The prior authorization process: A step-by-step workflow for practices

Key takeaways

Prior authorization is a payer’s approval to deliver a service, and without it the claim denies whatever the clinical merit.

Requirements are specific to the plan and the service code, so the eligibility check is where the requirement surfaces.

The workflow runs in five steps: identify the requirement, gather documentation, submit, track, then act on the determination.

For non-drug services, payers under the CMS interoperability rule answer standard requests within seven calendar days and expedited requests within 72 hours.

A denied authorization is appealable, and plans under the federal claims rules allow at least 180 days to file.

For your front desk, the prior authorization process is a five-step workflow. Check the requirement, document the need, submit the request, track it, then attach the approval to the claim.

Timing is what makes this hard. The requirement has to surface at booking, because a payer can take up to seven calendar days to answer a standard request.

The rest of this guide walks that workflow. It covers who checks the requirement, what each request needs, and how to act on the payer’s answer.

What prior authorization is, from the practice’s side

Prior authorization is a payer’s agreement to cover a service before you deliver it. Some plans call it precertification, preauthorization, or preapproval, and the mechanics are the same.

It sits at the front of revenue cycle management, so the framing that matters for a practice is financial rather than clinical. Deliver an auth-required service without the approval and the payer returns claim adjustment reason code 197, “precertification/authorization/notification/pre-treatment absent.”

That code arrives under the CO group, which marks the amount as a contractual obligation. The practice absorbs it, and the balance is not the patient’s to pay. Our guide to denial codes in medical billing covers how those codes read on a remittance.

Which services need an authorization is set by the plan, not by the procedure. The categories where payers apply it most consistently are familiar ones.

• Advanced imaging, including MRI, CT, and PET scans
• Elective surgical procedures and anything performed in a facility
• Specialty, injectable, and high-cost drugs, including weight-management medication
• Durable medical equipment and prosthetics
• Inpatient admissions, skilled nursing, and home health
• Some behavioral health, physical therapy, and sleep study services

Two plans from the same payer can treat the same code differently. That is why the requirement gets checked per plan and per service code, every time.

The prior authorization workflow, step by step

Five steps take a request from the schedule to a determination. The sixth job never really ends, because approvals expire.

1. Identify the requirement

The requirement surfaces at the eligibility check, before the appointment is confirmed. A benefit response tells you whether the plan is active and how it treats the specific service code you plan to bill.

Do this at booking rather than at check-in. A requirement found on the morning of the visit leaves you delaying the appointment or delivering at your own risk.

2. Gather the documentation

A request is a clinical argument with administrative details attached. The packet needs the order, notes that support medical necessity, relevant history, and the codes.

• The order or referral, with the ordering and rendering provider names and NPIs
• Clinical notes that state the diagnosis and why this service answers it
• CPT or HCPCS codes for every service you are asking about
• ICD-10 diagnosis codes that support the necessity argument
• Evidence of anything tried first, where the plan applies step therapy
• Requested units, visits, or dosage, plus the date range you need

Read the plan’s own criteria for the service before you write anything. Payers publish medical policies, and a request built against the stated criteria is harder to refuse.

3. Submit the request

Most requests go through the payer’s provider portal. Electronic submission is spreading, and fax is still alive at plenty of plans.

Whatever the channel, capture the reference number and the exact time you submitted. That timestamp is what a follow-up call is built on, and it starts the payer’s clock.

If the request is urgent, say so in the request itself and give the clinical reason. Expedited review is a category the payer assigns, not a tone of voice.

4. Track and follow up

Every open request needs a named owner and a follow-up date. Silence from a payer is not an answer, and nothing in the process chases itself.

Set the follow-up date inside the regulated ceiling rather than after it. If the answer is late, you want to be calling before the appointment, not explaining afterwards.

5. Act on the determination

A payer answers in one of three ways, and each one has its own next action.

• Approved. Record the authorization number, its valid-from and valid-to dates, and the approved units. Then get the number onto the claim.
• Pended. The payer wants something the submission did not carry. Send exactly what was asked for, same day where you can.
• Denied. An adverse determination arrives with an appeal window attached. Read the stated reason before you decide the route.

On an approval, the number belongs in item 23 of the CMS-1500, the prior authorization number field. It travels the same way on an electronic 837P claim.

An approval isn’t a guarantee of payment. It says the request met the plan’s criteria on the day the payer reviewed it. The claim still has to be clean and inside the plan’s timely filing limit.

6. Watch the expiry date

Authorizations carry a date range and a unit count, and both run out. An approval for March does nothing for an appointment that moved to April.

Reschedules are where approvals quietly die. Whoever moves the appointment needs to check the validity window at the same time, or the visit lands outside it.

How long prior authorizations take

Since January 1, 2026, payers covered by the CMS Interoperability and Prior Authorization final rule work to two ceilings for non-drug items and services. Expedited requests get 72 hours, and standard requests get seven calendar days.

That rule reaches Medicare Advantage organizations, Medicaid and CHIP fee-for-service programs and managed care plans, and qualified health plan issuers on the federally facilitated exchanges. It also requires a specific reason on every denial.

State law can be stricter, and your plan contract can be too. Michigan, for one, treats a request as granted when the insurer misses its deadline. That is 72 hours for an urgent request and seven calendar days for a standard one.

The ceilings describe the payer’s obligation, not your workload. In the American Medical Association’s 2025 physician survey, physicians reported completing an average of 39 prior authorizations a week.

The same survey put the cost at 13 hours of physician and staff time each week. Two in five physicians said they employ staff who do nothing else.

When a request stalls, escalate in order. Call and quote the reference number, then ask for the review status against the ceiling. After that, request a peer-to-peer review so your clinician can talk to theirs.

When the authorization is denied: The appeal path

Start with the stated reason, because it decides everything that follows. Payers covered by the CMS rule have to give you a specific one. The reason tells you whether this is a documentation problem or a coverage decision.

1. Classify the reason. Missing documentation, unmet criteria, a coding mismatch, and an eligibility problem all need different fixes.
2. Fix what was missing. If the notes did not carry the necessity argument, a letter of medical necessity from the treating clinician usually does.
3. Request a peer-to-peer review. Where the call is clinical, a conversation between two clinicians moves faster than paperwork.
4. File the formal appeal inside the window. Plans under the federal claims rules allow at least 180 days from the denial notice.
5. Diarize the decision deadline. Pre-service appeals get 30 days under those rules, and urgent care gets 72 hours.

One decision is worth making before any of this. Don’t deliver the service first and appeal afterwards, hoping the approval catches up.

A missing authorization comes back as a contractual write-off, which means you usually cannot bill the patient for it either. Our guide to denial management in healthcare sets out how those denials get worked and prevented.

Authorizations on the medical-necessity boundary

Practices whose services sit between cosmetic and medical feel prior authorization harder than anyone. Weight management, hormone therapy, and dermatology programs are where payers apply utilization management most aggressively.

The conditions attached are the part that catches teams out. In KFF’s 2025 employer survey, 34% of firms covering weight-loss drugs attached a condition beyond the drug itself. Enrollees had to see a dietitian or therapist, or join a lifestyle program.

Step therapy adds another layer. A plan can insist a cheaper option was tried and failed first, which means your documentation has to reach back further than this visit.

Three habits make this workable for a hybrid practice.

• Check auth status before the treatment plan is agreed, not after the patient has committed to a course of care.
• Keep documentation templates ready for the services you know need an argument, so the necessity case is not written from scratch each time.
• Have the coverage conversation early. A patient who knows their plan may not cover month three can decide how to proceed.

The self-pay path is a legitimate answer here. What damages trust is discovering the coverage limit halfway through a program the patient thought was covered.

How Pabau flags authorization requirements and carries them on the claim

Practice management software like Pabau will not submit a prior authorization request for you. What it does is make the requirement visible before the appointment, then keep the approval attached to the money.

Real-time eligibility checks run from the client card, through our Claim.MD integration. The response comes back as a full benefit report, including coverage by service code. An auth-required service shows up while there is still time to act on it.

The same integration sends claims as CMS-1500 or 837P files to thousands of US payers, with the authorization number on the claim. Nothing gets retyped into a second system on the way out.

When a payer denies anyway, the reason comes back with its CARC code on the claim’s activity history. A CO-197 lands on the claim record your team already works from, instead of a portal somebody checks on Fridays.

See coverage rules before the appointment is booked

Pabau runs real-time eligibility checks from the client card and returns coverage by service code, so authorization requirements surface early. Claims then go to thousands of US payers with the authorization number attached.

Book a demo

Conclusion

Prior authorization is won before the appointment. The practices that suffer are the ones who find the requirement after the service, when every remaining option is a worse one.

So put the effort at the front. One coverage check at booking, one owner per open request, and one place where authorization numbers and their expiry dates live.

The trade-off is honest enough. This work is unglamorous and it never stops, but it is cheaper than a write-off you cannot bill to anyone. Book a demo to see how Pabau surfaces coverage rules early and keeps authorization numbers on the claim.

Continue your research

Still working denials you could have prevented? Denial management in healthcare sets out the five-step process and the corrected claim versus appeal decision.

Need to read the code on the remittance? Denial codes in medical billing explains CARC 197 and the other codes that decide your next move.

Want the route your claim and its auth number travel? What is a medical claims clearinghouse? follows a claim from your system to the payer and back.

Want the claim to go out right the first time? What is a clean claim? covers the checks that stop a claim coming back at all.

Not in network with the plan yet? How to get credentialed with insurance companies covers the enrollment work that comes before any authorization.

Frequently asked questions