The Prior Authorization Process Explained for Small Practices

The prior authorization process is an insurer's advance review of a proposed service, medication or piece of equipment against its coverage and medical necessity rules, before the treatment is delivered or the prescription is filled. The practice checks whether the plan requires it, submits clinical documentation, answers any follow up questions, and receives a decision.

Prior authorization, also written as preauthorization or precertification, is not the claim. The claim comes later. An approval tells you the payer agreed the service meets its rules going in, and it does not guarantee payment on the way out.

For a two person front office, that distinction is where the work lives. The same employee who answers the phone and checks in patients is often the one chasing a pending request across three payer portals.

Here we cover what prior authorization is, why lean teams feel it differently, the workflow step by step, where requests stall, the part of the clock a practice can actually control, and how to judge technology and outside help without buying a promise nobody can keep.

Key Takeaways:

• Prior authorization is an advance coverage review. Approval does not guarantee payment, and eligibility verification, benefit verification and claims processing are separate tasks from it.
• The American Medical Association's 2025 physician survey reports roughly 40 prior authorizations per physician each week and 13 hours of combined physician and staff work. That is a mixed practice figure, not a small practice measurement.
• A practice controls one half of the clock: the time from clinical order to a complete submission. Payer review time is the other half. Measuring them together hides the only part you can fix.
• Not every denial is the office's fault. The HHS Office of Inspector General found that some reviewed Medicare Advantage prior authorization denials met Medicare coverage rules.
• CMS deadlines of 72 hours for expedited and seven calendar days for standard requests apply to specified payers and covered requests that are not drugs. They are not a universal rule for every plan or medication.

Table of Contents

1. What Prior Authorization Means
2. Why Small Practices Feel It Differently
3. The Prior Authorization Workflow Step by Step
4. How Medication Requests Differ
5. Where Requests Stall and Why They Get Denied
6. The Half of the Clock You Control
7. Building a Workflow a Lean Office Can Run
8. Technology and Outside Help
9. What the CMS Rules Do and Do Not Cover
10. Conclusion
11. Frequently Asked Questions
12. References

What Prior Authorization Means

Prior authorization is an insurer's advance review of certain proposed services, medications or equipment against its coverage and medical necessity requirements. It happens before the service or prescription, and it is separate from the claim submitted afterward.

Approval is not payment. The American Medical Association and CMS both describe authorization and claims as distinct steps, so a practice should treat eligibility verification, benefit verification, authorization and claims processing as four related tasks rather than one.

Insurers describe the review as a check on medical necessity, safety, coverage and appropriate use of resources. Physician organizations describe the administrative work and the treatment delays it produces. Both descriptions are accurate about different parts of the same process, and an office planning its own workflow gains nothing by picking a side.

Three terms worth defining once, because the rest of this article uses them. PA is prior authorization. ePA is electronic prior authorization, meaning the request moves through a supported electronic channel rather than a fax or a phone call.

An EHR is the electronic health record system the practice already uses. A pharmacy benefit manager, or PBM, is the organization that administers drug coverage for a plan, which is why a medication request often goes somewhere different from a surgery request.

Why Small Practices Feel It Differently

A small practice feels prior authorization as a staffing problem rather than a volume problem. In a large group, authorization sits with a department. In a two to five person office, it sits with whoever is free, and that person also schedules patients, verifies insurance and answers the phone.

The published evidence shows a large burden across physician practices. It does not establish a measured ratio between small and large practices, so treat what follows as an operational explanation and not a statistic.

• Limited specialization. Nobody on a small team knows every payer's forms, portals and escalation rules, because nobody does only this.
• Single person dependency. When authorization knowledge lives with one employee, a vacation or a resignation stops follow up.
• Interrupted work. Holding for a payer competes directly with patients standing at the desk.
• Physician rework. Missing clinical information or a peer to peer review sends an administrative task back to the clinician who is already behind.
• Scheduling uncertainty. A pending approval complicates coordination among the ordering office, the pharmacy, the specialist and the facility performing the service.

On scale, the AMA's 2025 prior authorization physician survey reports about 40 requests per physician each week and 13 hours of weekly work across physicians and staff. Read that carefully: it is combined clinical and administrative time, and it describes physician practices broadly, not solo offices.

The Medical Group Management Association's 2026 regulatory burden report collected responses from executives representing more than 230 group practices, 52 percent of them representing practices with 20 or fewer physicians, and 90 percent of responding practices reported that prior authorization burden had grown over the previous 12 months.

That is what respondents reported, not a national census, and a 20 physician group is still not a solo practice.

The Prior Authorization Workflow Step by Step

The workflow runs in eight stages: clinical order, requirement check, documentation, submission, receipt confirmation, payer review, decision, and then either implementation or appeal. The table below breaks those stages into the ten actions an office actually performs, with the checkpoint that matters when there is no authorization department to catch the miss.

Four routes get confused in step ten, and they are not interchangeable. An administrative correction fixes an error and resubmits. A peer to peer discussion is a conversation between the ordering clinician and a payer reviewer. A formal appeal follows the plan's written procedure and its deadlines. An external review is a separate right that applies in defined circumstances.

A peer to peer call is not automatically an appeal, does not automatically extend a deadline, and cannot always overturn a decision. One UnitedHealthcare Hawaii Medicaid policy effective in 2026 makes certain post denial peer to peer discussions informational only, which is exactly why staff should read the plan's own procedure rather than assume the national pattern.

How Medication Requests Differ

Medication and medical service requests share the same shape and different plumbing. A drug request often travels to a pharmacy benefit manager, while a service request goes to the health plan or a delegated utilization management organization.

The timing differs too. A prescription is frequently sent before anyone discovers authorization is required, and the practice finds out when the pharmacy cannot fill it. Electronic prescribing tools can surface some requirements earlier, which turns a reactive scramble into a decision made while the patient is still in the room.

For medications, the information that matters includes patient specific coverage restrictions, covered alternatives, medication history and the clinical reason an exception is being requested.

CMS describes the NCPDP SCRIPT standard as supporting electronic prescribing and drug authorization exchanges, while real time prescription benefit tools supply patient specific restrictions, alternatives and estimated cost. Those are two different capabilities, and not every insurer, EHR, pharmacy or medication supports the same path.

Where Requests Stall and Why They Get Denied

The sources reviewed for this article do not establish a national ranking of denial reasons for solo and small practices. What follows is a list of recurring problems and a practical audit category for each, which is more useful than a ranking anyway.

That last row deserves its own sentence, because the usual advice skips it. Not every denial reflects a preventable office error. The HHS Office of Inspector General examined Medicare Advantage prior authorization denials and found that some of them met Medicare coverage rules.

That finding does not translate into a current all payer denial rate, and it is not a small practice statistic, but it does mean a practice that treats every denial as its own mistake will stop appealing cases it should appeal.

It also helps to separate a rejection for an excluded benefit from a medical necessity denial. They look similar in a dashboard and call for completely different responses.

Ten audit labels, used consistently, turn a pile of denials into something you can act on: clinical information missing, medical necessity disputed, previous treatment evidence missing, eligibility or benefit issue, wrong submission channel, service or provider or date mismatch, duplicate request, additional information deadline missed, payer processing error, reason unclear.

The Half of the Clock You Control

Most advice on this topic blurs two different stopwatches into one number. Separate them and the picture changes.

The first stopwatch runs from the clinical order to a complete submission. That one belongs to the practice. Every hour in it comes from a requirement checked late, a note that was not closed, a missing document, or a request that sat in someone's inbox while they covered the front desk.

The second runs from submission to determination. That one belongs to the payer, shaped by its review process, its criteria and any applicable deadline rules. A practice can influence it only indirectly, by sending a complete packet the first time so the review does not pause for more information.

Offices that track a single number from order to approval end up with a metric they cannot move, and they usually conclude that nothing works. Offices that split the two find that the half they own is often the larger one, and it responds to ordinary process changes within weeks.

Worth measuring, with clearly defined denominators and similar request types compared against each other:

• Median time from order to submission, which is the half you own.
• Median time from submission to determination, read alongside any documentation requests.
• Share of requests that triggered an additional information request, which measures packet completeness.
• Approval rate on first submission, before appeals or reconsideration.
• Denial reasons grouped by payer and service, which shows where a change would pay off.
• Staff touches per completed request, which measures rework.
• Requests sitting past their next action date, which measures the queue itself.
• Appeals submitted and their outcomes, which shows whether escalation actually finishes.

One caution on all of it. These numbers tell you where your own process leaks. They do not predict payer behavior, and no workflow change eliminates payer side delay. Any vendor or service promising a specific reduction in denials without seeing your data is selling a number they invented.

Building a Workflow a Lean Office Can Run

The guidance below adapts professional recommendations on ownership, documentation, tracking and communication to an office where nobody does this full time.

One queue, one owner, one backup

Name an authorization coordinator and a trained backup. Neither has to be a new hire. The point is that a request always has a person attached to it, which is what fails first when the role is shared by everyone.

Fields worth carrying in the queue: patient identifier and ordering clinician, payer and specific plan, requested service or medication, owner and backup, clinical urgency, submission date and reference number, current status, missing information, next action and deadline, determination details, and appeal status where it applies.

Use an EHR worklist or another appropriately secured system. A general spreadsheet that quietly fills with patient information is a problem waiting to happen.

Standardize the first packet

Build short templates for the request types the practice sends most often, using the payer's current requirements. Useful fields are the indication, relevant examination or test findings, previous treatments and their outcomes, contraindications, and the reason this intervention is being requested.

A template should prompt accurate documentation, never insert facts nobody established. Staff can assemble the packet. The treating clinician stays responsible for every clinical statement in it.

Check requirements at ordering, not at scheduling

Requirement checking belongs next to the order, while the clinical reasoning is fresh and the patient is still reachable. A short reference sheet covering the practice's most frequent payer and service combinations speeds this up, as long as everyone understands it is a navigation aid and not a substitute for verifying the patient's current coverage.

Triage by clinical need

Separate urgent clinical situations from routine administrative work. Expedited review exists for clinical circumstances, and using it to rescue a scheduling backlog is both a misuse and a habit payers notice. Batch routine status checks. Escalate clinical deterioration or time sensitive treatment questions to the clinician the moment they appear.

Write down the escalation path

Decide in advance who chases missing records, who calls the payer, and when the physician has to step in. Keep payer correspondence and call notes together, because an appeal written from memory is a weak appeal.

Close the loop with the patient

Tell patients when authorization is required, what is outstanding and what happens next. Coordinate with the pharmacy or the performing facility so an approval does not go unused because the next organization never heard about it. Do not promise an approval date the practice does not control.

Technology and Outside Help

An online form is not an integrated workflow. That single confusion drives most disappointment with authorization technology, so it is worth separating the options before comparing prices.

Questions worth asking any vendor: Does the product handle medical services, drugs or both? Which of our actual payers and plans are connected? Can it identify requirements before submission, or only after?

Does it pull data from the EHR or just open a portal? Can staff see missing information and pending requests in one queue? Are decisions written back into the patient record? Can we retrieve acknowledgments and audit trails? What happens when the electronic workflow fails? What does setup, training and the recurring fee actually cost?

Then pilot it on a few frequent request types and compare real staff time, packet completeness and outcomes before expanding. A pilot is cheaper than a migration.

If you add a person instead of software

Many small practices solve this with staffing rather than technology, because the work is phone calls, portals and follow up. A remote administrative hire can own the queue, assemble packets, submit, chase additional information requests and keep the tracker current, while clinical judgment stays with the clinician.

Two things have to be true before that works. First, the scope has to be written down: intake, submission, follow up, appeal support, patient communication and clinician escalation are separate responsibilities, and a standard billing contract does not automatically include any of them.

Second, an outside organization handling protected health information on a practice's behalf may be a HIPAA business associate, which requires a written agreement and appropriate safeguards. The same applies to cloud arrangements holding electronic protected health information.

Contract checks worth running: specialty and payer experience, named responsibilities and turnaround expectations, access permissions and any subcontractors, the business associate agreement, audit trails and reporting, escalation to the treating clinician, data return at termination, and transparent pricing.

Ignore any claim that outsourcing guarantees approvals, eliminates denials or automatically handles your regulatory obligations. Nobody can promise that, and the ones who do tend to be the ones who disappear when an appeal deadline is missed.

A dedicated remote administrator working United States hours commonly runs 1,000 to 1,600 USD a month, which is why practices that cannot justify a full time domestic coordinator still manage to give the queue a real owner.

Remote Latinos places vetted bilingual administrative professionals from Latin America, and teams comparing this route can hire a vetted remote administrative professional or look at the roles most commonly staffed remotely before deciding what to hand over.

What the CMS Rules Do and Do Not Cover

For specified payers and covered requests that are not drugs, the CMS Interoperability and Prior Authorization Final Rule generally sets decisions within 72 hours for expedited requests and seven calendar days for standard requests, beginning in 2026.

Read the scope before quoting the deadline to a patient. The affected payer categories include Medicare Advantage, state Medicaid and CHIP fee for service programs, Medicaid managed care, CHIP managed care entities, and Qualified Health Plan issuers on federally facilitated exchanges.

The deadline provision itself excludes those exchange issuers, even though they are included in other parts of the rule. None of it is a universal rule for every commercial plan, every medication, every appeal or every clinical situation.

Procedures for additional information can also affect processing. Alabama Medicaid's implementation, to name one, describes an extension process when required documentation is missing. Do not assume every incomplete request automatically pauses or restarts the clock across all payers.

On the electronic side, the finalized requirements generally move toward prior authorization API implementation starting in 2027, with timing varying by payer type. That is a direction of travel, not a description of what a small practice has in hand today.

Drug requirements are a separate story. CMS's 2026 drug interoperability materials describe additional drug related requirements as proposals, while some technical standard updates have been finalized separately. Treat proposed obligations as proposed until the rule says otherwise, and recheck the CMS pages before relying on any deadline sensitive detail, including the ones in this article.

Conclusion

Prior authorization is an advance coverage review, not a payment decision, and it runs on documentation a practice either prepares early or scrambles to produce late.

Small offices lose time on the administrative half of the process, which is also the half they can fix. Name an owner and a backup, check requirements at ordering, standardize the packet, track every request with a next action date, and read determinations instead of summaries.

What those steps cannot do is remove payer side delay or guarantee an approval. Measure the two halves of the clock separately and you will know which problem you are actually solving.

Coverage questions for a specific patient belong with the plan, and treatment decisions belong with the treating clinician. This article explains the process, not any individual case.

You can also read:

• What Is a Legal Intake Specialist? Duties, Skills, and Cost
• How Much Does Bookkeeping Cost for a Small Business?

Practices weighing whether to add administrative help can see how other owners structured it in the client testimonials, or book a call to talk through the scope first.

Frequently Asked Questions

What is the prior authorization process?

Prior authorization is an insurer's advance review of certain treatments, services or medications. The practice checks the requirement, submits supporting clinical information, answers any follow up questions and receives a decision. Approval does not guarantee payment, and a denial may have an appeal route attached to it.

Who typically initiates the prior authorization process?

The ordering practice usually starts it, after a clinician orders a service or writes a prescription. For medications, the request is sometimes triggered later, when the pharmacy cannot fill the prescription and notifies the prescriber. Patients can ask about requirements, but the clinical documentation comes from the practice.

How long does prior authorization take?

It depends on the payer, the request and the rules that apply. For specified requests that are not drugs, CMS requirements generally set decisions within seven calendar days for standard reviews and 72 hours for expedited reviews. Those deadlines do not apply to every health plan or every medication.

Is there a standard prior authorization flow?

Yes, at the level of stages: clinical order, requirement check, documentation, submission, receipt confirmation, payer review, decision, then implementation or appeal. The forms, portals and criteria inside those stages vary by payer and by plan, which is why a practice needs its own payer reference sheet rather than one universal flow chart.

Does prior authorization approval guarantee payment?

No. Authorization is an advance coverage review. The claim is a separate step with its own requirements, and eligibility and benefit verification are separate again. Treat an approval as permission to proceed under stated conditions, then reconcile it against the service, provider, location and dates actually delivered.

Is a peer to peer discussion the same as an appeal?

No. A peer to peer is a conversation between the ordering clinician and a payer reviewer. A formal appeal follows the plan's written procedure and its deadlines, and external review is a separate right in defined situations. Some plans treat post denial peer to peer discussions as informational only, so check the plan's own procedure and keep tracking appeal deadlines while the conversation happens.

How can small practices reduce prior authorization delays?

Assign an owner and a backup, check requirements at the time of ordering, submit complete clinical records the first time, and track every request with a next action date. Use supported electronic workflows where they exist and write down the escalation path. These steps close avoidable administrative gaps. They do not remove payer side delay.

Can a remote assistant handle prior authorizations?

A remote administrative professional can own the queue, assemble packets, submit requests, chase additional information and keep the tracker current. Clinical statements and treatment decisions stay with the clinician. If that person or their employer handles protected health information on the practice's behalf, the arrangement may require a HIPAA business associate agreement and appropriate safeguards, so settle that before access is granted.

References

American Medical Association. (2025). 2025 AMA prior authorization physician survey.

American Medical Association. (n.d.). Prior authorization practice resources.

American Medical Association. (n.d.). Prior authorization and utilization management reform in private practice. AMA STEPS Forward.

Centers for Medicare and Medicaid Services. (2024). CMS interoperability and prior authorization final rule fact sheet.

Medical Group Management Association. (2026). Annual regulatory burden report.

Office of Inspector General, United States Department of Health and Human Services. (2022). Some Medicare Advantage organization denials of prior authorization requests raise concerns.

United States Department of Health and Human Services. (n.d.). HIPAA guidance on cloud computing.