Prior Authorization Workflow: A Practical Guide for Front Desk, Clinical and Billing Staff

A dermatology practice asked us why a third of its biologic injections were being written off. The answer was in a shared inbox. Authorization requests came in from the medical assistants by email, the front desk sometimes started them and sometimes assumed billing would, billing assumed the clinical team had finished, and the provider found out when the patient called about a bill. Nobody was lazy. The practice had four people doing prior authorization and no one who owned it.

That is the normal state of prior authorization in an independent practice. The work touches scheduling, the clinical record, the payer portal, the claim and the appeal, which means it crosses every department. When each department does "its part" with no hand-off rule and no tracker, requests fall between the chairs, and the result is a CO-197 denial that is very hard to overturn after the fact.

The workflow that works is simple to describe: one request record per service, one owner at each stage, a written hand-off when ownership changes, and a daily report of anything not approved with a date of service inside the next seven days. The rest of this guide sets out exactly what each role does to make that true, in the order the work actually happens.

What prior authorization is, and which rules govern it

Prior authorization is a payer's decision, made before a service is delivered, that the service meets its coverage and medical necessity criteria. It is a condition of payment under the contract, not a clinical opinion, and payers apply it to a list of services that changes with every plan year: advanced imaging, elective surgery, specialty drugs, durable medical equipment, sleep studies, genetic tests, physical therapy beyond a visit count, and anything new or expensive.

The rules depend on the payer type. Original Medicare has only a limited set of prior authorization programs, run through the Medicare Administrative Contractors for specific items such as certain hospital outpatient department services, repetitive scheduled ambulance transport and some DMEPOS; CMS lists the current programs on its Prior Authorization and Pre-Claim Review Initiatives page. Medicare Advantage plans make "organization determinations" under 42 CFR Part 422, must follow Traditional Medicare coverage criteria, and have to honor an approval for the full course of treatment. Medicaid managed care, CHIP and Marketplace plans are governed by the CMS Interoperability and Prior Authorization final rule (CMS-0057-F), which requires decisions within 72 hours for expedited requests and seven calendar days for standard requests, a specific reason for every denial, public reporting of approval and denial metrics, and FHIR-based prior authorization APIs. Employer plans regulated under ERISA follow the Department of Labor claims procedure rules, which set 72 hours for urgent pre-service decisions and 15 days for standard ones. Many states have their own statutes on turnaround times, gold carding and continuity of approvals when a patient changes plans.

The first question in any authorization dispute is "which rules apply to this patient", and the front desk can answer it the moment they read the card.

Front desk and scheduling: catch the service before it is booked

The front desk owns the first step and it is the step that saves the most money: identify, at the time of scheduling, whether the service needs authorization. If this step is done well, everything downstream has time. If it is skipped, everything downstream is an emergency.

1. Read the plan, not just the payer. The authorization list differs between a payer's HMO, PPO, Medicare Advantage and Medicaid products. Record the plan name, group number and the "precertification" phone number from the back of the card in the registration record.
2. Check the service against the authorization list. Keep a practice-specific list by payer and CPT code: the top 30 services your providers order. Look it up before you offer an appointment date. Our prior authorization lookup covers common payers and codes, but your own list, built from your own denials, is the one that matters.
3. Open the request record. One record per service per patient, with the fields every later step will need: patient, plan, member ID, ordering provider, CPT and ICD-10-CM codes as ordered, requested date of service, place of service, and the payer's submission channel (portal, fax, phone, 278 transaction through the clearinghouse).
4. Schedule with a buffer. For a standard request, do not book inside the payer's decision window. If the plan takes up to 14 days, a scan booked in 5 days will either be cancelled or performed without authorization.
5. Hand off to clinical in writing. The record moves to the clinical queue with a note: "Needs auth, [payer], submit by [date]". A verbal "I think this one needs an auth" is not a hand-off.

Two front-desk mistakes recur. The first is assuming a referral covers the service; a referral and an authorization are different things, and many HMO plans require both. The second is accepting "my old doctor already got the auth". An approval is tied to the ordering provider, the rendering provider and often the facility. Verify it in the portal and record the number, approved codes, units and date range before you rely on it.

Clinical staff: build a request that can be approved

The medical assistant, nurse or clinical coordinator owns the submission, because the submission is about clinical evidence and clinical staff can read the chart. Their job is to answer the payer's criteria before the payer asks.

1. Pull the payer's clinical policy. Every large payer publishes medical policies by service. Find the one for the CPT code and read the criteria section. For a lumbar MRI, that usually means six weeks of conservative treatment documented, a neurological finding, or a red-flag symptom. For a biologic, it means the diagnosis, severity score, prior therapies tried and failed with dates, and lab results.
2. Match the chart to the criteria. Open the note and check each criterion against documentation. If the note says "failed NSAIDs" without a drug, dose and duration, ask the provider for an addendum before submitting, not after the denial.
3. Submit through the fastest channel the payer offers. Portals and electronic 278 requests return decisions faster than fax and leave a timestamped trail. For drugs, electronic prior authorization through the e-prescribing workflow is usually quickest. Attach the notes, imaging reports and labs that the policy names; do not attach the whole chart.
4. Record the reference number immediately. Every submission produces a case or reference number even before a decision. Enter it in the request record with the date and time submitted and the channel. If the payer later says it never received the request, that number is your evidence.
5. Request expedited review when the standard applies. Expedited (urgent) review is for situations where waiting could seriously jeopardize the patient's health or ability to regain maximum function. Use it when that is true and document why. Using it for convenience damages credibility with the plan's reviewers and wastes a channel that other patients need.
6. Follow up on a schedule. Check the portal at the midpoint of the decision window and again two business days before the date of service. Pends for "additional information" have their own short deadlines, often 10 to 14 days, and a missed pend becomes a denial.

When a request is denied for medical necessity, clinical staff arrange the peer-to-peer review. Most plans allow the treating provider to speak with the plan's medical director within a short window after the denial, sometimes 5 to 10 business days, and some only before a formal appeal is filed. Book it fast, send the provider the denial letter, the policy and a one-paragraph summary of where the chart meets the criteria, and put the call on the calendar.

Billing: make the approval survive contact with the claim

Billing owns the authorization from the moment it is approved until the claim pays. Most authorization denials we see in audits are not for missing authorizations; they are for approvals that did not match the claim.

1. Verify the approval before the visit. Confirm the authorization number, the approved CPT codes, the approved units or visits, the date range, the rendering provider and the facility. If the provider changes the plan in the room (adds contrast, changes laterality, does a second procedure), the approval may not cover it.
2. Put the number where the payer looks. On the 837P the prior authorization number goes in loop 2300, REF segment with qualifier G1. On the CMS-1500 it is box 23. If the practice management system stores it on the patient rather than the claim, check that it actually populates on every claim in the date range.
3. Reconcile the claim to the approval on the day of service. Compare the charge ticket to the approved codes before the claim drops. Mismatches are the moment to request an authorization update or a retro-authorization, while payers that allow it still will.
4. Work authorization denials within 48 hours. CO-197 (precertification, authorization or notification absent), CO-15 (authorization number missing, invalid or does not apply) and CO-198 (precertification exceeded) each have a different fix. CO-15 is often a typo or a number that belongs to another date range. CO-198 means the units ran out and the next visits need a new request. CO-197 is the hard one: if the authorization existed and was not on the claim, correct and resubmit; if it never existed, check the payer's retro-authorization policy, usually a window of 24 hours to a few days after the service, and if that has passed, prepare an appeal on the medical necessity merits and the circumstances.
5. Feed the denials back. Every authorization denial is logged with the root cause: not identified at scheduling, submitted late, pend missed, approval mismatch, or payer error. That log is what the manager uses to fix the workflow. Our denial management teams run this loop weekly for the practices we support.

The provider: document to the criteria and show up for the peer-to-peer

The provider's part is small in minutes and decisive in outcome. The criteria the payer applies are public, and a note written with them in mind is approved on first submission far more often than a note written for another clinician.

Concretely: write the duration and the specific failed treatments ("ibuprofen 800 mg three times daily for eight weeks, physical therapy twelve sessions completed, no improvement in straight-leg raise"), state the finding that triggers the imaging or procedure, and record the functional impact. For drugs, name the step-therapy agents tried and the reason each was stopped. When the practice sees a pattern of pends for the same missing element, the manager should ask the provider to add it to the template.

For a peer-to-peer, prepare for ten minutes, not an hour. Have the denial letter and the policy criteria in front of you, state which criteria are met and where in the chart, and ask directly what documentation would change the decision. Most medical directors will tell you. If the reviewer is not of the same specialty, you can ask for a reviewer with expertise in the relevant specialty, which Medicare Advantage rules and many state laws require for medical necessity denials; say so politely and note the request.

The practice manager: own the tracker and the numbers

The manager does not do authorizations. The manager makes sure one person owns each request at each moment, and that the practice can see the whole queue.

1. Choose a single tracker. Many practice management systems have an authorization module; if yours does not, a shared spreadsheet with locked columns works. The fields are the request record fields above, plus status (not started, submitted, pended, approved, denied, peer-to-peer scheduled, appealed), owner, next action date and outcome.
2. Run the daily report. Every morning: all requests with a date of service in the next seven days that are not approved, sorted by date. That list is the day's priority for clinical staff and the front desk.
3. Keep the authorization list current. Payers change their lists at least annually, usually with the plan year. Assign someone to pull each major payer's updated list every quarter and update the practice's cheat sheet.
4. Review the denial log monthly. Sort by root cause. If "not identified at scheduling" leads, the fix is front-desk training and the lookup list. If "approval mismatch" leads, the fix is the day-of-service reconciliation step. If "payer error" leads for one plan, escalate through the provider relations representative with the case numbers.
5. Protect the time. The AMA's annual prior authorization physician survey consistently finds physicians and their staff spending on the order of a dozen hours a week on roughly 40 requests per physician. That time has to be scheduled, not squeezed into lunch.

The hand-off table

Stage	Owner	Trigger	Output handed off	Deadline
Identify need	Front desk / scheduling	Order or appointment request	Request record opened, plan and codes entered	Same day as scheduling
Build and submit	Clinical staff	Request record in clinical queue	Submission with reference number, policy criteria checked	Within 2 business days of the record opening, and before the payer's window closes
Follow up and pends	Clinical staff	Midpoint of decision window; any pend notice	Decision recorded, or additional records sent	Pend answered within 2 business days
Peer-to-peer	Clinical staff schedules, provider attends	Medical necessity denial	Call completed, outcome recorded, appeal decision made	Inside the plan's peer-to-peer window, often 5 to 10 business days
Verify approval matches plan of care	Billing	Approval received; day before service	Authorization number, codes, units and dates confirmed on the claim record	Before the date of service
Claim and denial work	Billing	Claim drops; any CO-15, CO-197, CO-198	Paid claim, corrected claim, retro request or appeal; root cause logged	Denials touched within 48 hours
Oversight	Practice manager	Daily and monthly	Seven-day exception report; monthly root cause review; updated payer lists	Daily report by 9 a.m.; monthly review in the first week

What good looks like

A practice with this workflow in place knows four numbers. First, the share of authorization-required services identified before the appointment is booked; we want this above 95 percent, and the gap is almost always one payer whose list nobody updated. Second, the first-submission approval rate, which varies enormously by specialty and payer but should rise steadily once notes are written to the criteria. Third, the number of CO-197 and CO-15 denials per month, which in a well-run practice falls toward a handful and is dominated by payer error rather than practice error. Fourth, the dollar value of services written off for missing authorization, which should trend to near zero, because a service that cannot be authorized should be rescheduled or the patient should sign a financial responsibility acknowledgment rather than the practice absorbing it. If you do not know these numbers today, the revenue leak estimator gives a rough sense of what the gap costs, and the denial log gives you the real figure within a quarter.

Questions we hear

How long does a payer have to decide a prior authorization request?

It depends on who regulates the plan. Medicare Advantage, Medicaid managed care, CHIP and Marketplace plans under CMS-0057-F must decide expedited requests within 72 hours and standard requests within seven calendar days. ERISA employer plans follow the Department of Labor timeframes: 72 hours for urgent pre-service claims and 15 days for standard ones, with one extension allowed. Many states set their own, sometimes shorter, limits for state-regulated plans. Original Medicare's limited programs have their own published turnaround times on the CMS initiative pages. Always record the applicable clock in the request record so follow-up has a date.

Can we get a retro authorization after the service was performed?

Sometimes, and the window is short. Many commercial and Medicaid plans allow retroactive requests for a defined period after the service, often one to a few business days, and for emergencies or situations where the patient's coverage was not known at the time. Some plans do not allow it at all for elective services. Read the payer's provider manual, and if the window has passed, appeal on the merits with an explanation of why the authorization was not obtained; results vary and depend heavily on the payer and the circumstances.

Does an approved authorization guarantee payment?

No. Approval letters say so in the fine print. The claim must still match the approval (codes, units, provider, facility, dates), the patient must still be eligible on the date of service, and the claim must meet every other billing rule. What the approval does guarantee, under Medicare Advantage rules and in most states for commercial plans, is that the payer cannot later deny the approved service for lack of medical necessity if the facts were accurately presented.

What is gold carding and does it apply to us?

Gold carding exempts providers with a high historical approval rate for a service from having to request authorization for it. Texas enacted the first gold card law in 2021 and a number of states have followed with their own thresholds, and some payers run voluntary programs. Whether it applies depends on your state, the plan type (state laws generally do not reach ERISA self-funded plans) and your approval history. Ask your major payers whether a program exists and what the qualifying rate is.

Who should do prior authorizations: the front desk, a nurse, or billing?

All three, in sequence, which is the point of this guide. Identification belongs at the front desk because that is when the service is booked. Submission belongs with clinical staff because it is about matching the chart to clinical criteria. Reconciliation and denials belong with billing because they are about the claim. A single "authorization coordinator" can hold the submission and follow-up stages in a larger practice, but the front desk and billing steps still exist and still need owners.

Can we charge the patient when authorization is denied?

It depends on your contract and the reason for the denial. If the patient chose to proceed after being told in writing that the service was not authorized and would be their responsibility, many contracts permit billing the patient; some HMO contracts and Medicaid programs prohibit it regardless. If the denial resulted from the practice's failure to obtain an authorization that would have been approved, most contracts make it a provider write-off. For Original Medicare, the Advance Beneficiary Notice process applies instead. Check the hold-harmless language in each contract and ask counsel before changing your financial policy.

Sources and references

• CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), CMS: the rule setting decision timeframes, denial reason requirements, public metrics and prior authorization APIs for MA, Medicaid, CHIP and Marketplace payers.
• Prior Authorization and Pre-Claim Review Initiatives, CMS: the current list of Original Medicare prior authorization programs and how they differ from pre-claim review.
• Medicare Managed Care Appeals & Grievances, CMS: how Medicare Advantage organization determinations, reconsiderations and independent review work, with the governing guidance.
• 2024 Medicare Advantage and Part D Final Rule (CMS-4201-F), CMS: the rule requiring MA plans to follow Traditional Medicare coverage criteria and honor approvals for the full course of treatment.
• Some Medicare Advantage Organization Denials of Prior Authorization Requests Raise Concerns About Beneficiary Access to Medically Necessary Care, HHS Office of Inspector General: the audit finding that a share of MA prior authorization denials met Medicare coverage rules.
• 005010X217 Health Care Services Review (278), X12: the standard electronic prior authorization request and response transaction, with examples.
• MGMA Advocacy, MGMA: the association's regulatory burden work, where prior authorization is tracked as a leading practice concern each year.