative trail broke down. A claim that arrives without a required authorization is usually denied with the payer's position that the service was never approved. These denials are hard to overturn because the payer is not disputing the care, it is disputing the process.

A few things worth knowing about the failure path:

• Retrospective authorization exists, but only where the payer permits it. It is an approval requested after the service was provided, and it is the exception, not the default.
• Denied requests can be appealed. The path depends on why the request was denied: correcting errors, submitting a new request, requesting reconsideration, or filing a formal appeal before the payer's deadline. For medical necessity denials, the treating physician can sometimes request a peer-to-peer review, a direct conversation with the payer's medical reviewer.
• Expired authorizations are not flexible. If the service happens outside the approved date window, the authorization does not cover it. Our breakdown of claim denials, their causes, and fixes covers what happens when these denials hit the claim side.

What practices do about the friction

The practices that keep prior authorization from becoming a daily fire drill do four boring things consistently:

1. Check requirements at scheduling, not at the visit. The authorization question gets answered when the appointment is booked.
2. Keep the payer lists current. Requirements change during the year. The plan's published list is the source of truth, and it gets checked, not assumed.
3. Log authorization numbers centrally. Every auth number goes into one shared log, tied to the service it covers, so the billing team has it ready when the claim goes out.
4. Put one person on tracking. Not a task everyone shares. One owner who follows every request to determination.

When the volume outgrows the staff, practices often hand the whole workflow to their billing operation, and that is one of the functions RCM outsourcing firms absorb. Prior authorization sits inside revenue cycle management at the front of the cycle: get the front end right and the back end has far less to fix.

Permission starts the claim. It doesn't pay it.