Prior authorization workflow at a health plan: where review time goes

A health plan's prior authorization workflow has six steps: intake and eligibility, choosing the medical policy that applies, reading the clinical record against each criterion, asking the provider for anything missing, deciding, and issuing the notice. Since 1 January 2026 the whole sequence must finish within 7 calendar days for a standard Medicare Advantage request and 72 hours for an expedited one, and a late notice counts as an adverse decision. Review time goes mostly on the third and fourth steps: finding the page that proves each criterion in a record of dozens to hundreds of faxed and scanned pages, then waiting for the provider to send what was missing. Botminds' Prior Authorization Automation reads the record against the policy before the nurse opens the request, quotes the passage and page for each criterion met, and drafts a records request naming the exact documents for any criterion left open, so the nurse's time goes on judging the evidence and the physician's on the contradicted cases.

This guide is written for utilization management directors, prior authorization operations leaders and the medical directors who staff and answer for the workflow. The examples come from the solution's fictional sample worklist; the rules are quoted from the federal regulations and the volumes from KFF and HHS's Office of Inspector General, linked where they appear.

What are the steps in a health plan's prior authorization workflow?

The steps are the same whatever the service: the request is logged and the clock starts, eligibility and the need for authorization are confirmed, the policy and its edition are chosen, the record is read against each criterion, missing documents are requested, and a qualified person decides and the notice goes out. What differs by request is how long each step takes, and that depends mostly on the record.

The clocks the workflow must finish inside

The shortest clock that applies to the member's coverage sets the workflow's deadline, and in 2026 the Medicare Advantage and Medicaid clocks got shorter. A standard Medicare Advantage decision on an item or service subject to prior authorization is due "7 calendar days after receiving the request for the standard organization determination," down from 14 (42 CFR 422.568); an expedited one within 72 hours (42 CFR 422.572). If the plan fails to give timely notice, "this failure itself constitutes an adverse organization determination and may be appealed."

A plan that serves all four markets runs four sets of clocks on one worklist, and the workflow should sort by time left, not by arrival. The 72-hour clock runs through nights and weekends, so the staffing model needs cover on days the provider offices are closed. The ERISA claims rule sets "not later than 15 days after receipt of the claim by the plan" for a pre-service claim and "not later than 72 hours after receipt of the claim by the plan" for an urgent one (29 CFR 2560.503-1).

Where does the review time go on one request?

On a standard request with one criterion missing from the record, Botminds estimates that a plan working by hand uses about 6 of its 7 days: half a day on intake and policy, a day reading the record, a day and a half before the right records request goes out, two and a half days waiting for pages, and half a day deciding and issuing the notice. The waiting is the largest block, but the day and a half before the question is asked is the part the plan controls.

Inside the reading step, the nurse's hours go on search rather than judgement. A request can arrive as a one-page order or a chart of several hundred pages, faxed in batches, with the office note that matters on page 140 and three copies of the same lab report; the eight requests on the solution's sample worklist carry between 22 and 186 pages each. The judgement, whether a passage meets the criterion as the policy intends, takes minutes once the passage is found.

Search is also where errors start. Describing the manual reviews behind wrongly denied Medicare Advantage payment requests, the Office of Inspector General wrote that "these manual reviews are susceptible to human error, such as a reviewer's overlooking a document in the case file or inaccurately interpreting CMS or MAO coverage rules" (OEI-09-18-00260). KFF's figure that 80.7% of appealed Medicare Advantage denials were overturned in 2024 is the cost of that error to the plan: rework, a second review and a member who waited. Insufficient documentation denials sets out what happens when the page was in the file.

The records request: the step that decides the elapsed time

A records request decides how long a request waits, because the clock does not stop while the provider looks for documents. A vague request for "supporting documentation" brings back the wrong pages and starts a second round; one that names the criterion, the documents, the facility and the dates usually brings back the right ones the first time.

In the sample, the knee replacement request's open criterion was at least six weeks of supervised physical therapy. Page 14 said the member "completed a course of PT" at an outside clinic, and the history agent found 12 therapy visits approved and billed over seven weeks: the therapy happened, but no page showed it. The drafted fax named three documents, the therapy clinic's initial evaluation, visit notes covering at least six weeks, and the discharge summary, with a reply-by time 48 hours before the decision was due. The nurse sent it at 09:52; at 10:31 a 14-page fax from the surgeon's practice was matched to the request, and the criterion ticked on pages 187 and 199.

The open criterion becomes a fax naming the exact documents

Who may deny a prior authorization request?

In Medicare Advantage a nurse may prepare an adverse medical necessity decision but may not issue it without review by a qualified professional, and most plans reserve that review for physicians. The workflow must route every expected denial accordingly.

“If the MA organization expects to issue a partially or fully adverse medical necessity … decision based on the initial review of the request, the organization determination must be reviewed by a physician or other appropriate health care professional with expertise in the field of medicine or health care that is appropriate for the services at issue, including knowledge of Medicare coverage criteria, before the MA organization issues the organization determination decision.”

42 CFR 422.566(d), Medicare Advantage organization determinations

Medicaid managed care uses different words: any decision to deny or reduce a requested service must "be made by an individual who has appropriate expertise in addressing the enrollee's medical, behavioral health, or long-term services and supports needs" (42 CFR 438.210(b)(3)). The workflow consequence is an asymmetry worth designing for: a nurse can approve alone when every criterion is shown, while every request heading for a denial needs a second, qualified reviewer. Sending the physician only the contradicted criteria, with the passages for and against quoted in full, is where physician time is saved; prior authorization denial reasons sets out what the notice must then say.

How many prior authorizations can a nurse review in a day?

No public benchmark measures it, and a number without its mix of services and record sizes means little: outpatient imaging requests with three-page orders and inpatient rehabilitation admissions with 60-page hospital charts are different work. The useful figure is the plan's own, decisions per nurse per day by service line and record size, and it can be estimated before it is measured.

Volume completes the model. Medicare Advantage insurers averaged 1.7 prior authorization requests per enrollee in 2024 (KFF), so a plan can estimate requests per week from enrolment and its own request mix, divide by reviews per nurse-day, and add cover for weekends on the 72-hour clock. A pilot on the plan's own closed requests, as the pilot guide describes, replaces the illustrative minutes with measured ones before anyone plans staffing on them.

What changes in the workflow when Prior Authorization Automation reads the chart first

The nurse's first screen changes from a pile of pages to a list of criteria. Every request on the worklist has been read and checked against its medical policy before the nurse opens it, and the worklist is ordered by the clock. Inside a request, each criterion is met, with the passage quoted and the page one click away; open, with what was searched and what document would close it; or contradicted, with both passages, routed to a physician.

The worklist in Prior Authorization Automation is sorted by the clock, every request already read

The controls stay with people. The approve button reads "Approve · 1 open" until the last criterion has evidence, and a nurse may approve only when every criterion is met unless the plan changes that setting; the agents never recommend a denial. In the sample, the knee replacement was decided on day 3 of 7, and the approval notice listed each criterion with the page that proves it.

What should a utilization management leader measure?

Decisions within the clock, by request type, are the first measure, because a late notice is itself an adverse decision in Medicare Advantage. Behind it sit the measures that explain it: time from arrival to the first records request, records requests answered with the right documents first time, criteria left open by policy, and the share of physician reviews that turn on a contradicted criterion rather than a missing page.

Decisions on time, and the metrics the plan posts each year

The plan's published prior authorization metrics, required under CMS-0057-F, make the same numbers public, so the internal measures should be computed the same way. The whole series starts from Prior Authorization Automation.

Questions people ask

What is the prior authorization process at a health plan?

The request is logged and its clock starts; eligibility and the need for authorization are confirmed; the medical policy is chosen; the record is read against each criterion; missing documents are requested; and a nurse approves or a physician or other qualified professional decides any adverse outcome, followed by the notice. In Medicare Advantage the whole process must finish within 7 calendar days for a standard request from 2026.

Is the 7-day prior authorization clock calendar days or business days?

Calendar days. The Medicare Advantage rule says 7 calendar days after receiving the request for items and services subject to prior authorization, beginning on or after 1 January 2026, and the Medicaid managed care limit is also 7 calendar days for rating periods starting on or after that date. The expedited clock is 72 hours in both programs.

Can a nurse deny a prior authorization request?

In Medicare Advantage, an expected adverse medical necessity decision must be reviewed by a physician or other appropriate health care professional with the right expertise before it is issued, under 42 CFR 422.566(d). Most plans have a physician sign every denial; a nurse may approve when every criterion is documented.

What happens if a plan misses the prior authorization deadline?

In Medicare Advantage, failing to give timely notice counts as an adverse organization determination that the member may appeal, under 42 CFR 422.568(f). The plan cannot treat a late request as still pending.

How often are prior authorization denials overturned?

Often, when appealed. KFF reports that Medicare Advantage insurers denied 7.7% of prior authorization requests in full or in part in 2024, that only 11.5% of denials were appealed, and that 80.7% of appeals were partially or fully overturned.

What slows the prior authorization workflow most?

Waiting for records from the provider, and the time before the right request for them goes out. On Botminds' estimate for a standard request with one missing criterion, two and a half of six days by hand are waiting, and a day and a half pass before the records request is sent.