Prior Authorization Process: Your Patient Needs One, Now What

Eligibility came back active, but the benefit response, or the payer’s policy list, shows that the service your physician ordered needs an authorization. The prior authorization process is the set of steps from that point to an approval number on the claim, and in 2026 it has a few things it did not have when a biller first drafted this post twelve years ago. The biggest is a deadline. Medicare Advantage, Medicaid and CHIP plans now must give you a decision in 7 calendar days for a standard request and 72 hours for an urgent one, and they must give a reason for a denial.

The work is still tedious, but the new deadlines and denial-reason rules help. Here is the routine.

Why it is worth having a process

The AMA’s survey of 1,000 physicians, published in May 2026, found practices handling about 40 prior authorizations per physician per week, consuming roughly 13 hours of physician and staff time, with 40 percent of physicians employing staff who do nothing else. Ninety-five percent said authorizations delay necessary care and 79 percent said patients had abandoned treatment because of them. A written process helps a small office handle that volume without losing patients to delays.

The steps

1. Confirm coverage first, then confirm the requirement

Verify the policy is active and the plan is the one you think it is. Then check whether the service needs authorization under that specific product. Payers publish prior authorization lists by product line, and in radiation oncology they changed on January 1, 2026 when the delivery codes moved to 77402, 77407 and 77412. A list that still names 77385 and 77386 is out of date. Note the authorizing entity. Often it is not the payer but a delegated vendor (eviCore, Carelon, NIA and others), and the vendor’s portal, not the payer’s, is where the request goes.

2. Gather the patient and payer facts

Name, date of birth, member ID, group number, ordering provider’s NPI, rendering and facility NPIs if different, place of service, and the authorizing entity’s contact and portal details. Keep a payer file: a page per payer and per vendor with the portal address, phone and fax, turnaround time, forms they insist on, and what worked last time. It is still the single best time saver in this work.

3. Gather the clinical facts

The diagnosis with ICD-10-CM code, the ordered services with CPT or HCPCS codes and units, the physician’s history and physical, relevant imaging and pathology, prior treatment history and the clinical rationale. For a radiation course, the request should name the technique and the fraction count, and if the request is for 77412 it should say which criterion puts it at that level, because the reviewer will look for it. Collecting this is the slow part and the reason to schedule the service far enough out to allow for it.

4. Submit through the channel the entity accepts

Portals are the norm, and many return a decision for routine requests in minutes. Some entities still take fax or phone. Behind the scenes, the HIPAA standard transaction for this is the X12 278, and CMS-0057-F requires impacted payers to offer a FHIR-based Prior Authorization API by January 1, 2027, which should let practice systems query requirements and submit requests without a portal. Until then, submit completely and keep the confirmation.

5. Track the deadlines

Here is what changed. Under the CMS Interoperability and Prior Authorization final rule (CMS-0057-F), beginning January 1, 2026:

Requirement	Applies to
Decision on an expedited (urgent) request within 72 hours	Medicare Advantage plans, state Medicaid and CHIP fee-for-service programs, Medicaid and CHIP managed care plans
Decision on a standard request within 7 calendar days	Same
A specific reason for every denial, whatever channel the request came through	Those payers plus Qualified Health Plan issuers on the federal exchanges
Prior authorization metrics posted publicly on the payer’s website each year, first set by March 31, 2026	All impacted payers
Prior Authorization API, Provider Access API and Payer-to-Payer API	All impacted payers, by January 1, 2027

The decision timeframes do not apply to Qualified Health Plan issuers, and drugs are outside the API and denial-reason requirements. Employer and other commercial plans are outside the rule entirely, though many signed voluntary commitments in 2025. For everyone else: log the submission date and time, calendar day 7, and escalate on day 8, citing the rule.

6. Hand it off, and attach it to the claim

If the approval stays in an email, the claim is likely to deny. Record the authorization number, approved codes and units, date span and facility in the billing system against the patient and the service, and send it to whoever will bill: your own staff, the hospital department, the imaging center. When the course or the dose changes, go back for an updated authorization before the first claim, because an approval for 20 fractions does not pay fraction 21.

Worked example: one request, two deadlines

A Medicare Advantage patient is scheduled for a 20-fraction course of 77407 with daily image guidance (77387-26). The request goes in through the vendor portal on Monday, October 5, at 2:15 p.m. with the H&P, simulation note and treatment plan attached.

Standard deadline: a decision is due by Monday, October 12. If there is no decision on October 13, call the vendor, cite the 7-calendar-day requirement, and add a note to the payer file.
If the physician documents that a delay would seriously jeopardize the patient’s health and asks for expedited review, the decision is due within 72 hours, by Thursday, October 8, at 2:15 p.m.
If the answer is a denial, it must state a specific reason. “Does not meet criteria” without the criterion is not a reason; ask for it before you write the appeal or request a peer-to-peer.
If the answer approves 77402 instead of the requested 77407, that is a partial denial with a stated reason, and the appeal is about the technique criterion, not about whether treatment is covered.

A checklist for the authorization tracker

Patient, member ID, payer and product, authorizing entity
Codes, units, technique, fraction or dose count, facility
Date and time submitted, channel, confirmation number
Due date (day 7, or 72 hours for expedited)
Decision, authorization number, approved span and units, stated reason if denied
Where the approval was sent and when it was entered on the account

What to do now

Put the 72-hour and 7-day due dates on every Medicare Advantage, Medicaid and CHIP request, and escalate the day after.
Rebuild your payer file around the authorizing vendors, not just the payers, and include the 2026 radiation code lists.
Insist on the stated reason for every denial before appealing.
Download each impacted plan’s posted prior authorization metrics and keep them with the payer file; they show which plans deny the most.
Iridium Suite’s real-time eligibility check returns the payer’s coverage and benefit response in seconds and can fill patient demographics and policy data from it, which is the first step in deciding whether an authorization may be needed.

Your patient needs a prior authorization. Now what? The prior authorization process in 2026, step by step