Changes to Prior Authorization: Risksand Opportunities in 2026
Under the CMS Interoperability and PriorAuthorization rule, payers must meet faster decision timelines:
· 72hours (generally) for urgent requests and
· 7calendar days for standard requests.
· Publicly report prior authorization metrics such as approval rates, denialrates and response times, with the first reporting due in 2026.
These requirements are intended to make aprocess criticized for opacity more transparent. (Of course, this is MedicareAdvantage (MA), Medicaid, CHIP, and QHP issuers on the FFEs, it does notcurrently apply to most employer-sponsored (commercial) insurance or MedicareFee-For-Service (with some exceptions).
At the same time, policymakers areexperimenting with expanding prior authorization in places it historically hasnot existed. A new federal demonstration will test the use of priorauthorization in traditional Medicare for a limited set of services in severalstates.
The net result is probably not less priorauthorization but a more structured and more measurable version of it.
For multisite providers, that distinctionmatters. Organizations with dozens of locations face a volume problem as muchas a policy problem. Each payer plan, service category and state ruleintroduces variation. When those differences are multiplied across hundreds ofclinicians and thousands of encounters, prior authorization becomes less aboutindividual staff effort and more about operational systems.
The effects will not be evenly distributedacross healthcare verticals.
Imaging-heavy specialties such asorthopedics and cardiology will continue to seeheavy authorization requirements, particularly as insurers scrutinize high-costdiagnostic tests.
Durable medical equipment andrespiratory providers must navigate priorauthorization alongside other compliance steps, including documentation ofmedical necessity and proof of delivery, which can compound small data errorsinto denied claims later in the revenue cycle.
Infusion providers and specialtymedication services face a different challenge: theburden of documentation. For them, delays often arise not from the initialauthorization request but from missing or inconsistent clinical documentation.
Behavioral health organizations face yetanother variation, with frequent authorizationrenewals and treatment plan updates that can interrupt care if missed.
Most providers today still manage priorauthorization either manually in house or through outsourced vendors. Bothmodels carry risks that may become more visible under the new rules.
For in-house teams, the new timelines will require tighter operational discipline.Payer response clocks run on calendar days rather than business days, and amissed documentation detail can reset the process entirely. Providers shouldalso pay attention to denial explanations. Insurers will be required to providemore specific reasons for denials, which can become a valuable source ofoperational feedback if organizations track and analyze them.
Outsourced prior authorization creates a different set of challenges. Many providers receive onlyhigh-level status updates from their RCM vendor without structured informationabout why approvals succeed or fail. That can make it difficult to identifysystemic issues across locations, payers or service lines. Vendors oftenoptimize for volume and turnaround time rather than continuous improvement infirst-pass approval rates.
Payers’ Likely Response. Insurers are also likely to adjust their own behavior in response tothe new transparency requirements. Public reporting of prior authorizationperformance will put pressure on plans to manage response times more carefully.At the same time, the broader economics of healthcare still push payers to useauthorization as a utilization management tool. In Medicare Advantage alone,insurers processed nearly 53 million prior authorization requests in a recentyear, with millions denied and only a small fraction appealed.
For providers, the lesson isstraightforward. Prior authorization is evolving from a largely invisibleadministrative step into a measurable operational process. The organizationsthat fare best will be the ones that treat it that way, not as a set of individualphone calls and portal submissions, but as a system that can be standardized,tracked and continuously improved.
