Prior authorization (PA) in medical billing is the process of obtaining approval from a payer before delivering a specific service, procedure, or medication so the claim qualifies for reimbursement.
The payer reviews clinical documentation, confirms medical necessity, and issues an authorization number that must appear on the claim. Without that number, the claim denies under CO-197 — regardless of how clinically appropriate the service was.
PA exists because payers use it as a utilization management tool. From the billing side, PA is the single most consequential upstream control in the revenue cycle — a missing or expired authorization converts a billable service into an unrecoverable write-off before the claim ever reaches adjudication.
In this guide, we’ll be exploring:
- Which services trigger PA most often
- Four types of authorization and when each applies
- The step-by-step PA workflow and where it breaks
- The five PA errors that cause the most revenue damage
- How to appeal a PA denial and when peer-to-peer review works
- How PA rules differ across Medicare Advantage, Medicaid, and commercial plans
How does the prior authorization process work?
The PA workflow runs parallel to the clinical workflow — it must start before the service is performed and complete before the claim is submitted. Missing any step produces a denial.
The authorization number
The PA reference number links the approval to the claim.
Without it, the payer’s adjudication system can’t verify the service was authorized — and the claim denies even when the PA was actually obtained.
Practices that obtain authorization but fail to include the number on the claim generate preventable CO-197 denials that require resubmission.
Expiration dates and unit limits
Authorizations carry valid date ranges and unit limits.
An authorization approved for 6 physical therapy visits over 90 days expires after 90 days — if the patient completes only 4 visits and returns after the window closes, visits 5 and 6 are no longer authorized.
Practices that don’t track expiration dates and remaining units bill against exhausted authorizations and absorb the denial.
In practice, the failure mode isn’t usually “nobody knew PA was needed.” The failure is that the authorization was obtained, but the reference number wasn’t attached to the claim, or the visits continued past the expiration date without anyone noticing.
What are the types of authorization in medical billing?
Four authorization types exist in medical billing — prior, concurrent, retroactive, and referral. Each has different timing rules, different documentation requirements, and different payer acceptance rates.
The operational difference between these types is timing.
Prior authorization must be completed before the service date. Concurrent authorization applies to ongoing cases where the payer reviews at intervals — missing a concurrent review deadline can terminate coverage mid-treatment.
Retroactive authorization is a last resort with limited payer acceptance, typically reserved for genuine emergencies.
Which services most commonly require PA?
PA requirements vary by payer and plan, but four service categories trigger authorization requests far more frequently than others — advanced imaging, specialty medications, elective procedures, and DME.
Advanced imaging
MRIs, CT scans, and PET scans are among the most PA-required services.
Payers verify that the ordering diagnosis justifies the modality — an MRI for acute low back pain without documented conservative treatment failure often denies at the PA stage because guidelines require 4-6 weeks of conservative care first.
Specialty medications
Biologics, oncology drugs (J-codes), infusion therapies, and non-formulary medications require PA under most plans.
Payers frequently enforce step therapy — the patient must try lower-cost alternatives first. Missing step therapy documentation produces a PA denial that clinical preference alone can’t override.
Elective procedures
Joint replacements, spinal surgeries, bariatric procedures, and interventional pain management carry PA requirements under most commercial plans and Medicare Advantage.
Clinical documentation must show conservative treatment failure, functional limitation, and defined surgical criteria.
Durable medical equipment
Power wheelchairs, oxygen therapy, CPAP machines, and hospital beds require PA under Medicare and most commercial plans.
DME carries additional documentation layers — Certificates of Medical Necessity, face-to-face encounter notes, and compliance data for items like CPAP.
How do PA rules differ across payer types?
The PA rules a practice must follow depend entirely on who the patient’s insurer is — and which specific plan within that carrier.
Treating Medicare Advantage, Medicaid MCO, and commercial PA requirements identically is a guaranteed source of denials.
Medicare Advantage
MA plans use PA more aggressively than Original Medicare.
Many services that need no authorization under traditional fee-for-service require PA under Medicare Advantage because the managed care plan applies its own utilization criteria. Practices serving both must maintain separate PA workflows — treating them identically produces denials on the MA side.
The AMA’s 2024 prior authorization survey found that 94% of physicians reported PA caused care delays and 33% reported it led to serious adverse events.
For Medicare Advantage patients specifically, the gap between Original Medicare’s limited PA requirements and MA plans’ broad requirements creates a compliance trap for practices that don’t distinguish between the two at the scheduling level.
Medicaid MCOs
PA rules vary by state and by MCO within the same state.
A service authorized by one Medicaid MCO may require different documentation from another MCO in the same state. Tracking PA requirements per plan, not just per state, is non-negotiable.
The operational burden compounds because Medicaid patients experience more frequent coverage changes than Medicare or commercial patients.
A patient enrolled in MCO-A last month may have switched to MCO-B — which has completely different PA requirements for the same CPT code. Verifying the patient’s current MCO assignment at scheduling and re-checking PA requirements against the current plan prevents the mismatch.
Commercial payers
Each maintains its own PA criteria, and those criteria change with annual plan updates.
A CPT code that required PA last year may not this year — and vice versa. Relying on last year’s rules without verification creates submission errors invisible until the claim denies.
For practices with high commercial volume, the real workflow question is whether PA verification happens at the point of scheduling (where there’s time to secure approval) or at the point of service (where there’s not).
Practices that check PA at scheduling catch 90%+ of authorization needs before the appointment. Practices that check at check-in catch some — and miss the rest.
What PA mistakes cause the most revenue damage?
Five PA errors account for the majority of authorization-related denials — and every single one is verifiable before the claim is submitted.
The service required authorization and it wasn’t obtained. Automatic CO-197 denial. Retro-auth success rates are low for non-emergent cases.
PA was obtained but the reference number wasn’t included on the claim. Payer can’t match the claim to the approval. Preventable resubmission required.
Service performed after the authorization’s valid date range. Payer treats it as unauthorized. New PA required before rescheduling.
The CPT code on the claim doesn’t match the code authorized. Even a related code that differs from the approved one triggers a denial.
Authorization approved 6 visits. Practice billed 8. Visits 7 and 8 deny. Must track remaining units and request extension before limits exhaust.
The financial impact goes beyond individual denials. A denied MRI at $500-$1,500, multiplied across dozens of missed authorizations per quarter, produces revenue leakage that dwarfs the cost of a dedicated PA position or outsourced PA service.
How do you appeal a PA denial?
PA denials follow a structured appeal process, and a significant percentage of initial denials are overturned when additional clinical evidence is submitted. The AMA reported 83.2% of appealed MA prior auth denials were overturned in 2022.
Identify the denial reason
The determination letter specifies why — missing documentation, medical necessity not met, non-covered service, or step therapy incomplete. The appeal strategy depends on which reason applies.
Submit additional evidence
For medical necessity denials, the appeal must include clinical documentation the initial submission lacked — imaging results, specialist notes, failed treatment history, or supporting literature. Generic appeals restating the original request without new information rarely overturn the denial.
Request peer-to-peer review
Many payers allow the ordering physician to speak directly with the payer’s medical director.
Peer-to-peer reviews are often more effective than written appeals because the physician can address specific objections in real time. Most payers require the peer-to-peer within 5-10 business days of the denial — missing the window forfeits the option.
File the formal appeal
Payer appeal deadlines range from 30 to 180 days. Filing after the deadline closes the appeal permanently. Include the original PA request, the denial determination, and all supporting clinical documentation.
The problem isn’t that denials can’t be overturned. The problem is that most practices don’t appeal because the operational burden of building the appeal exceeds the perceived value of a single claim.
How do you prevent PA-related denials?
PA denial prevention is a workflow problem, not a knowledge problem. Most billing teams know PA is required — denials happen because verification is skipped, authorizations expire untracked, or reference numbers aren’t linked to claims.
Verify at scheduling
Check PA requirements when the appointment is booked, not when the patient arrives. Catching the need before the visit gives days or weeks to secure approval. Catching it at check-in gives hours — often not enough.
Maintain payer-specific PA sheets
Update whenever the payer changes criteria.
Many practices discover a CPT code was added to a PA list only after the first denial, which means every patient seen in the gap between the policy change and the discovery was billed without authorization.
Track authorization status centrally
Expiration dates, remaining units, and approval status in a centralized system — not individual memory or scattered notes. When a therapy patient has 2 visits remaining on an 8-visit authorization, the team needs to see that before scheduling visit 9.
Link PA numbers automatically
The practice management system should attach the authorization number to the claim without manual intervention. Manual linking creates the most common PA submission error — PA was obtained, number wasn’t on the claim, claim denied anyway.
Build PA status into scheduling visibility
When the front desk can see whether a scheduled procedure has an active PA at the time of scheduling — not just at check-in — the practice catches gaps days or weeks before the appointment.
A scheduling system that flags “PA required, not yet obtained” gives the authorization team time to submit and receive approval.
A system that surfaces the gap at check-in gives them hours, which isn’t always enough for standard review timelines.
Separate PA tracking from general authorization notes
Practices that record PA status in free-text notes within the patient chart lose visibility at scale.
When 30 patients per week require PA across multiple payers, free-text notes don’t generate alerts, don’t track expiration dates, and don’t flag approaching unit limits.
A dedicated PA tracking queue — whether built into the PMS or maintained as a separate workflow — gives the team a daily view of pending requests, expiring authorizations, and approaching unit limits.
Every PA-related denial was preventable
Prior authorization is the billing step where prevention has the highest ROI.
Every PA denial represents revenue the practice already earned clinically but lost administratively. The gap between obtaining the authorization and getting the claim paid is where most PA revenue leaks.
MedHeave embeds authorization specialists into the billing workflow who verify PA requirements at scheduling, submit requests with clinical documentation, track approval status and expiration dates, and link authorization numbers to every claim before submission.
- PA verified and submitted for every applicable service
- Authorization status tracked through approval with proactive renewal
- Claims submitted within 24-48 hours with PA reference numbers linked
- Denials addressed within 72 hours with payer-specific appeal documentation
- Performance-based pricing (4-7% of collections) with no lock-in
Contact us to see how structured authorization management closes the gaps your practice keeps absorbing.
Frequently asked questions
Here are some commonly asked questions about prior authorization:
Prior authorization is a payer-required approval process where the provider must obtain confirmation from the insurance company before delivering specific services, procedures, or medications. The payer reviews clinical documentation to determine medical necessity and coverage criteria compliance. If approved, a reference number is issued that must appear on the claim for reimbursement. Without the authorization, the claim denies under CO-197 regardless of clinical appropriateness.
Four types exist — prior authorization (obtained before service delivery, most common), concurrent authorization (ongoing approval during extended treatment like inpatient stays or rehab), retroactive authorization (requested after service, limited to emergencies with narrow payer acceptance windows), and referral authorization (required in HMO plans when the PCP must authorize specialist visits). Each type has different timing rules, documentation requirements, and payer acceptance rates.
Record the reference number in the practice management system and include it on the claim when submitted. The number links the claim to the payer’s approval — without it, the adjudication system can’t verify authorization and the claim denies even when the PA was obtained. Also record the authorization’s valid date range and approved unit count so the team tracks when it expires and how many services remain covered.
Some payers allow retroactive authorization within a narrow window — typically 48-72 hours — for emergency or urgent services where obtaining PA before treatment was genuinely impossible. For non-emergent services performed without PA, retroactive approval success rates are low, and many payers deny retro-auth requests outright. The safest approach is verifying PA requirements and obtaining authorization before every applicable service rather than relying on retroactive approval.
Original Medicare (fee-for-service) requires prior authorization for a limited set of services — certain DME items, some imaging, and specific procedures. Medicare Advantage plans apply PA requirements much more broadly because managed care plans impose their own utilization management criteria. Many services that need no authorization under Original Medicare require PA under MA. Always verify requirements based on the patient’s specific plan type rather than assuming Medicare rules are uniform.
Standard PA requests take 5-15 business days for non-urgent services. Urgent requests — where delay could seriously harm the patient — are processed in 24-72 hours under most payer policies. Electronic prior authorization (ePA) through integrated EHR or clearinghouse systems reduces turnaround time significantly. The most common cause of delay is missing documentation in the initial submission, which triggers additional information requests that restart the review timeline.
