Payer coverage policy tracking, explained.

What payer policy tracking is: watching the rulebooks that decide who gets a medicine paid for

One psoriasis policy, from committee vote to a patient's denied request

1. The committee votesCrestline's pharmacy and therapeutics committee approves new psoriasis criteria on September 29, 2026.
2. The policy is postedRevision 14 appears on the plan's website at 8:40 am on October 7, with an effective date of November 1. Nobody sends a letter.
3. Somebody notices and reads itA person, or a system, finds the new version, compares it with the last and checks it against the contract. This is the step this guide is about.
4. People respondThe account director objects in writing. The field team and hub staff learn what offices must now send.
5. Patients meet the ruleFrom November 1, requests that would have passed on October 31 come back denied, unless the plan has changed its mind.

The plan, medicines and dates in this example are fictional.

Why PA criteria changes are easy to miss, and costly when you do

Prior authorization, step therapy, formulary, covered lives

Fourteen terms are defined in the one-page summary.

Medical policies, pharmacy policies, PBM formularies and Medicaid preferred drug lists: four document families to monitor

In shortA US patient's drug coverage can be set by a health plan, a pharmacy benefit manager (PBM), a state Medicaid agency or a Medicare drug plan, and each publishes in its own format. A medicine given by infusion in a clinic usually sits under a different document from the same medicine taken at home. A watch list, the set of sources a team checks, has to cover all of them, or it has holes you cannot see.

A pharmacy benefit covers what a patient collects from a pharmacy. A medical benefit covers what a clinic or hospital buys and gives. Same plan, often different department, different policy number and different rules. A drug that starts with an IV dose in a clinic and continues as a home injection can be covered by both.

Behind many plans stands a PBM, a company that negotiates with drug makers, builds formularies and runs PA and step therapy on the plan's behalf.6 Its national formulary works as a template. A plan may adopt it or decline it, so a change at the PBM may or may not reach a given patient.7

What each payer document looks like and how often it moves

Formats are our description of typical documents; plans differ. How often a typical plan revises a given policy is not published as a statistic. Count your own over a quarter. A biosimilar is a close copy of a biologic, a medicine made from living cells; a private-label biosimilar is one sold under a brand tied to a PBM.

Specialty drug coverage keeps getting stricter than the FDA label, and step therapy leads the way

In shortThe best public record, a Tufts database of 17 large commercial plans, shows restrictions beyond the label rising between 2017 and 2021, while outright exclusions held near 3%. A separate study found that more than half of step therapy protocols it examined were stricter than clinical guidelines, and nearly all of them in psoriasis. These figures end in 2021, and we found no newer national trend, so use them for direction only.

Specialty drugs are the expensive, often injected medicines this guide follows. The FDA label says who a medicine is approved for. A coverage policy says who the plan will pay for. Plans are free to draw a narrower line, for cost or clinical reasons, and the gap between the two lines is what access teams spend their time on.

Outright exclusions from coverage stayed near 3% throughout, and 13 of the 17 plans increased their restrictions.3 Most of the rise came from step therapy, up from 25.8% to 34% of policies, and prescriber requirements.3,2 The sample is large commercial plans, so it says nothing directly about Medicaid or Medicare.

The same study found plans applied step therapy to 38.9% of specialty coverage policies, ranging from 20.6% at one plan to 57.5% at another.13 That spread is why a national summary tells you little about a given plan.

Crohn's disease looked different: 67.8% of its protocols were consistent with the guideline.14 Medicare drug plans moved the same way: the share of compounds restricted by PA, step therapy or exclusion rose from 31.9% in 2011 to 44.4% in 2020.6

Fast shifts: what happened to GLP-1 coverage in state Medicaid

Coverage can also move quickly and by whole programs. KFF counted 16 state Medicaid fee-for-service programs, where the state pays claims directly, covering GLP-1 medicines for obesity in October 2025. California, New Hampshire, Pennsylvania and South Carolina then dropped coverage and North Carolina restored it, so the count was 13 in January 2026.15 Anyone tracking that class in that window had five state programs to catch within months.

Which rules govern a payer's notice of formulary and PA changes, plan type by plan type

In shortNo single US rule tells every plan how to post or announce a coverage change. Part D has a 30-day notice rule. Medicare Advantage must make internal criteria publicly accessible. Exchange plans must keep a public drug list. Medicaid has a 24-hour answer rule for drugs. State laws cover some of the rest, and self-funded employer plans mostly sit outside them. The federal PA rule that took effect in 2026 leaves drugs out.

Four names come up below. Medicare Part D plans are private drug plans for people on Medicare. Medicare Advantage plans are private plans that replace traditional Medicare, and they cover drugs given in a clinic under Part B. Medicaid is the joint federal and state program for people with low incomes, and CHIP is its counterpart for children. Exchange plans are the plans people buy on the Affordable Care Act marketplaces. Employer plans split into fully insured and self-funded, explained in section 05.

A simplification for orientation, and our own. State rules vary, and a contract may add promises of its own. Ask counsel about any specific plan.

Step therapy laws in 38 states stop short of most employer plans: the same change can be contestable in one place and untouchable in another

In shortThe American Bar Association's 2026 overview counts 38 states plus D.C. with some form of step therapy regulation, and Illinois has banned it for the plans the state can reach. Those laws do not reach self-funded employer plans, which cover 67% of covered workers. A federal bill to close that gap had not passed when we checked.

State step therapy laws usually give a doctor a way to ask for an exception, with a deadline for the answer. They govern insurance that a state regulates: fully insured plans, where the employer buys a policy from an insurer. A self-funded plan, where the employer pays claims itself and hires an insurer to administer them, falls under a federal law, ERISA, which pushes aside many state plan rules.17

The law here is still moving. In 2020 the Supreme Court let states regulate PBM reimbursement rates in Rutledge. In 2023 a federal appeals court, the Tenth Circuit, read that narrowly in Mulready, finding ERISA preempted parts of an Oklahoma law, and on June 30, 2025 the Supreme Court declined to hear the appeal.32,30 A denial decides nothing about who is right, so the appeals courts are left to work this out.

The federal Safe Step Act (S. 2903, H.R. 5509) would give ERISA plan members an exceptions process. Senators were still adding their names in March 2026; we found no record of passage.33,34

What an office can do when a plan adds a step, by type of coverage

A map of state law does not tell you which patients it helps: only your plan-level funding data can. Whether a given plan is insured or self-funded is rarely stated in its coverage policy.

Three PBMs handle most US prescriptions, and their formulary exclusion lists now top 600 products each

In shortThe FTC reports that the three largest PBMs manage 79% of prescription claims. One line in one of their exclusion lists can move more lives than a dozen regional plans, and every fall brings a new list. Those lists are defaults that a plan sponsor, the employer or other body paying for the plan, can decline, so a watch list needs both the PBM's document and each plan's choice.

"Now" is the FTC's July 2024 report; it also says the top three processed nearly 80% of about 6.6 billion prescriptions in 2023.6

Drug Channels, which reads the published lists each year, reports that each big PBM's 2026 exclusion list holds more than 600 products. Growth plateaued at two of them and continued at the third. It calls the lists "suggestions", because a sponsor can decline the standard formulary, though it may then face lower rebates or higher costs.7

Two more findings matter for anyone tracking a biologic. For large brands with biosimilars, PBMs increasingly favor biosimilars sold through their own affiliated private-label businesses. And Drug Channels found little evidence that medicines with a Medicare negotiated price were broadly excluded from commercial formularies in 2026.7 Only one of the three discloses tier status on its public formularies, so tier moves can be harder to see than exclusions.7

How PBM rules and rebates connect to coverage criteria

The FTC describes rebates paid "in exchange for favorable formulary placement", and says PBMs and manufacturers sometimes enter agreements that require PA and step therapy to discourage use of generic drugs.6

The Consolidated Appropriations Act, 2026 will change some of the money. Part D PBM pay must be delinked from drug prices and rebates from January 1, 2028, with a full pass-through of rebates to ERISA plans effective 30 months after enactment, in practice January 1, 2029 for calendar-year plans. Larger plans will get reports that explain formulary placement for categories above $10,000 in gross spend.29 When those reports start, expect more plan-level questions about why a formulary says what it says.

How to read a prior authorization policy change, criterion by criterion, against the last revision

In shortA policy is easier to compare when you stop reading it as prose and treat it as about a dozen fields: status, tier, PA, steps, thresholds, prescriber, labs, approval length, limits, site of care. Fill those fields for the old and new versions, line them up, and the real change stands out. Then mark up the text itself in a redline, with removals struck through and additions shown, and read the sentences around the change, because "AND" and "OR" alter the rule.

The fields every coverage criteria record needs

Reading AND, OR, trial length and "for new starts"

• AND against OR. "One TNF inhibitor OR Ostrelix" lets the patient choose. "One TNF inhibitor AND Ostrelix" means two failed drugs before yours.
• "Preferred" names change meaning. "Preferred TNF inhibitor" may point to a list in another document. A step can tighten when that list changes and the policy text does not.
• "New starts". A rule may spare patients already on therapy. Whether they stay spared at renewal is a separate question.
• Trial length. "Tried and failed for at least 12 weeks" costs a patient three months, where "tried" could cost a day.
• A form with a new box. Criteria unchanged, and yet offices using the old form have requests returned.

Market access contract compliance: checking a policy change against access terms, notice days, cure periods and rebate leverage

In shortDrug makers pay rebates in return for access, and the contract spells that access out in clauses a policy change can break. Those clauses only help if someone notices in time: you count the notice days, quote the clause, send a written notice, and only then does a cure period, the days the plan has to fix the problem, start. Competitor-step clauses also carry antitrust questions, so counsel should see them.

Rebate agreements are private, so nobody publishes how common each term is. These are the usual kinds of promise a manufacturer buys, each shown with the fictional wording from the example. TNF inhibitors and IL-23 inhibitors, named below, are two classes of biologic used in these diseases.

Counting the Crestline days: notice given, cure period, and what is left

Two points people miss. First, each day you wait to send your notice moves the cure end later, and the patients are affected from the effective date either way. Second, read which sections the remedy covers. In this sample, §9.3 attaches to Section 4, so the rebate remedy rests on the competitor step. The late notice under §7.1 is a term not met, and it has no rebate consequence of its own in these words.

How to build a payer access map: covered lives with contracted access, state by state, without double counting

In shortAn access map shows, for one product and indication, what share of a state's covered lives can get the drug on contracted terms. You weight each plan by its lives in that state. Showing two versions, in force today and as posted, lets you see a change before it lands. The arithmetic is easy; the input data is where errors hide.

Take Ohio in the example. The state's view counts 10.9 million lives across the plans below. As posted, Crestline's 2.02 million drop out of contracted access, because a step through a competitor is what the contract forbids.

Fictional example; the plan-level figures appear again in section 15. National access barely moves, from 94% to 93%, because 3.1 million lives are small against the whole country.

This is why a national number hides the work. The change is 1 point nationally and 18 points where the plan's members live, and that is where offices and field teams will feel it.

Four ways a covered-lives figure misleads you

What a late catch costs patients and brands: denied requests, abandoned treatment and rejected fills

In shortNobody publishes what a late catch costs, but public data shows what happens downstream of a tighter policy. About 46% of branded fills rejected for PA in one 2024 national analysis were in the end rejected again. Physicians report handling about 40 PAs a week. In Medicare Advantage, few denials are appealed, though most appeals win at least in part. And claims data is a slow way to learn: a vendor puts the lag at 60 to 90 days, with no study behind it.

Wang and colleagues, using claims covering about 58% of national retail pharmacy transactions. The design cannot show what patients did next, and the data has no record of prescriptions approved immediately.37

Physicians see the human side. In the American Medical Association's survey of 1,000 physicians in December 2025, they reported about 40 PAs per physician per week, taking 13 hours of physician and staff time. Of them, 95% said PA delays access to necessary care, and 79% said it at least sometimes leads patients to abandon treatment.38,39 Those are physicians' reports, on all kinds of care.

KFF counted 52.8 million determinations in Medicare Advantage in 2024, 7.7% denied. This is Part C, which covers clinic-administered Part B drugs among all other services, and excludes Part D prescriptions as far as KFF's brief describes.40

Why claims data is a slow way to detect a policy change

A tighter policy reaches sales numbers only after offices send requests, plans answer and pharmacies report. One analytics vendor puts that at 60 to 90 days after a change, without citing a study.41 Treat it as a claim to test on your own data. To measure it, take five past changes with known effective dates and find the week your prescription trend first bends. Meanwhile the contract's notice window has often closed, since that clock began with the posting.

Eight ways payer policy monitoring goes wrong: moved links, unwatched benefits and dates read wrongly

In shortNo agency inspects this work, so there are no warning letters to count. The errors below come from how the documents behave and how teams divide the work. Most fall into one of three kinds: you never saw the change, you saw it and misread it, or you read it right and the right person heard too late.

What field reimbursement teams can say about a coverage change, and what hub data can show

In shortA coverage change often has to reach doctors' offices. What a manufacturer's staff may say is limited by federal rules on promotion and on inducements, so compliance reviews the words. Patient hubs hold sensitive records, so impact figures should stay totals, with very small counts hidden.

A field reimbursement manager helps offices understand coverage: what a plan asks for and which form to use. Those conversations are valuable and sensitive at the same time.

A statement that a plan will approve a patient is a promise no one can make. A statement about how well the drug works turns a coverage note into promotion. And free help tied to prescribing can raise questions under the federal Anti-Kickback law on paying for referrals, which is why companies route this through compliance. The General Compliance Program Guidance from OIG, the US health department's inspector general, is voluntary and is the usual starting point.42

Counting patients on therapy and hub cases without moving patient records

To price a change, you want to know how many patients are on the drug at that plan and how many hub cases are open. That needs a count, and the patient's identity adds nothing to it. Keep patient-level data inside the hub system and move only totals.

Small counts can still point to a person: CMS's rule for its research data forbids reporting any cell from 1 to 10.43 That policy binds CMS data users, and it makes a sensible floor for your own reports. Ask your privacy officer how it applies under HIPAA, the federal health privacy law.

What AI can do with payer policies, where it stops, and why most AI guidance for drug makers sits elsewhere

In shortSoftware can now read long, messy PDFs into structured criteria, line up versions and sit a contract clause beside a passage. It can also misread a table or lose a footnote, so every field needs its page and a person must confirm any finding that leads to a letter. Most drug-sector AI guidance is written for regulatory submissions and manufacturing; this is commercial work on public documents. That leaves the controls for you to set.

Which AI guidance reaches payer policy tracking

Limits to plan for in automated policy reading

• Sign-in and terms of use. Some documents sit behind provider portals or licensed feeds. Respect the terms, and record which source you read.
• Layouts. Tables that break across pages, footnotes and scanned PDFs are where a reader, human or machine, gets a field wrong.
• Meaning. Is "stricter than the label" a breach of your contract? A model can flag the question. A person answers it.
• No shared yardstick. We found no public accuracy benchmark for extracting PA criteria by software. Build a gold set from 50 of your own policies and measure on it.

Who monitors payer policies at a drug maker today: analysts, account directors, contracts, field and compliance

In shortSix groups touch a policy change, and they usually work in different systems. A typical path runs from a weekly feed email to a spreadsheet, a separate contract lookup, a review meeting and a field message, with hand-offs at each step. How long that takes is unpublished. Teams run it in house, buy data feeds and analyst validation, or use software, and many mix them.

The six roles a psoriasis or Crohn's policy change passes through

Durations are our own estimates, and no public survey measures them. The one published figure we found, a vendor's 60 to 90 days, is about claims data.41

Three ways access teams run payer policy monitoring

Crestline's revision 14: found in 32 minutes, read, redlined, checked against two clauses and answered with a signed notice

In shortThis is the example from the top of the page, inside the product. Six agents fetch, read, compare, count and check, then draft. Lena Ortiz, the payer intelligence lead, confirms the finding. Sam Patel, the account director, signs. Dana Okafor runs the cure clock. No agent decides a breach or sends anything.

1

The map moves as the new version arrives

Lena's home screen is a map of the United States, shaded by the share of lives who can get Veltrimab for psoriasis as contracted, across 412 payer policies, PBM formularies and Medicaid lists in 64 plans. At 8:40 am Crestline Health posts revision 14 of RX-PSO-117. The 9:12 am hourly check of the 31 plans over 1 million lives finds it, 32 minutes later.

The change wire, a running list on the right, fills in: new step through a competitor, a higher skin-area threshold, shorter renewal, 25 days' notice. On the map, Ohio, Kentucky and West Virginia leave the top band, each marked with its old value.

2

One click shows who in Ohio is affected

Lena clicks Ohio. Crestline carries 2.02 million lives there, now marked "Step through a competitor". Northgate Rx, Harbor Union Rx, Larchmere Medicare Rx and other plans stay where they were.

The arithmetic is the one from section 09: the plans at contracted access add up to 79% of the 10.9 million lives counted in the state.

3

The redline shows three words that matter

The review opens on the policy text against revision 13. Line 4 gains "AND to Ostrelix". The skin-area threshold goes from 3% to 10%, and renewal from 12 months to 6. The dates change too, and the notice works out to 25 days.

The left column separates what changed from what stayed: age, dermatologist, TB test, no other biologic, quantity limit. Listing the unchanged criteria means nobody has to wonder whether they were read.

4

Two clauses quoted beside the policy, and one flagged for a person

The Contract Guard reads the Crestline 2026 Commercial Formulary Agreement, read-only, from the contract system. §4.2 says the plan shall not require a member to try or fail any Competitive Product, and Exhibit B names Ostrelix. §7.1 asks for 60 days' written notice, and 25 were given. Two terms not met.

The third card flags the 10% threshold as stricter than the label. The screen reasons that parity holds, since Ostrelix has the same threshold, and does not count it. Read §4.5 closely, though, and it sets two tests: no stricter than the label, and no stricter than a competitor. A lawyer could count this one. That is the kind of question the product leaves to people.

5

The notice is drafted, confirmed and signed by people

Lena presses "Confirm and draft notice". The drafter writes on the legal team's template: what changed, the terms not met, what Northwind Bio asks. Every statement carries a citation. It asks Crestline to remove the step before November 1 and to confirm in writing within 30 days.

Lena sends it to Sam. He signs, it goes, and Dana starts the 30-day cure clock, which ends November 6. Remember from section 08 that the effective date comes first, so the notice has to go out early to mean anything.

The solution's design targets are a median of 0.9 days from posting to a cited alert, and all 412 sources checked every 4 hours with the 31 largest plans each hour. Those are targets to measure on your own plans. The 45-to-90-day figure on the dashboard for the old way is an estimate from the solution's own team; no public study measures it. The 32 minutes belongs to this sample.

The rest of the tracker: in-force views, the criteria database, parity, site of care, new PA forms, field briefs and settings

In shortOne revision makes a good story, and a real month holds many kinds of change. These screens show the others: the same map in force today and for another disease, the contract terms at a glance, a parity break, a medical-benefit site-of-care rule, a new form, a step at a plan with no contract, a good-news brief, the database of criteria, the dashboard and the settings.

Six agents read and draft; the payer intelligence lead, the account director and compliance decide

In shortEach agent does one job and has a written limit. People confirm every breach, sign every notice and approve every field brief. Every step goes on the trail. Contract terms stay in your contract system, and hub data arrives as counts.

Who signs a breach, a notice and a field brief

Enterprise controls: roles and separation of duties, maker-checker on notices and briefs, an exportable audit trail, sources and contract systems connected through integrations. Botminds is SOC 2 Type II audited and manages information security to ISO 27001. This is commercial work outside GxP scope, so the guide makes no claim about GxP, Part 11 or Annex 11.

The payer documents, contract terms and hub counts that go in, and the alerts and notices that come out

Connecting a tracker to your contract system, hub and data feeds

What a missed step therapy change costs you: rebates paid without access, lost new patients and field teams working from old criteria

In shortPublic data shows how strict coverage has become, and what happens to rejected prescriptions. It cannot tell you what your own misses cost, because nobody publishes that. A week with your own records will. Six numbers cover most of it, and you can find them all from documents you already hold.

Six costs of a late policy catch, and how to measure each in a week

Reputation with plans, contract leverage and other costs a calculator misses

What faster policy tracking returns when you count analyst hours, rebates at stake and new patients at risk

In shortPut in your own numbers. The calculator counts three things: analyst time, rebates you could stop paying sooner when a plan breaks a term, and new patients kept by catching a change earlier. Every default is an assumption to replace; no public benchmark exists for any of them.

Time, contract leverage and patients: where a payer access team gains

Material changes a year, rebates at stake and the value of earlier notice

Is your market access team ready to automate policy tracking? Eight scored questions and one to think about

In shortScore each question from 0 to 2. The result says whether to build your baseline first, run a pilot, or plan the rollout. Your answers stay on this page.

What to ask any payer policy tracking vendor about coverage, accuracy, contracts and control

In shortMost demos look alike on a clean PDF. These questions separate them on the hard cases: a scanned file, a changed cross-reference, a clause that needs judgment and a failed fetch. Ask us too.

A 12-week payer policy tracking pilot on two products and twenty plans

In shortStart with the plans that hold most of your lives and the two contracts your team knows best. Build a gold set from past changes, run a parallel period against your current process, measure, and decide. Keep the people who confirm and sign exactly as they are today.

What to measure in a coverage tracking pilot, and the result that counts as a pass

Payer policy tracking and formulary monitoring: the questions people search for

In shortTwelve short answers on what the work is, which rules apply and how far AI can be trusted with it.