Medicare Prior Auth: Rules, Timelines, and Appeals

A patient is scheduled for an outpatient spinal injection on Tuesday. On Monday afternoon, the Medicare Advantage plan denies the authorization. Your medical assistant starts calling the payer, the provider prepares for a peer-to-peer review, and the front desk calls the patient to explain a possible delay. The clinic now has to reschedule care, collect […]

A patient is scheduled for an outpatient spinal injection on Tuesday. On Monday afternoon, the Medicare Advantage plan denies the authorization. Your medical assistant starts calling the payer, the provider prepares for a peer-to-peer review, and the front desk calls the patient to explain a possible delay. The clinic now has to reschedule care, collect additional documentation, and protect the claim from a later denial.

That's Medicare prior auth in practice. It's a pre-service review that happens before a covered item or service is furnished, and it can function as a payment-control gate between the ordering provider and the payer. It isn't the same as a post-payment audit, and it isn't merely a notification that a service is scheduled.

Medicare prior auth is manageable when your team knows which code and setting trigger review, which coverage policy governs the request, how long the plan has to respond, and when an appeal is worth the work. This guide breaks down those decisions, the difference between Original Medicare and Medicare Advantage, the role of LCDs and NCDs, the CMS interoperability requirements, and the workflow I'd give to a new prior authorization coordinator.

What Medicare Prior Authorization Actually Is and Why It Matters

Prior authorization requires the provider or supplier to submit a request before the service, item, or treatment is delivered. CMS describes the process as a pre-service review in which the request must show that applicable coverage, coding, and payment requirements are met. For certain hospital outpatient department services, the request must be submitted before both the service and the claim, with documentation supporting compliance with Medicare rules. CMS's explanation of prior authorization and pre-claim review is the right starting point for your coordinator.

Three actors appear in nearly every request:

  • Ordering provider: The clinician who determines that the service, item, or treatment is medically appropriate and initiates the request.
  • Rendering provider: The facility, specialist, supplier, or clinician who will furnish the service.
  • Plan or contracted reviewer: The Medicare contractor or Medicare Advantage plan reviewer who evaluates the request against applicable coverage and utilization criteria.

The code matters because prior authorization is usually tied to a specific CPT or HCPCS code, diagnosis, place of service, provider type, and payer policy. A service that requires review in a hospital outpatient department may not require the same review in another setting. CMS has limited Original Medicare prior authorization to defined categories, including certain hospital outpatient procedures and some durable medical equipment, with published code lists controlling the exact scope. The applicable federal regulation reinforces why your staff must check the exact code and setting instead of relying on a general service name.

A five-step infographic showing the Medicare prior authorization process, from appointment booking to final delays.

A denial can affect more than one appointment. It can create unused procedure time, patient dissatisfaction, delayed revenue, and additional work for the clinician. For that reason, practices should treat authorization as a controlled workflow, not as a form someone completes when the schedule becomes urgent. A remote healthcare staff member can support the administrative steps, provided the provider retains clinical responsibility and the assistant works inside approved systems and escalation rules. Resources such as Ekipa AI's healthcare industry page can also help managers think through how remote healthcare operations fit into broader practice workflows.

The rest of the process comes down to three questions. Which rule governs the request? How long does the payer have to respond? What should your team do when the answer is no?

Original Medicare vs Medicare Advantage Prior Auth Rules

The first question is the patient's coverage pathway. Staff shouldn't begin with the procedure name alone. They should confirm whether the patient has Original Medicare or Medicare Advantage, then identify the payer, plan, network status, code, and place of service.

Original Medicare prior authorization is narrower and more policy-driven. CMS identifies specific services and items that may require review, and the request is evaluated under Medicare coverage rules and the applicable contractor's policies. Medicare Advantage plans operate within Medicare requirements but apply their own plan-level utilization management rules, forms, portals, and clinical criteria. KFF reports that 99% of Medicare Advantage enrollees are required to obtain prior authorization for at least some services, most commonly higher-cost care such as inpatient hospital stays, skilled nursing facility stays, and chemotherapy. KFF's 2024 Medicare Advantage analysis documents the scale of that activity.

Dimension Original Medicare Medicare Advantage
Coverage pathway Governed by Medicare coverage rules and the applicable contractor's jurisdictional policies Governed by Medicare requirements plus the individual plan's utilization management policies
Prior authorization scope Limited to defined services and items, including certain hospital outpatient procedures and some durable medical equipment May apply across a broad range of services, depending on the plan and benefit
Operational source CMS rules, applicable code lists, National Coverage Determinations, and Local Coverage Determinations Plan-specific medical policies, forms, portals, network rules, and clinical criteria
Submission method Contractor-directed process for the applicable service or item Plan portal, electronic transaction, fax, phone process, or another payer-specified channel
Denial route Medicare contractor and Medicare appeals pathways Medicare Advantage plan reconsideration and the applicable federal appeals pathway
Main practice risk Missing a coverage requirement or using the wrong contractor policy Applying the wrong plan workflow, missing required clinical criteria, or treating a plan decision like an Original Medicare decision

The friction is usually operational rather than mysterious. A Medicare Advantage request may require a plan-specific form, an upload through a payer portal, recent notes, failed conservative treatment, imaging, or a peer-to-peer review. The next plan may ask for a different packet for a similar service. Your coordinator needs a payer matrix that records the correct portal, phone number, required attachments, escalation contact, and expiration fields.

Original Medicare work has a different failure pattern. The staff member must identify the applicable Medicare Administrative Contractor and read the policy that governs the service. A coverage decision based on an LCD or NCD isn't interchangeable with a Medicare Advantage medical-necessity decision.

Operational rule: Never assign a request by specialty alone. Assign it by patient coverage, code, setting, payer policy, and documentation requirement.

A credentialing or administrative support partner may help organize staff who handle these payer-facing workflows. For example, practices can review medical credentialing services when deciding how to separate payer administration from clinical decision-making.

How LCDs and NCDs Shape Every Request

Coverage should be checked before anyone drafts a prior authorization request. A well-written packet can still fail if the service falls outside the governing Medicare coverage policy, the diagnosis doesn't support the indication, or the place of service conflicts with the policy.

A National Coverage Determination, or NCD, is issued by CMS and applies nationally. A Local Coverage Determination, or LCD, is issued by a Medicare Administrative Contractor and applies within that contractor's jurisdiction. An LCD may address a service that isn't fully described by an NCD, and it can define covered indications, limitations, diagnosis codes, frequency restrictions, and setting requirements.

The practical workflow is straightforward:

  1. Confirm the contractor and jurisdiction. Use the patient's location, billing entity, and service details to identify the relevant Medicare Administrative Contractor.
  2. Search the Medicare Coverage Database. Pull the active NCD or LCD for the code, service, and setting.
  3. Read the limitations, not just the title. The indications section may require a specific diagnosis, clinical finding, treatment history, frequency limit, or place of service.
  4. Match the chart to the policy. Identify the exact note, imaging report, lab result, or treatment history that supports the listed requirement.
  5. Resolve gaps before submission. Ask the provider for clarification while the patient is still scheduled, rather than after a denial.

Coverage with Evidence Development adds another layer in situations where payment depends on collecting and submitting defined data. Your coordinator should flag those cases for a designated clinical or compliance reviewer instead of treating them like an ordinary authorization.

The distinction between a coverage denial and a plan denial matters. An LCD or NCD issue asks whether Medicare covers the service under the applicable policy. A plan-level denial asks whether the request satisfies the plan's utilization or medical-necessity criteria. Those decisions can require different forms, reviewers, and appeal strategies.

Chart-review standard: The diagnosis code should not stand alone. The note must explain why the patient meets the policy's clinical indications for the specific service being requested.

A practice manager should store the policy citation with the authorization record. That gives the reviewer a clear map from code, to diagnosis, to clinical documentation, to coverage requirement.

Timelines, Documentation, and the New CMS API

A practice can't manage an authorization deadline it hasn't recorded. Start the clock when the payer receives a complete request, not when a staff member first opens a draft. Save the submission timestamp, confirmation number, attachment list, payer response, and any request for more information.

For impacted payers handling medical items and services, CMS sets response deadlines of 72 hours for expedited requests and seven calendar days for standard requests. CMS also clarifies that these timelines apply to medical items and services, not prescription drugs. CMS's prior authorization process FAQ should be part of your coordinator's reference library.

Request Type Original Medicare Medicare Advantage Documentation Trigger
Medical item or service Follow the applicable CMS or contractor process and the notice's stated timeframe Standard and expedited response deadlines may apply under the CMS interoperability rule for impacted medical items and services Complete clinical packet, code, diagnosis, coverage support, and payer-required attachments
Prescription drug Follow the applicable drug coverage and contractor process Don't assume the medical-item API deadlines apply Drug-specific policy, prescribing information, and plan requirements
Expedited medical request Use the applicable contractor process 72 hours for impacted medical items and services The request must explain why delay threatens the patient's care or condition
Standard medical request Use the applicable contractor process Seven calendar days for impacted medical items and services Submit a complete packet so the plan doesn't pause review for missing information

CMS's interoperability rule requires impacted payers to expose prior authorization status through a Prior Authorization API. The response must identify an approval, a denial with a specific reason, or a request for more information. For medical items and services, the API must also identify covered services and documentation requirements. CMS's final-rule fact sheet describes the shift toward a structured, machine-readable workflow.

That doesn't mean a practice can stop monitoring requests. A coordinator still needs to verify that the electronic response matches the patient, code, units, dates, and rendering provider. If a payer asks for more information, the response should be routed to the right clinical reviewer immediately.

A strong packet commonly includes:

  • Recent visit documentation: The face-to-face or telehealth note should explain the condition, symptoms, examination, prior treatment, and requested service.
  • Policy support: Include the applicable LCD, NCD, or payer policy reference when the submission workflow permits it.
  • Clinical evidence: Attach relevant imaging, laboratory information, testing, and treatment history.
  • Coding alignment: Confirm that the CPT or HCPCS code, ICD-10 diagnosis, provider, location, and requested units agree across the form and chart.
  • Equipment justification: For durable medical equipment, the record may need a detailed medical-necessity explanation. A resource on a letter of medical necessity for a powerchair illustrates the type of documentation managers should review with their clinical and billing teams.

An insurance verification specialist can confirm benefits and plan identity before the appointment, while a prior authorization specialist handles submission, tracking, escalation, and denial follow-up. Practices can review insurance verification services when deciding whether those functions belong to one coordinator or separate roles.

The Five Levels of the Medicare Appeals Process

A denial shouldn't automatically trigger an appeal. First determine why the request failed, whether the missing information can be corrected, whether the service remains clinically appropriate, and whether the financial and patient-access consequences justify escalation. An appeal is strongest when the record answers the denial reason directly instead of merely repeating the original request.

The Medicare appeals pathway generally progresses through five levels:

Level one redetermination

The first review is a redetermination by the Medicare contractor or the applicable Medicare Advantage plan review process. The coordinator should identify the denial basis, gather the relevant policy language, and submit a focused response with the missing or misunderstood documentation.

This is the point where administrative accuracy matters most. Confirm that the appeal uses the correct beneficiary information, service code, date, provider identifiers, denial reference, and supporting records. A vague appeal wastes the opportunity to correct a clear record problem.

Level two reconsideration

If the redetermination doesn't resolve the issue, the next level is reconsideration by a Qualified Independent Contractor for the applicable Medicare pathway. This review is particularly relevant when the dispute involves how an LCD, NCD, or coverage requirement was interpreted.

Your packet should distinguish a factual error from a disagreement with medical policy. If the provider believes the reviewer overlooked an imaging result or misread a treatment-history requirement, identify the exact page and explain the connection to the policy.

Level three Administrative Law Judge hearing

An Administrative Law Judge hearing is a more formal review. The practice should consider the provider's availability, the strength of the clinical record, the importance of the service, and the resources required to prepare. A hearing may offer the opportunity to explain clinical context that a form-based review missed, but it also demands organized records and a clear position.

Level four Medicare Appeals Council review

The Medicare Appeals Council reviews the case after the earlier administrative levels. It isn't a chance to upload an unstructured second packet. The submission should explain the legal, factual, or procedural error that remains and should identify the earlier decision being challenged.

Level five federal district court review

Federal district court is the final judicial stage in the sequence. Practices rarely pursue this route without guidance because the record, jurisdiction, filing requirements, and legal arguments require careful handling. Confirm the available route with qualified counsel before treating court review as an ordinary revenue-cycle task.

The appeal notice controls the deadline and filing instructions. A terminated service may also qualify for a fast-track process, particularly when continuing the service is at issue. Don't let an appeal sit in an inbox. Assign an owner, record the deadline, schedule the provider review, and confirm receipt after submission.

Where Prior Auth Quietly Breaks Down

Behavioral health deserves a separate workflow. Broad authorization summaries often emphasize overall approval and denial activity, but oversight bodies have identified behavioral health as an area needing closer review. The Government Accountability Office recommendation on behavioral health prior authorization reviews calls for CMS to target behavioral health services in Medicare Advantage denial reviews, while CMS audit reporting has highlighted problems involving prior authorization and appeals processing, beneficiary access, and care coordination. The American Hospital Association's summary of the CMS audit report provides additional context.

For a mental health or therapy practice, the practical question isn't only whether a request will eventually be approved. It's whether an outpatient therapy series, psychiatry visit, or transition to higher-acuity care is delayed while the plan and practice exchange information. A patient coordinator can track visits and deadlines, but the clinician must define urgency and provide the clinical rationale.

Other recurring weak points include outpatient surgery, advanced imaging, and Part B drugs. A prior authorization approval doesn't guarantee that a later claim will survive review if the submitted record doesn't support the billed service or match the applicable coverage policy.

Use a second-level chart review for high-risk requests:

  • Before submission: Confirm code, diagnosis, setting, provider, policy, and required records.
  • After approval: Record authorization number, approved dates, units, service location, and limitations.
  • Before claim release: Compare the performed service and documentation with the approval and coverage policy.
  • After denial: Classify the reason as missing information, coding mismatch, coverage issue, or medical-necessity disagreement.
  • For behavioral health: Escalate time-sensitive access concerns to the clinical and compliance leads rather than allowing them to remain in a general payer queue.

Most breakdowns are predictable. They happen when ownership is unclear, the schedule is checked too late, or the team treats approval as the end of the workflow instead of one checkpoint in the claim lifecycle.

A Practice Manager Checklist and the Takeaway

Give a new coordinator a written process, not an instruction to “check the payer.” The checklist below is designed for the first morning of a new authorization queue.

  • Confirm the plan type: Identify Original Medicare or Medicare Advantage, the payer, the member number, and the active coverage dates.
  • Check the exact requirement: Verify whether the code, service, provider, and place of service require prior authorization under the applicable policy.
  • Pull the coverage policy: Locate the relevant LCD or NCD before drafting the request, then save the policy reference in the authorization record.
  • Build the packet: Attach the clinical note, diagnosis support, imaging, laboratory information, treatment history, and any payer-specific form.
  • Submit through the correct channel: Use the plan portal, Prior Authorization API, contractor process, or other approved route. Don't assume a fax sent to an old number counts as receipt.
  • Log the response: Save the API payload or payer response, decision reason, approval number, approved dates, units, and documentation requests.
  • Calendar the deadline: Record the plan's applicable decision deadline and every appeal deadline stated in the notice.
  • Escalate intelligently: Schedule a peer-to-peer review when the denial turns on clinical judgment, and involve the provider when the record needs a medical explanation.
  • Audit before billing: Compare what was approved, what was performed, and what the chart supports before the claim leaves the practice.

A checklist for practice managers outlining essential steps to manage the prior authorization process for patients.

A remote coordinator can manage schedule screening, documentation collection, payer submission, follow-up, approval logging, and denial tracking. That person shouldn't diagnose patients, make independent medical decisions, or substitute for a licensed clinician. The practice should define what the coordinator can complete, what requires provider review, and how protected health information moves through the EHR, phone system, and payer portals.

The primary care and internal medicine staffing resource is relevant for practices that need coverage across scheduling, insurance verification, referrals, and authorization follow-up. The same operating model can be adapted for specialty practices, therapy clinics, and multi-site organizations, but the payer matrix and escalation rules must match the specialty.

The Takeaway

Medicare prior auth works fastest when the request follows a clear coverage policy and includes the right evidence from the start. Medicare Advantage adds plan-specific utilization rules and broader administrative variation, while Original Medicare requires close attention to CMS requirements, contractor jurisdiction, and applicable coverage policies. A denial is not automatically the end of the process, but an appeal is worth filing only when the team can answer the denial with a stronger record or a clear policy argument.

Start this week by separating plan verification, coverage research, submission, response tracking, and appeal ownership. Staff the queue with trained coordinators and connect it to the EHR rather than relying on scattered spreadsheets, personal inboxes, and manual fax follow-up.


Medical Virtual Assistants provides U.S. medical practices with pre-vetted LATAM healthcare staff who can work aligned U.S. hours on authorization submission, payer follow-up, denial tracking, insurance verification, and related administrative workflows. If your practice needs a trained coordinator to keep Medicare prior auth requests moving inside your existing systems, visit Medical Virtual Assistants.