What payers’ first prior authorization numbers needed from providers to be useful

The week

March 31, 2026 was the first deadline for health plans covered by CMS’s Interoperability and Prior Authorization final rule, known by its docket number CMS-0057-F, to post prior authorization metrics publicly. CMS, the Centers for Medicare & Medicaid Services, is the federal agency that runs Medicare and Medicaid and sets many of the rules private plans in those programs must follow.

Prior authorization is the step between a doctor ordering, say, an MRI and the scan taking place: someone in the hospital’s back office asks the patient’s health plan for permission, and the plan, or “payer,” checks whether it will cover the service before it is delivered. Every day, thousands of these requests travel between hospitals and insurers by web portal, fax and phone. For years, nobody outside the insurers could see how often they said yes, or how long they took. The deadline changed that, at least on paper.

The rule covers four kinds of payer: Medicare Advantage organizations (private companies that run Medicare benefits), Medicaid and CHIP programs and their managed care plans (the state-run coverage for lower-income adults and children, often administered by private plans), and qualified health plan issuers on the federal exchanges (the insurers selling individual coverage on HealthCare.gov). Each had to publish calendar year 2025 data on a page anyone could reach without logging in.

The metrics included the shares of requests approved, denied and approved after appeal, plus average and median decision times. Drugs were excluded. Reporting levels differed by type of payer: contract level for Medicare Advantage, plan level for managed care, state level for fee-for-service Medicaid and CHIP, and issuer level for exchange plans. One published number might therefore describe a single plan or an entire state’s program.

The posting did not arrive alone. It followed rules that took effect on January 1, 2026, including seven-day decision clocks for standard requests and 72-hour clocks for expedited, urgent ones for most affected payers, and a requirement to give a specific reason when a request is denied. Together they marked the moment prior authorization stopped being a private argument and started becoming a measured one.

For years, the argument over prior authorization ran on two different currencies. Providers argued with anecdotes: the cancer patient whose treatment waited a week, the surgeon who spent an afternoon on hold. Payers answered with averages: overall approval rates were high, and most decisions were quick. Each side believed its own evidence, and neither could check the other’s.

The March 2026 postings gave everyone the same averages, in public. That was real progress, but it was half a dataset. The payer metrics were percentages and decision times, aggregated across a contract, a plan or a whole state. They did not include request counts, did not break results down by service, and could not show what happened to one hospital’s requests.

A health system could turn the public numbers into something it could manage against only by supplying the other half itself. We see three parts to that work: understanding what the payer half contained, building the provider half, and using the combination where it changes decisions. First, though, a word on what prior authorization actually is, and why a board should care about a back-office process.

A permission slip with a clock on it

Prior authorization is a permission slip. Before a hospital performs certain tests, procedures or admissions, it asks the patient’s health plan to confirm the service will be covered. The plan reviews the request against its coverage rules, sometimes with a nurse or physician reviewer, and approves it, denies it or asks for more information. If the hospital goes ahead without approval, it may not be paid.

Payers say the process stops unnecessary or unsafe care and controls cost. Providers say it delays treatment and buries staff in paperwork. Both can be true at once, which is why measurement matters: it moves the conversation from who is right in general to where the friction actually sits.

A few terms recur throughout this story:

• Payer means the organization that pays the claim: a Medicare Advantage plan, a Medicaid program or managed care plan, or a commercial insurer.
• Standard and expedited requests are the two speeds. Expedited requests are for situations where waiting could seriously harm the patient; from January 2026 most affected payers face a 72-hour clock for those and a seven-day clock for standard ones.
• Appeal is the provider’s or patient’s formal challenge to a denial. An appeal overturn is a denial that was reversed.
• Average and median are two ways of describing a typical decision time. The average adds everything up and divides; the median is the middle value. If most decisions take two days but a few take a month, the average gets dragged up while the median stays low. Neither tells you how many patients waited a month.
• An API, short for application programming interface, is a standard doorway that lets one computer system ask another a question and get a structured answer. The rule’s next phase, due in January 2027, requires payers to support prior authorization through APIs, so requests and status updates can move electronically instead of by fax and phone.

The payer half: what the postings contained

Each posting answered a narrow set of questions about one payer’s book of business: what share of standard and expedited requests it approved or denied, what share was approved after appeal, and how long decisions took, on average and at the median. Those are useful facts, especially the appeal overturn rate. A high share of denials reversed on appeal suggests that initial reviews are rejecting requests that meet criteria, which is a pattern providers can raise directly. Every overturned denial represents work that should not have been necessary: a clinician’s time on a letter, a staff member’s time on a resubmission, a patient waiting.

The limits were built in. Rates without volumes cannot show whether a plan handled a hundred requests or a million. Medicare Advantage figures at contract level may blend very different markets, so a contract that spans a busy city and a rural region reports one number for both. Averages can hide a long tail of slow decisions.

Definitions also varied. A request withdrawn and resubmitted, or approved after extra documentation, might be counted differently by different payers. One plan might treat that as an approval; another might count a denial and a new request. Formats varied too, because CMS’s template was optional. Some payers posted tidy tables; others posted documents that took real effort to find and read.

Comparing two payers’ headline rates was therefore risky, rather like comparing two restaurants’ “average wait time” when one counts from the moment you walk in and the other from the moment you sit down. Comparing one payer’s rate with a provider’s own experience of that payer was much safer, because at least one side of the comparison is data the provider controls and understands.

The provider half: counts the payer did not publish

Many health systems could not say, without manual work, how many requests went to each payer last year, for which services and through which channel; how many were denied, appealed and overturned; or how long each took from submission to decision.

The reason is mechanical. Requests move through payer portals, fax, phone and clearinghouse transactions. A portal is the payer’s website, where staff log in and type the request; each payer has its own. A clearinghouse is an intermediary that converts and routes standard electronic transactions between many providers and many payers. Status often lives in staff notes rather than structured fields, so the fate of any given request is buried in free text that no report can count.

Building the provider half means capturing a small set of fields for every request in the revenue cycle or practice management system. The revenue cycle is everything between scheduling a patient and collecting payment: registration, insurance checks, authorizations, coding, billing and follow-up. The fields are:

• payer and plan
• service or procedure code
• ordering department
• submission channel
• submission time and decision time
• decision and denial reason
• appeal outcome

The January 2026 requirement for specific denial reasons made that denial reason field far more useful, because reasons can now be grouped and tracked. “Missing documentation” and “does not meet medical necessity criteria” point to very different fixes, one in the hospital’s own paperwork and the other in the clinical conversation with the payer.

Some of this data can be pulled from portals and electronic transactions. Some requires a change in how staff close out a request: a dropdown instead of a free-text note, a timestamp captured when the decision arrives rather than when someone gets round to recording it.

This is operations work with a modest technology component. It needs an owner in revenue cycle, a short data definition agreed with clinical departments, and a monthly report that someone reads. Without it, the public metrics remain trivia.

One health system’s quarter of counting

Suppose a health system with three hospitals and a large outpatient imaging business. Its revenue cycle director reads a Medicare Advantage plan’s posting: high approval rates, a short median decision time. That does not match what her team experiences, but until now she has had only the team’s frustration to go on.

The system spends a quarter capturing the fields above for every request. The pattern that emerges is specific. For most services, the plan behaves as its posting suggests. For one category of advanced imaging submitted by fax, denials are frequent, the denial reason is usually missing clinical documentation, and many denials are overturned on appeal. Decision times for that slice are much longer than the plan’s published median.

Now the system has three distinct problems instead of one vague grievance. Part of it is internal: ordering physicians are not attaching the notes the plan needs. Part is channel: fax submissions are slower to process and harder to track. Part is the payer’s: initial reviews appear to be rejecting requests that pass on appeal. Each problem has a different owner and a different fix, and the conversation with the plan can open with the plan’s own published numbers next to the hospital’s.

The system did not need the plan to publish more, or a new software platform, or a consultant’s benchmark. It needed a consistent way of recording its own requests and someone with the time to read the results each month. The first report was rough, and several fields were blank for the early weeks. By the third month the picture was clear enough to act on.

The public posting alone would have told it almost nothing actionable. The plan’s headline numbers were accurate for the plan’s whole book of business; they were simply not about this hospital. A payer’s average is a fair description of the payer, and a poor description of you.

The combination: where it changes decisions

Put side by side, the two halves support three decisions that the public data alone could not.

The payer conversation

Suppose a plan reports high approval rates and short turnaround, but a hospital’s own experience with it is much worse. The gap then points somewhere specific: a service line, a documentation pattern or a submission channel. That moves joint operating meetings, the regular sessions where a health system and a payer review their relationship, from complaints to a shared fact base, using numbers the payer itself published. The seven-day standard clock can be tracked the same way, with missed clocks escalated through provider relations, the payer team responsible for its hospital and physician network.

Staffing

Prior authorization teams are often sized by headcount history: last year’s team, plus or minus a few people. Volume by payer, combined with each payer’s denial and appeal patterns, shows where the work actually sits. A payer with frequent denials and appeals consumes far more staff time per request than one with routine approvals, even at similar volumes. The data supports moving staff to the payers and services that need them, and setting service levels the team can meet.

There is a workforce effect as well. Prior authorization roles have high turnover in many revenue cycle departments, partly because the work feels endless and unmeasured. A team that can see each payer’s published commitments next to its own results, and that has a defined escalation path when clocks are missed, is managing a relationship rather than absorbing whatever arrives. It is a better job, and an easier one to staff and train for.

Automation

Many health systems were evaluating tools to automate submission and status checks ahead of the January 2027 API requirements. Automation pays most where volume is high, approval is routine and turnaround is slow: the request is predictable, so software can assemble and send it, and checking status by machine saves hours of portal clicking. It pays least where denials are frequent and a clinical response is needed, because the bottleneck there is a physician’s judgment rather than typing. Only the combined dataset shows which payer and service pairs fall into which group, and buying automation without it means choosing where to aim before knowing where the work is.

Denials, delays and payer contracts

Where do denials cluster, and which patients wait longest? The answers show where revenue leaks and where care is held up.

Money. Every denied request that is later overturned costs staff and clinician time, and every service delivered without valid authorization risks going unpaid. Knowing where denials cluster is knowing where revenue leaks.

Patients. Delays in authorization are delays in care. A health system that can show where requests wait longest can redesign the process around the patients most affected, and can speak credibly to patients and the public about what it is doing.

Regulators and reputation. The rule exists because policymakers wanted the process to be visible. Health systems that bring good data to payer negotiations, state regulators or public discussions are taken more seriously than those bringing stories.

Strategy. Payer contracts are among a health system’s most important commercial relationships. Authorization friction is part of what a contract really costs to operate, and the combined data makes that cost visible at renewal time.

The systems that had it under control

A health system that has this under control usually has a few things in place:

• One named owner for prior authorization data, with authority to change how requests are recorded.
• A short written definition of each field, agreed with clinical departments, so “decision time” means the same thing in radiology and in surgery.
• A monthly report by payer and service that compares the health system’s own results with each payer’s published rates and clocks.
• A defined escalation path for missed seven-day and 72-hour clocks.
• Automation decisions made from the combined data rather than from a vendor demonstration.

The ways it goes wrong are just as recognizable. One is ranking payers by their headline rates, as if the figures were comparable; they were not, given the differences in definitions, formats and reporting levels. Another is buying an automation tool first and hoping the data will follow. A third is building a beautiful dashboard that nobody uses in payer meetings. The last is treating the denial reason as free text, which throws away the most useful new field the January 2026 rules created.

What a hospital should be able to say about its own requests

• How many prior authorization requests did we send to each of our top payers last year, for which services, and how many were denied, appealed and overturned?
• How often are payers missing the seven-day standard and 72-hour expedited clocks on our requests, and what happens when they do?
• Have we read each major payer’s public posting, and where does our experience differ from it?
• Which denial reasons come up most, and how many of them are things we could fix ourselves?
• Before we buy automation, which payer and service pairs have high volume, routine approval and slow turnaround?

Asking these takes no technology project; answering several of them does. That gap is the honest measure of how ready a health system was for the payers’ first public numbers, and for the electronic requirements that follow.

With hindsight

Most required plans did post. An independent tracker, AuthDenied, reported that 92% of plans required to publish 2025 metrics had done so by late July 2026, according to an August analysis by Forvis Mazars. On compliance alone, the first deadline largely worked.

Usability was another matter. A KFF review in August found the postings hard to locate and interpret, reported as percentages without counts, inconsistent in format, thin on response-time detail and without service-level breakdowns. The gaps a careful reader could see in March were still there months later, now confirmed by an independent health policy organization. KFF noted that CMS’s July 2026 template updates and a 2026 proposed rule aimed to close some of these gaps, though not the lack of service categories.

Those findings confirm the shape of the problem. The public metrics were a reference point rather than a management tool. A percentage published by a payer, about its whole book of business, cannot tell a hospital which of its own patients are waiting, or why. Only the hospital’s own records can do that.

Health systems that captured their own request-level data could use the postings: as a benchmark in payer meetings, as a check on decision clocks, and as a guide to where staff and automation would pay off. Those that did not were left reading tables they could not act on.

The January 2027 API deadline will add electronic submission and real-time status. That is welcome, but it does not change the underlying problem. An electronic doorway into a payer’s system speeds up a request; it does not tell a health system which requests matter most, which denials it is causing itself, or which payers are falling short. The same internal data will decide how well those APIs are used.

Transparency rules hand you someone else’s numbers, and they become valuable only when you can hold your own numbers next to them. The health systems in the best position for 2027 are those that treated March 2026 as a prompt to measure themselves, and not as a compliance event for payers.