A practice manager told us last week that her authorization coordinator spends about a third of her day on hold checking the status of requests that should already have been decided. Nobody in the office knew how long each plan was allowed to take, so nobody knew which calls were legitimate follow-up and which were just waiting on hold to be told "still in review".
That is a solvable problem. As of this month there is a defined standard for almost every payer type a practice deals with, and the standards are specific enough to write on a card and tape to the monitor. Some come from regulation, some from the insurers' own pledge, and some from state law. Here is the table we use, followed by how to turn it into a tracking habit.
Key takeaways
- Every payer type now has a defined decision window: 72 hours and seven days for Medicare Advantage and Medicaid plans under CMS-0057-F, 72 hours and 15 days for self-funded employer plans under the ERISA claims regulation, and state-law windows for fully insured plans.
- The plan type is on the card: "administered by" usually means a self-funded ERISA plan, and quoting the Medicare Advantage standard to it gets you nowhere.
- Beyond turnaround, four commitments are specific enough to enforce: a specific denial reason, 90 days of continuity when a patient changes plans, clinician review of clinical denials, and shorter authorization lists.
- A standard nobody measures is a suggestion; six fields in the authorization log turn it into a monthly compliance report by plan.
- CO-197 and CO-15 on the remit belong to the authorization team, and each one has a different usual cause.
The service level table
| Payer type | Urgent decision | Standard decision | Source |
|---|---|---|---|
| Medicare Advantage | 72 hours | 7 calendar days | CMS-0057-F, effective January 1, 2026, plus existing MA regulation |
| Medicaid and CHIP managed care | 72 hours | 7 calendar days | CMS-0057-F, effective January 1, 2026 |
| Medicaid fee-for-service | 72 hours | 7 calendar days | CMS-0057-F, effective January 1, 2026 |
| Self-funded employer plans (ERISA) | 72 hours | 15 days, with one 15-day extension | Department of Labor claims procedure regulation |
| Fully insured commercial plans | Often 24 to 72 hours | Varies by state; commonly 2 to 15 days | State insurance law and the June 2025 pledge |
| Traditional Medicare (WISeR states only) | Expedited process available | Target of a few days per CMS | WISeR model, from January 2026 |
The state column is the one you have to fill in yourself. Many states enacted prior authorization reform laws between 2021 and 2025 covering fully insured plans, and the timelines differ: some require 24 hours for urgent and 2 business days for standard; others allow longer. Your state medical society usually has a one-page summary. Self-funded employer plans are exempt from state law, which is why the ERISA line matters: if the patient's card says "administered by" rather than "insured by", you are probably looking at the 15-day standard.
The ERISA line deserves one more sentence because it is the one most offices get wrong in both directions. The Department of Labor claims procedure regulation gives a plan 15 days to decide a pre-service claim, which is what a prior authorization request is, with one extension of up to 15 days if the plan notifies you before the first period ends and explains why. Urgent care claims must be decided within 72 hours, and a request to extend an ongoing course of treatment must be decided within 24 hours if it was made at least 24 hours before the current authorization ran out. The patient, not the practice, holds the appeal rights under ERISA, so the appeal is filed on the patient's behalf with a signed authorization, and the plan owes a decision on a pre-service appeal within 30 days. None of this is new, but almost nobody at the front desk knows it, and the plans are not going to volunteer it.
Standards beyond turnaround
Turnaround is the number everyone tracks, but four other commitments are now specific enough to enforce.
A specific denial reason. Under CMS-0057-F, impacted payers must state a specific reason for a denial regardless of how the request was submitted. The pledge signatories committed to clear explanations of denials for their commercial books as well. "Does not meet criteria" is not a specific reason. Ask for the criterion.
Ninety days of continuity when a patient changes plans. The pledge signatories committed, by January 1, 2026, to honor an existing authorization for 90 days when a patient in active treatment switches to a new plan. If your oncology or infusion patient changed plans in January, the new plan should not be re-authorizing the regimen from scratch. Cite the commitment in writing when it happens anyway.
Clinical review of clinical denials. Most state laws and the pledge require that a denial based on medical necessity be made by a licensed clinician, and many states require a same-specialty reviewer on appeal. A peer-to-peer conversation is usually available before the formal appeal. Ask for it every time the denial is clinical; a surprising number reverse on the phone.
Fewer services requiring authorization. Several large insurers announced list reductions effective January 1, 2026 under the pledge. Pull each payer's current list and check the services you request most often. We have already seen practices submitting requests for services that no longer require them, which wastes the coordinator's time and, more important, delays the visit.
The log that makes the standards usable
A standard nobody measures is a suggestion. Add these fields to whatever you use to track authorizations, whether that is a spreadsheet, a module in the practice management system or a dedicated tool:
- Payer and plan type (MA, Medicaid managed care, ERISA self-funded, fully insured commercial, traditional Medicare).
- Urgent or standard.
- Date and time the complete request was confirmed received, with the confirmation number.
- Decision due date, computed from the table above.
- Actual decision date and outcome.
- For denials: whether a specific reason was given, and whether a peer-to-peer was offered.
Once a month, sort by payer and count late decisions and non-specific denials. That is your compliance report. Two or three months of it turns a vague complaint into a documented pattern, which is what a plan's provider relations representative, a state insurance department or CMS will respond to.
The denial codes that tell you the authorization process failed
Two adjustment codes on the remit belong to the authorization team, not the coders. CO-197 means precertification or authorization was absent. CO-15 means the authorization number on the claim was missing, invalid or did not match the service. In our experience CO-197 is about half a payer problem (the request was submitted and lost) and half a practice problem (the service was added during the visit and nobody went back for authorization). CO-15 is almost always a practice problem: the number was obtained and not put on the claim, or the claim carried a different CPT code than the one authorized. Track both by count and dollars, monthly, alongside the turnaround log.
Where practices lose the argument
The most common failure is an incomplete request that the practice believes was complete. The plan pends it for records, the clock never starts, and three weeks later the coordinator is angry at a plan that is technically compliant. Build request templates per service that include what the plan's medical policy asks for, and have the coordinator check the template before submitting. The second failure is not distinguishing plan types: quoting the seven-day Medicare Advantage standard to a self-funded employer plan gets you nowhere. The third is treating a late decision as an excuse to proceed without authorization. A late decision is a compliance complaint, not an approval; the claim will still deny.
Our denial management team runs this log for the practices we support, and the monthly report shows late decisions and non-specific denials by plan. A practice that wants to see how its authorization process compares can start with an RCM audit, which includes a review of CO-197 and CO-15 denials for the prior quarter.
Questions we hear
The plan says its clock starts when the request is assigned to a reviewer, not when we submitted. Is that right?
Under CMS-0057-F the timeframe runs from receipt of the request, and the rule says so regardless of submission method. A plan cannot add an internal queue in front of the clock. Ask them to put the position in writing; they usually don't.
Can we bill the patient if authorization was denied and the physician proceeded anyway?
It depends on the plan and on what the patient signed. For Medicare Advantage, a patient can generally only be billed if they received advance written notice that the service might not be covered and agreed to pay. For commercial plans, read the contract; many prohibit billing the patient for authorization failures caused by the provider. This is a contract and consumer protection question, so involve counsel before making it a policy.
Where do we find our state's prior authorization law?
Start with the state medical society; most publish a one-page summary of turnaround times, peer-to-peer rights and any gold card program. The state insurance department's website usually has the statute or bulletin. Record the state standard in the same table as the federal ones, and note which of your payers it reaches: only fully insured commercial plans and, in some states, Medicaid managed care. If a payer's provider manual quotes a longer window than the state law allows, the law controls, and saying so in writing usually ends the discussion.
What to do this month
- Fill in the state law row of the service level table for your state and tape the finished table next to the authorization coordinator's monitor.
- Add the six log fields: plan type, urgent or standard, complete-receipt timestamp and confirmation number, due date, decision date and outcome, and denial reason and peer-to-peer offered.
- Pull each top payer's current authorization list and remove services that no longer require a request from your workflow.
- Run the first monthly count of late decisions and non-specific denials by plan, and share it with the practice manager.
- Pull last quarter's CO-197 and CO-15 denials by count and dollars and sort each into payer-caused and practice-caused.
