A practice manager told us this spring that her staff "spend all day on prior auths." We asked how many requests they submitted last month, how many were approved on the first pass, and how long the average request took. She did not know, and she is not unusual. MGMA's 2026 Regulatory Burden Report, published April 9, 2026, found that 90 percent of the more than 230 practices surveyed said prior authorization requirements increased in the past year, and 40 percent had hired multiple full-time administrative staff per physician to deal with payer requirements. Almost none of the practices we meet can produce a turnaround report.
That matters more now than it did two years ago, because the rules have deadlines in them. CMS-0057-F, the Interoperability and Prior Authorization final rule, took effect for decision timeframes on January 1, 2026. Medicare Advantage plans, Medicaid and CHIP managed care plans and fee-for-service programs, and qualified health plans on the federal Marketplaces must respond to a standard prior authorization request within seven calendar days and to an expedited request within 72 hours, must give a specific reason when they deny, and had to publish their first set of authorization metrics by March 31 of this year. Many states have their own, sometimes shorter, deadlines for fully insured commercial plans. A deadline you do not measure is a deadline nobody enforces.
Key takeaways
- The log is a spreadsheet with about a dozen fields, one row per request. You do not need software to start.
- Four monthly numbers matter: median and 90th percentile turnaround by payer, percent of decisions past the applicable deadline, first-pass approval rate by code, and requests per staff member per week.
- Three escalation triggers, at the deadline, at day ten and at day fourteen, turn the log from a record into a tool.
- Appeals that open with a dated timeline do better than appeals that open with a clinical argument, because the reviewer can verify the timeline in thirty seconds.
What the log needs
You do not need software for this, although the practices that do it well eventually build it into their practice management system or EHR work queues. A spreadsheet with these fields, one row per request, is enough to start:
| Field | Why it matters |
|---|---|
| Patient account, payer, plan type (MA, Medicaid MCO, commercial group, Marketplace) | Plan type determines which deadline applies |
| CPT or HCPCS code(s) and diagnosis | Denials often hinge on a code mismatch, and approval rates are tracked by code |
| Date and time submitted, and channel (portal, fax, phone, EHR-integrated) | Starts the clock; channel affects speed and is your evidence of submission |
| Standard or expedited | 72 hours versus 7 days |
| Date payer requested more information, and date you sent it | Payers pause the clock here; you need to prove how fast you responded |
| Decision date, decision (approved, denied, partially approved), authorization number, valid dates | Closes the clock; feeds the claim |
| Denial reason as stated by the payer | Required to be specific since January 2026; vague reasons are appealable on that basis |
| Peer-to-peer requested and completed dates | Measures a second, hidden delay |
| Date of service actually rendered | Shows the patient-facing delay |
| Staff member who owns the request | Workload and handoffs |
The four numbers to report every month
- Median and 90th percentile turnaround by payer. The median tells you what is normal. The 90th percentile tells you which payer is hurting patients. A plan with a three-day median and a fourteen-day 90th percentile has a problem in one department or one service line, and you can name it.
- Percent of decisions past the applicable deadline. For MA and Medicaid managed care, anything past seven calendar days (or 72 hours expedited) without a documented request for more information is a regulatory miss you can cite in the appeal and in the payer meeting.
- First-pass approval rate by code. A code with a 95 percent approval rate is a candidate to stop requiring authorization. The large insurers have been removing exactly those codes under the commitments they made in June 2025: AHIP and the Blue Cross Blue Shield Association reported in April that participating plans had eliminated 11 percent of authorizations, and UnitedHealthcare said on May 5 that it would drop requirements for 30 percent of services by the end of this year. Bring your own data to the conversation.
- Requests per full-time staff member per week. This is your staffing number. It also shows whether an EHR-integrated submission channel is worth the cost, because integrated requests should take fewer minutes each.
A worked example
A three-physician orthopedic practice logged 412 requests over a quarter. The numbers, rounded:
| Payer | Requests | Median days | 90th percentile days | Past deadline | First-pass approval |
|---|---|---|---|---|---|
| MA plan A | 118 | 3 | 6 | 2% | 91% |
| MA plan B | 96 | 5 | 13 | 18% | 84% |
| Medicaid MCO | 74 | 4 | 9 | 9% | 88% |
| Commercial PPO (state rule: 5 business days) | 124 | 2 | 7 | 6% | 96% |
Two things jump out. MA plan B misses the seven-day deadline on nearly one request in five, and its tail runs to thirteen days; that is the payer meeting. The commercial PPO approves 96 percent of everything, and when the practice sorted by code, MRI of the knee (73721) was approved 99 percent of the time; that is the code to ask them to remove. Neither finding was visible before the log. The practice manager had a feeling that "plan B is slow," and feelings do not move payers.
Escalation triggers
The log is only useful if it changes behavior on the day something is late. We set three triggers. At 72 hours on an expedited request or day seven on a standard one with no decision and no information request, the coordinator calls the payer, documents the call reference number, and cites the deadline. At day ten, the practice manager sends a written escalation to the payer's provider relations contact with the request ID and the dates. At day fourteen, the patient is told, in writing, that the plan has not decided, and is given the plan's member services number and, for MA members, a reminder that they can file a grievance. Patients calling their own plan move requests faster than practices do.
Using the log in appeals
When a denial comes, the log gives you the first paragraph of the appeal letter: submitted on this date through this channel, information requested on this date, sent the same day, denied on this date with this stated reason. If the stated reason is vague ("does not meet criteria" with no criteria named), say so and cite the requirement for a specific reason. If the decision came after the deadline, say so with the dates. Then make the clinical argument. Appeals that open with a factual timeline do better than appeals that open with a clinical argument, because the reviewer can verify the timeline in thirty seconds and is then inclined to believe the rest.
Using the log in payer meetings
Most mid-sized practices have a provider relations contact at each major plan and never use them. Once a quarter, send the contact a one-page summary: request volume, median and 90th percentile turnaround, percent past deadline, and the five codes with the highest approval rates. Ask two questions: can these codes be removed from the authorization list for our group, and what is causing the tail? We have seen plans remove codes for a single group when the data was clean and the volume justified it. It does not always work. It never works without the data.
Mistakes we see
Logging only denials, so the approval rate by code cannot be calculated. Logging the fax date but not the confirmation, so the payer can claim it never arrived. Letting the clock run while waiting for a physician to sign a letter of medical necessity, then blaming the payer. Filing everything as standard because the expedited box "causes trouble," when the clinical situation met the expedited definition and the patient waited four extra days. Keeping the log in one coordinator's head or personal spreadsheet, so it leaves when she does. And the most common: building the log, running it for two months, and never producing the monthly report, so nobody sees the value and it quietly stops.
Questions we hear
Does the seven-day rule apply to our commercial PPO patients?
Not under CMS-0057-F, which covers MA, Medicaid and CHIP, and Marketplace qualified health plans. Employer group plans follow state law and plan contract terms, and many states have their own turnaround requirements, some shorter than the federal ones. Look up your state's rule and add it to the log as another deadline column, as the orthopedic practice above did.
Is this worth it for a small practice?
A three-physician orthopedic practice submits several hundred requests a quarter. Ten minutes a day of logging produces a dataset by year-end that no payer can argue with, and the escalation triggers alone shorten the tail. Our denial management team builds and runs this log for practices that would rather not, and the RCM audit includes a turnaround review as standard.
Will the January 2027 API requirements make the log unnecessary?
No. The payer APIs will return decisions to the EHR for the payers and services that are connected, which will make logging easier for those requests. They will not cover every payer or every service for some time, and the payer-published metrics are annual and aggregated. Your own log will remain the only source of practice-level data through 2027.
What to do this week
- Build the spreadsheet with the fields above and start logging every new request from Monday. Do not try to back-fill.
- Write the three escalation triggers on a card and give one to each coordinator.
- Look up your state's prior authorization turnaround rule for fully insured commercial plans and add the column.
- Put the first monthly report on the calendar for the first week of September, with the four numbers and one page.
- Identify your provider relations contact at each of your top five payers and confirm the email address before you need it.
