Hey there, each week, we write in plain English about how health insurance works, why claims get denied, and how patients and healthcare teams can get paid or reimbursed.

tldr; Prior authorization is the approval your insurance company makes your doctor get before it will pay for a test, procedure, or medication, even after your doctor has already decided you need it. By the end of this issue you'll know why that step exists, who actually touches your request between your doctor's decision and the payer's answer, and what the newest physician survey says happens to patients while they wait.

In this part, we go into the basics of prior auth and the impact it has on healthcare. In part 2, we will explore the mechanics of prior auth and go deep into strategies to be more successful at it. Before diving deep here, I recommend you understand the bigger picture and take a look at RCM 101: How Healthcare Gets Paid, Eventually, Maybe.

Prior authorization, PA for short, is a permission step. Before certain tests, procedures, or medications happen, the insurance company has to sign off that it will pay for them. Not that the care is allowed to happen. Just that they'll cover the bill.

Sometimes, prior-auth is also called pre-authorization, pre-certification and just authorization, depending on the payer.

It isn't new. Insurers have required it for decades as a check on care they consider expensive or easy to overuse. The idea, in theory, is reasonable: keep someone from ordering a $4,000 scan for a routine tension headache with none of the red flags, like trauma, sudden severe onset, or a neurological symptom, that would actually call for imaging. When those red flags do show up, the scan is exactly what should happen, and the guidelines say so just as clearly.

In practice, PA has grown past that original scope. It now touches routine medications and, as Biscuit's about to find out, genetic tests that didn't need a second opinion five years ago.

Prior authorization is a tool payers use to “manage utilization,” which is a fancy way of saying they want to control what gets paid for before the bill shows up. Payers say prior auth helps control costs, reduce unnecessary care, and prevent fraud. The irony is that for patients and providers, the process can feel like its own kind of trick: care may be medically appropriate, the patient may have coverage, but everyone still has to prove it to the payer before the plan is allowed to actually act like a plan.

The irony is that prior auth is supposed to prevent abuse of the system, but for patients and providers, it often feels like the system abusing them back.

Remember Biscuit the Corgi from Medical billing 101? He’s back!

Dr. Singh flags something in Biscuit's family history during a routine visit and orders a genetic panel that screens for a hereditary cancer marker. Nothing dramatic happens in the room. The test gets ordered, and that's where the visible part of the visit ends and the invisible part begins.

Sage, who runs the billing side of Dr. Singh's practice, checks whether Biscuit's payer requires PA for this specific test code. It does. Sage pulls together Biscuit's clinical notes, his family history documentation, and whatever else the payer's policy asks for, and submits the packet through the payer's portal. On the other side sits Otis, who works utilization management for Biscuit's insurer. Otis's job is to check the packet against the payer's medical policy and decide: approve, deny, or ask for more.

Said out loud like that, it sounds like two people and one submission. It isn't. Each of those steps hides its own layers: different documentation depending on the payer, more than one round of "we need more information" before anyone gets a yes, sometimes a phone call between the doctor and a reviewer called a peer-to-peer, sometimes a fast lane that skips PA entirely for practices a payer already trusts. We're giving that whole layer its own issue soon: the actual mechanics of how doctors and RCM teams work a PA once they've been burned by it a few times.

Biscuit's request gets approved in nine days. Nine days sitting on a question that will tell his family whether a hereditary risk is present, before anyone's even drawn blood.

Nine days used to be normal. It's about to get harder for payers to justify. Starting this year, federal rules require most Medicare Advantage, Medicaid, and ACA marketplace plans to decide standard PA requests within seven calendar days and urgent ones within 72 hours (CMS, 2026). More on that here: CMS put prior auth on a clock (your job's plan dodged it)

Regulators wrote that rule because the gap between "the doctor decided" and "the payer answered" is where people get hurt waiting. However, the catch is that this rule doesn’t impact most commercial plans.

For a long time the industry's answer to "does the wait matter" was a shrug. The newest physician survey answers it directly. The American Medical Association surveyed 1,000 physicians in 2026 and found that 95% said prior authorization delays access to necessary care, and 92% said it negatively affects clinical outcomes. Seventy-nine percent said patients abandon treatment altogether rather than keep fighting for approval. More than one in four, 26%, reported that a PA delay led to a serious adverse event for one of their patients: hospitalization, permanent impairment, or death (AMA, 2026).

That last number is physicians reporting what they witnessed, not a government body counting deaths. It's still the most direct answer available to the question this issue opened with, and it's not a small number of doctors saying it.

The most important thing to understand is that “my doctor ordered it” and “my insurance agreed to pay for it” are not the same thing. Before you leave the appointment, ask whether the test, procedure, or medication needs prior authorization. If it does, ask who is submitting it, what documents they need from you, and when you should follow up.

Prior auth turns medical judgment into a paperwork argument, and peer-to-peer calls are where that becomes most obvious. Before discussing the case, ask who is reviewing it. Get the reviewer’s name, specialty, and credentials. The AMA found that only 24% of physicians believe medical-necessity denials are consistently reviewed by an appropriately qualified clinician, and only 16% say peer-to-peer reviewers often or always have the right qualifications. So make the reviewer’s qualifications part of the record. If someone is questioning the care plan, it is fair to ask whether they are qualified to review that care.

Prior auth failures usually do not start at the denial. They start earlier, in small operational gaps: the wrong form, missing clinical notes, outdated payer criteria, an expired approval window, a CPT code mismatch, or no auth number tied back to the claim. By the time the denial arrives, the team is already paying for the mistake in rework. Build a simple matrix by payer and service line: what documents are required, which CPT codes trigger review, what clinical criteria must be present, how long approvals last, what information is most often missing, and what denial reasons keep repeating. The goal is not just to appeal faster. It is to stop treating every prior auth like a brand-new mystery.

This is the section worth forwarding to your team. 2026 already changed the ground under you. CMS now requires impacted payers to publish their PA approval rates, denial rates, and appeal-overturn rates on their own websites, updated annually. The first round posted this March, covering 2025 data. By January 2027, those same payers have to expose PA status through a standards-based API, which means the logic behind PA decisions is becoming far more visible and far more comparable across payers than it's ever been.

That visibility cuts both ways. A payer whose numbers show fast, consistent decisions gets to use that in contracting conversations with health systems and employers. A payer whose numbers show inconsistency has a harder story to tell, publicly, for the first time. If your team doesn't already have a live view of your own PA metrics next to your competitors', close that gap before next March's numbers do it for you.

The thing worth remembering from medical billing 101 still applies here: a payer's own policy is the source of truth, and it changes quietly. Prior authorization is just the place where that policy shows up fastest and does the most damage when nobody's tracking the update.

Part 2 coming out soon with a deep-dive in prior authorization mechanics and strategies that can help you be more successful at it!

That's it for this issue. Hit reply. I read everything.

Disclaimer: The content published by preimbursed (the "Newsletter") is provided for general informational and educational purposes only and reflects the opinions and commentary of the author. It does not constitute, and should not be relied upon as, medical, legal, financial, tax, insurance, or other professional advice. No physician-patient, attorney-client, fiduciary, or other professional relationship is created by reading the Newsletter or by corresponding with the author. The Newsletter is not a substitute for individualized advice from a qualified professional. Before making any healthcare, coverage, insurance, financial, or legal decision, you should consult your own physician, attorney, benefits administrator, or other licensed advisor and review your specific plan documents, policies, and applicable law. The author is not responsible for any action taken or not taken in reliance on the content herein, and you assume full responsibility for your use of the information provided. Information in the Newsletter is believed to be accurate as of the date of publication and is drawn from the sources cited. Laws, regulations, coverage rules, corporate ownership, market data, and other facts change frequently and may have changed since publication. Certain statements describe pending, recently enacted, or phased-in legal and regulatory changes whose scope, interpretation, and effective dates may shift. The author makes no representation or warranty, express or implied, regarding the accuracy, completeness, timeliness, or reliability of any content, and disclaims all liability for any errors or omissions to the fullest extent permitted by law. References to any company, organization, product, government program, or individual are made solely for purposes of news reporting, commentary, analysis, and criticism, and do not imply any endorsement, sponsorship, affiliation, or partnership. All trademarks, service marks, and trade names are the property of their respective owners and are used only for identification and descriptive purposes. Where a named party disputes a characterization or finding, the Newsletter notes that dispute. Statements concerning identified companies reflect cited reporting and the author's opinion and analysis of matters of public concern. Certain characters, organizations, and scenarios in the Newsletter, including but not limited to Biscuit, Dr. Singh, and composite payer and provider names, are fictional and used for illustration. Any resemblance to actual persons or entities is coincidental.

Disclosure: The authors are the co-founders of Converus.ai, a company that organizes payer policy information for healthcare providers, and therefore has a commercial interest in the subject matter discussed. References to Converus.ai are made only where relevant and are not paid placements. To the fullest extent permitted by applicable law, the author and preimbursed disclaim all warranties and shall not be liable for any direct, indirect, incidental, consequential, or other damages arising out of or in connection with your use of, or reliance on, the Newsletter.