How Prior Authorization Works and Which Treatments Require It

Why Prior Authorization Exists — and Who It Actually Serves

Insurance companies introduced prior authorization as a cost-control mechanism. The stated rationale is clinical: by reviewing whether a treatment is medically necessary before it's delivered, insurers aim to prevent unnecessary procedures, steer patients toward evidence-based care, and reduce wasteful spending. In theory, this protects both payers and patients.

In practice, prior authorization creates a significant administrative burden for providers and delays for patients. A 2023 survey by the American Medical Association found that 94% of physicians reported prior authorization caused delays in patient care, and 33% said it led to a serious adverse event for a patient. Those numbers reflect a system that, while intended to gatekeep appropriately, frequently does so in ways that interrupt necessary care.

Understanding the system doesn't mean accepting its friction uncritically — it means knowing how to navigate it effectively. Whether your insurer is an HMO with comprehensive managed care protocols or a PPO with selective authorization requirements, the rules operate similarly. If you're weighing plan types, our guide on choosing between an HMO and a PPO explains how prior authorization frequency differs across plan structures.

How the Prior Authorization Process Works, Step by Step

Prior authorization follows a largely consistent sequence regardless of your insurer, though timelines and documentation requirements vary. Here is how the process typically unfolds:

1. Your provider identifies a service that requires authorization. When your doctor orders a procedure, specialist visit, medication, or imaging study, their billing department checks your insurer's requirements. Many providers use automated tools to flag prior auth requirements, but errors and omissions happen.
2. The provider submits a prior authorization request. This includes clinical documentation: diagnosis codes, treatment rationale, relevant test results, and the specific service codes (CPT codes) being requested. The more complete this submission, the fewer delays.
3. The insurer reviews the request. A clinical reviewer — often a nurse or pharmacist — evaluates whether the service meets the plan's medical necessity criteria. Complex or expensive requests may escalate to a physician reviewer. Insurers are increasingly using automated algorithms at this stage.
4. The insurer issues a decision. You and your provider receive one of three outcomes: approval, denial, or a request for additional information (sometimes called a peer-to-peer request, where the insurer's reviewer speaks directly with your doctor).
5. Care proceeds or an appeal is initiated. If approved, you can schedule or proceed with the service. If denied, your provider can request a peer-to-peer review, or you can formally appeal the decision.

One critical point: approval has an expiration. Prior authorizations are time-limited, often 30 to 90 days. If your procedure gets delayed past the authorization window, your provider must request a renewal. Always confirm the authorization is still active before your appointment.

Which Services Most Commonly Require Prior Authorization

Not every healthcare service triggers a prior authorization requirement. Routine office visits, standard blood tests, and preventive screenings covered under the Affordable Care Act typically do not. But a wide range of non-routine services almost always require advance approval. Below are the categories most frequently subject to prior authorization:

Prescription Drugs

Specialty medications — particularly biologics used for autoimmune conditions, cancer, and rare diseases — are among the most heavily scrutinized. Many insurers also require prior authorization for brand-name drugs when a generic equivalent is available (called a step therapy requirement, meaning you must try and fail the lower-cost option first). Opioids above certain dosages and certain psychiatric medications also commonly require authorization.

Elective or Non-Emergency Surgeries

Procedures categorized as elective — joint replacements, spinal surgeries, bariatric surgery, hernia repairs — almost universally require prior authorization. This is true even when the clinical need is clear. Your surgeon's office will typically initiate the request, but confirm they have done so and that approval is confirmed in writing before your procedure date.

Advanced Imaging

MRI scans, CT scans, and PET scans are expensive diagnostic tools that most insurers require prior authorization for, even when ordered by a specialist. Standard X-rays and ultrasounds are less commonly gated but can be depending on your plan.

Mental Health and Substance Use Treatment

Inpatient psychiatric admissions, intensive outpatient programs (IOP), and residential substance use treatment facilities nearly always require prior authorization. Under the Mental Health Parity and Addiction Equity Act, insurers must apply the same prior auth standards to mental health care as they do to comparable medical/surgical care — but enforcement remains inconsistent, and patients should document any disparities they observe.

Durable Medical Equipment (DME)

Items like CPAP machines, power wheelchairs, prosthetic limbs, and insulin pumps require prior authorization. Insurers want clinical documentation demonstrating medical necessity before agreeing to cover equipment that may represent a large one-time cost.

Out-of-Network Care

If your plan covers out-of-network providers at a reduced rate, prior authorization is almost always required for out-of-network specialist visits, facilities, or procedures. Without it, the insurer may decline to pay at any level. See our article on verifying whether your doctors are in-network to understand how network status intersects with authorization requirements.

When Prior Authorization Is Not Required

Federal law provides important carve-outs from prior authorization requirements. Knowing these protections helps you recognize when an insurer may be overstepping.

Emergency Care

Under federal law and most state laws, health insurers cannot require prior authorization for emergency medical care. If you present to any emergency room with a genuine emergency, your insurer must cover care based on a prudent layperson standard — meaning coverage is determined by whether a reasonable person with average health knowledge would believe the symptoms required emergency treatment, not by the final diagnosis.

ACA-Mandated Preventive Services

Plans subject to the Affordable Care Act must cover a set of preventive services — including recommended vaccinations, cancer screenings, and annual wellness visits — without cost-sharing and without prior authorization. These services are protected under the ACA's essential health benefits framework.

Continuity of Care During Plan Transitions

Some states require insurers to provide a transition period — typically 30 to 90 days — during which prior authorization requirements are relaxed for ongoing treatments when a patient switches plans. This is particularly relevant for patients on specialty medications or in the middle of a treatment course.

Emergency and urgent care situations aside, the best protection against prior authorization surprises is proactive verification. Our coverage verification checklist walks you through exactly what to confirm before any scheduled procedure.

What to Do When Prior Authorization Is Denied

A denial is not the end of the road. Federal law under the Employee Retirement Income Security Act (ERISA) and the ACA gives you structured rights to appeal. Understanding how to use those rights effectively is one of the most valuable things you can do as a patient.

Step 1: Understand the Denial Reason

Your insurer must provide a written explanation of the denial, including the clinical criteria used and the specific reason your request did not meet them. Read this carefully — denial reasons often fall into categories like not medically necessary, experimental or investigational, step therapy not completed, or administrative error (such as missing documentation). The denial reason dictates your appeal strategy.

Step 2: Request a Peer-to-Peer Review

Before filing a formal appeal, your treating physician can request a direct conversation with the insurer's medical reviewer. This peer-to-peer call frequently results in overturned denials, particularly when the reviewing clinician lacks your doctor's specialty expertise. This step is worth attempting before the formal appeals process, as it is faster.

Step 3: File an Internal Appeal

Submit a formal written appeal to your insurer with supporting documentation: clinical notes, published guidelines supporting the treatment, letters of medical necessity from your physician, and any peer-reviewed literature. Most plans give you 180 days from the denial notice to file an internal appeal. The insurer must respond within 30 days for non-urgent requests, or 72 hours for urgent ones.

Step 4: Request an External Review

If your internal appeal is denied, you can request an external review conducted by an independent organization — not affiliated with your insurer. This reviewer's decision is binding on the insurer. Studies consistently show external review results in insurer overturns roughly 40–50% of the time, meaning it is absolutely worth pursuing.

“The external review process is one of the most underused consumer rights in health insurance. Patients who pursue it win roughly half the time, yet the vast majority of denied patients never file an external appeal.”

— Karen Pollitz, Senior Fellow, Health Policy, Kaiser Family Foundation

Keep meticulous records throughout this process: timestamps on every call, names of representatives you speak with, and copies of every document submitted and received. Your insurer's cost-sharing structure — including how prior auth affects what you ultimately pay — is also worth understanding in detail. The premiums and deductibles hub explains how these costs interact with coverage decisions.

State Laws and Employer Plan Differences That Affect Your Rights

One reason prior authorization rules can feel confusing is that they operate under multiple overlapping regulatory frameworks, and the rules that apply to you depend on how your insurance is structured.

State-Regulated Plans

If you purchased your insurance on your state's ACA marketplace or directly from an insurer (and it is not an employer plan), it is regulated by your state's insurance department. Many states have enacted prior authorization reform laws in recent years — requiring faster turnaround times, mandating gold-carding (exempting physicians with strong approval track records from routine prior auth), or limiting step therapy requirements. California, Texas, and New York, among others, have passed meaningful prior auth reform legislation.

Self-Insured Employer Plans (ERISA Plans)

If your employer self-insures — meaning the company itself bears the insurance risk and uses an insurer only to administer claims — your plan is governed by federal ERISA law, not your state's insurance regulations. This means state-level prior authorization protections generally do not apply to you. Approximately 65% of covered workers in the U.S. are enrolled in self-insured plans, so this is not a minor exception.

Medicare and Medicaid

Traditional Medicare (Parts A and B) uses prior authorization for a limited set of services, including some DME and certain outpatient procedures. Medicare Advantage plans — private plans that replace traditional Medicare — use prior authorization much more broadly, and have drawn significant regulatory scrutiny. Medicaid programs vary by state and by whether the enrollee is in managed care; managed Medicaid plans use prior authorization extensively.

Regardless of your plan type, understanding whether your insurer is state-regulated or federally governed under ERISA shapes what remedies are available to you when a dispute arises. If you are exploring how your plan type affects care access overall, see the HMO vs PPO comparison hub for a structured breakdown.

Practical Steps to Avoid Prior Authorization Delays

The best strategy is proactive rather than reactive. Most prior authorization problems are predictable and preventable with the right habits before a procedure or new treatment begins.

• Call your insurer first. Before scheduling any non-routine procedure, call the member services number on your insurance card and ask directly: does this service (provide the CPT code your doctor gave you) require prior authorization under my plan? Get the representative's name and note the date.
• Confirm your provider has submitted the request. Do not assume — call your provider's billing or authorization department 3–5 business days after your appointment to confirm submission and ask for the reference number.
• Follow up on the decision. Call your insurer to confirm the authorization was approved, note the authorization number, and verify the expiration date. Request written confirmation.
• Check timing carefully. If your procedure is rescheduled, verify that the authorization window still covers the new date. If not, request a renewal before the new appointment.
• Understand your formulary for medications. For new prescriptions, ask your pharmacist or insurer whether a prior authorization applies and what step therapy requirements exist before your first fill attempt.

Proactive verification is especially important for complex care situations. Our step-by-step pre-procedure checklist provides a downloadable framework for confirming all coverage details — including prior auth status — before any scheduled service.