Prior authorization is a plan's approval, obtained before care is delivered, that a service or drug meets the plan's coverage conditions. HealthCare.gov defines preauthorization as "a decision by your health insurer or plan that a health care service, treatment plan, prescription drug or durable medical equipment is medically necessary," and adds the sentence most people never see: "Preauthorization isn't a promise your health insurance or plan will cover the cost." A claim is held when that step is required and has not been completed.
This article explains an administrative process in the United States. It is general information, not medical, insurance, legal or financial advice. It does not say what care anyone should get, decline or delay, does not define what is medically necessary for any person, and does not say whether a claim should be appealed. Clinical questions belong with your clinician, and coverage questions belong with your plan. This site's full position is set out on its disclaimer page.
Sources read September 8, 2026. Prior authorization rules differ by plan type, by state and by federal program, and several federal requirements have phased in on their own schedule.
What is prior authorization in health insurance?
The National Association of Insurance Commissioners, in a consumer article on prior authorization dated November 5, 2024 and read September 8, 2026, puts it in one line: "Prior authorization requires your doctor or provider to obtain approval from your health plan before providing health care services or prescribing prescription drugs."
The NAIC also describes what the plan is doing with the request: "Prior authorization is a check that your plan covers the proposed care. It's also a way the health plan can decide if the care is medically necessary, safe, and cost effective." And it states the consequence of skipping it: "Without prior authorization, your health plan may not pay for your treatment or medication."
You may see the same process called preauthorization, precertification or prior approval. The names vary by plan and mean the same administrative step.
Two things it is not. It is not a clinical decision about your care, which is between you and your clinician. And it is not a payment guarantee, which is the point the HealthCare.gov glossary entry for preauthorization, read September 8, 2026, makes explicitly.
Why a claim gets held
A claim is a request for payment submitted after care. Prior authorization is a request for approval submitted before it. When the second one is required and missing, the first one has nowhere to land.
Holds usually trace to one of a small number of situations: the service required authorization and none was requested, an authorization exists but for a different code, date, quantity or facility than the one billed, the authorization expired before the care happened, or the request is still pending a decision when the claim arrives.
The distinction that matters most to a person reading a notice is between a hold and a denial. A held or pended claim is one the plan has not finished processing. A denied claim is one the plan has processed and refused. They can look similar on an explanation of benefits, and the reason code on that notice is where the plan states which it is. What the plan then owes you by way of process depends on which of the two it is.
Which services tend to require it
Requirements are set by each plan and published in its own documents, so no list here is authoritative for your coverage. What is generally true is that the requirement attaches to categories of higher cost or higher complexity rather than to routine visits, and that drug formularies carry their own separate approval steps.
There is one situation where federal consumer guidance is explicit. CMS, on its page about ending surprise medical bills dated September 10, 2024 and read September 8, 2026, states that "emergency services must continue to be covered without any prior authorization, and regardless of whether or not a provider or facility is in-network."
Where a service sits inside a plan's network rules is a separate question that runs alongside authorization rather than replacing it, and our explainer on in-network and out-of-network allowed amounts covers that side.
Plan design also shapes how much of this a member encounters, since referral and authorization practices differ across plan types, as set out in our comparison of what the HMO, PPO and EPO letters change.
The federal timeframes, and exactly who they bind
This is the part that most consumer pages state as though it were universal, and it is not.
The CMS Interoperability and Prior Authorization Final Rule, known as CMS-0057-F, was published on January 17, 2024, and its fact sheet was read on September 8, 2026. CMS identifies the plans it reaches as "Medicare Advantage (MA) organizations, state Medicaid and Children's Health Insurance Program (CHIP) Fee-for-Service (FFS) programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan (QHP) issuers on the Federally Facilitated Exchanges (FFEs)," which CMS calls "impacted payers."
For those payers, CMS's fact sheet sets decision timeframes of "72 hours for expedited (i.e., urgent) requests and seven calendar days for standard (i.e., non-urgent) requests." It also states that "beginning in 2026, impacted payers must provide a specific reason for denied prior authorization decisions, regardless of the method used to send the prior authorization request," and requires those payers to publicly report certain prior authorization metrics annually on their websites, with initial metrics due by March 31, 2026. CMS gives compliance dates generally beginning January 1, 2026 for the operational provisions and generally January 1, 2027 for the application programming interface requirements.
| The question | What CMS's fact sheet says |
|---|---|
| Who is bound | Medicare Advantage organizations, Medicaid and CHIP fee-for-service programs, Medicaid and CHIP managed care entities, and QHP issuers on the federally facilitated exchanges |
| Standard decision | Seven calendar days |
| Expedited decision | 72 hours |
| Denial reasons | A specific reason required, beginning in 2026 |
| Public metrics | Posted annually by impacted payers, initial metrics due March 31, 2026 |
The information gain is in the first row. If your coverage is an employer sponsored plan that is not one of those payer types, these particular federal timeframes are not the rule that governs your request. Many states set their own prior authorization timelines for the plans they regulate, and plans set their own service standards. Your state Department of Insurance is the body that can say what applies where you live, and your plan document is the authority for your plan.
When a request is denied
The NAIC's consumer article describes the sequence available to a member without prescribing an outcome. Its first suggestion is to call the health plan to understand the stated reason, since a request that failed on missing or incorrect information may be resolved by correcting it. Beyond that, it describes working with the provider's office to submit an appeal with additional supporting information, following the health plan's instructions, and it adds: "Contact your state insurance department to help guide you through the process or help you file a complaint if appropriate."
HealthCare.gov sets out the general two stage structure for plans it covers, on its page about appealing an insurance company decision. "You have the right to an internal appeal," meaning you "may ask your insurance company to conduct a full and fair review of its decision," and "if the case is urgent, your insurance company must speed up this process." Then: "You have the right to take your appeal to an independent third party for review. This is called an external review," with the effect that "the insurance company no longer gets the final say over whether to pay a claim."
Whether an appeal is worth pursuing, and on what grounds, is not something an article can judge. The denial notice states the reason and the deadline, and the plan, your clinician's office and your state regulator are the parties who can act on it.
What happens after an approval
An approval settles the coverage question for that service. It does not settle what you owe.
Once the claim is processed, the ordinary cost sharing runs: the deductible until it is met, then coinsurance or a copayment, calculated against the figure the plan allows. That sequence is set out in our guide to how a deductible and coinsurance work, and it is the reason an authorized service can still produce a substantial patient responsibility.
This is also why HealthCare.gov's sentence about preauthorization not being a promise of payment is worth keeping in view. Authorization, coverage and payment are three separate determinations made at three different moments, and a yes at the first does not settle the third.
Where to take a question this article cannot answer
Your clinician's office, for anything about the care itself and for submitting or resubmitting an authorization request. Your plan's member services, for whether a service requires authorization, what a pending or denied status means and what the reason code says. Your plan administrator or benefits contact, for what the plan document requires. Your state Department of Insurance, for the timelines and rules that apply to plans regulated in your state and for complaints; the National Association of Insurance Commissioners maintains the directory of state insurance departments, read September 8, 2026. Nothing on this site interprets a diagnosis, a treatment plan or a clinical necessity determination.
Frequently asked questions
What is prior authorization in health insurance?
The NAIC defines it as a requirement for "your doctor or provider to obtain approval from your health plan before providing health care services or prescribing prescription drugs." HealthCare.gov describes preauthorization as a decision by the plan that a service, treatment plan, drug or piece of equipment is medically necessary.
Does prior authorization guarantee my plan will pay?
No. HealthCare.gov states that "preauthorization isn't a promise your health insurance or plan will cover the cost." Coverage and payment are determined when the claim is processed, and ordinary cost sharing still applies.
How long does a plan have to decide?
It depends on the plan. Under the CMS Interoperability and Prior Authorization Final Rule, impacted payers, which CMS lists as Medicare Advantage organizations, Medicaid and CHIP fee-for-service programs, Medicaid and CHIP managed care entities and QHP issuers on the federally facilitated exchanges, must send decisions within 72 hours for expedited requests and seven calendar days for standard requests. Other plans are governed by state rules and their own standards.
What happens if prior authorization was not obtained?
The NAIC states that "without prior authorization, your health plan may not pay for your treatment or medication." The claim may be denied or held, and the plan's notice states the reason and what process is available.
Is emergency care subject to prior authorization?
CMS states that emergency services "must continue to be covered without any prior authorization, and regardless of whether or not a provider or facility is in-network." Questions about how that applied to a particular bill can go to the federal No Surprises Help Desk on 1-800-985-3059.
Sources, all read September 8, 2026: HealthCare.gov glossary, "Preauthorization," no date shown. National Association of Insurance Commissioners, "What Is Prior Authorization?", dated November 5, 2024. Centers for Medicare and Medicaid Services, "CMS Interoperability and Prior Authorization Final Rule CMS-0057-F" fact sheet, dated January 17, 2024. CMS, "Ending Surprise Medical Bills," dated September 10, 2024. HealthCare.gov, "How to appeal an insurance company decision," no date shown. NAIC state insurance department directory. No dollar amount, denial rate or universal timeline is asserted in this article; the timeframes stated are attributed to the payer types CMS names in the rule.