What Is Prior Authorization in Health Insurance?

Prior authorization is your payor's approval requirement before it will cover a service like residential, PHP, or IOP treatment. You submit clinical documentation, a reviewer checks it against medical necessity criteria, and the plan approves, denies, or pends the request. For a UR coordinator, it is the gate that starts the authorization window, the concurrent review cycle, and every peer-to-peer call that follows.

What does prior authorization mean for insurance, in plain English?

Prior authorization means the insurance company reviews and approves a service before you deliver it. The payer checks that the requested level of care, say residential or PHP, meets its medical necessity criteria, then issues an authorization number with an approved length of stay and date range. Medicare explains that payers must return a standard decision within 14 days or an expedited decision within 72 hours, per CMS. That number is what gets attached to claims; without it, payment is at risk. For UR teams, the practical work is submitting the service request form, tracking the authorization window, and documenting medical necessity so the approval holds. We break down the full lifecycle in our prior authorization guide for behavioral health billing.

Which services typically require prior authorization from insurance?

Prior authorization means your payor approves a service before you deliver it. In behavioral health, the services most likely to require it are the higher levels of care: detox, residential, PHP, and IOP. Outpatient therapy sessions often don't need it; a residential stay almost always does.

Behavioral health levels of care and authorization

Detox and residential treatment draw the tightest scrutiny, because payors apply medical necessity criteria (often ASAM 4th Edition) to justify both admission and continued stay. PHP and IOP requests usually hinge on step-down documentation, showing why the client needs that level rather than a lower one. Requirements vary by plan: a commercial payor, a Medicaid MCO, and a carve-out can each have different service request forms, authorization windows, and review criteria for the same level of care. The practical move is to check each payor's criteria before admission, not after the first concurrent review, and to match your documentation to the level of care you're requesting (see ASAM Criteria and Insurance Authorization | CriteriaIQ).

How do you get prior authorization from insurance before treatment?

Step 1: Verify benefits and confirm the PA requirement

Call the number on the member's card or check the payor portal before admission. Confirm the level of care (residential, PHP, IOP, detox) actually requires prior authorization, the authorization window, and any state-specific rules. Log the reference number; you will need it for every later call.

Step 2: Assemble the clinical documentation

The request lives or dies on medical necessity, so build the packet before you submit: ASAM level-of-care placement criteria, psychosocial assessment, recent progress notes, lab results for detox, and the service request form the payor specifies. Most payors, including large carriers like Aetna and Cigna, publish provider manuals listing the request channels and required forms, and the structure is similar across carriers. The pattern UR nurses know too well: a single missing note or delayed assessment can trigger hours of rework or an automatic denial, because the reviewer judges only what you send, not what exists in the chart. Assemble the packet once, completely, and you avoid the resubmission cycle that pushes cases past the decision window and into A/R aging.

Step 3: Submit and track the request

Submit through the payor portal or fax, capture the submission date, and track the decision window against it. If you run Kipu, CriteriaIQ keeps concurrent review dates and documentation status attached to each case instead of a spreadsheet (Kipu EMR Authorization Analysis | CriteriaIQ).

How do Aetna and Cigna prior authorization requests differ in process?

Both payors require you to confirm whether the member's specific plan requires prior authorization before submitting, because benefit design varies by plan even within the same carrier.

Aetna insurance prior authorization: where requests go

Aetna accepts requests through its Availity provider portal, by fax using the payer-specific service request form, or by phone for urgent cases. Residential, PHP, and IOP requests go through behavioral health utilization review, and Aetna's clinical criteria are applied at the plan level, so check the member's documents first.

Cigna insurance prior authorization: where requests go

Cigna routes requests through the Cigna for Health Care Providers portal (HCP), with fax and phone fallbacks. Cigna publishes its precertification lists separately for behavioral health, and level-of-care requests are typically handled by its behavioral company rather than medical precert.

Side-by-side process comparison

Both allow expedited review when the standard timeframe could jeopardize the member. Plan-level details always override general rules, so verify each member's requirements. Steven Cavan covers the UR workflow implications of these differences (Steven Cavan, Utilization Review Author | CriteriaIQ).

How long does a prior authorization decision take, and what is an expedited review?

For routine requests, Medicare Advantage plans must decide within 14 calendar days, and Medicaid managed-care plans within 14 days in most states; commercial payers typically follow similar windows set by state law and contract. Expedited review shortens that to 72 hours when a delay could seriously jeopardize your patient's life, health, or ability to regain maximum function — think acute detox or a deteriorating residential client. You mark the request expedited and document the clinical justification.

If the payer misses the window, the request is often treated as a denial that triggers appeal rights, and some state regulators treat the missed deadline as approval. Either way, note the date you submitted and the decision due date. Tracking those dates across payers is exactly the authorization-window problem that tools like CriteriaIQ | Behavioral Health Utilization Review Software exist to manage.

What are concurrent review and peer-to-peer, and why do they matter after approval?

Concurrent review

Concurrent review is the payor's check-in while a client is still in care. For residential, PHP, and IOP stays, the payor re-authorizes in increments, often every few days, based on updated clinical documentation. A missing note or late assessment can pause the authorization window, which is why UR teams track review dates per payor rather than assuming an approved stay runs to discharge.

Peer-to-peer (P2P) review

A P2P is a phone call between your treating clinician and the payor's medical director after a concurrent review or initial request is denied or cut short. The goal is to argue medical necessity directly. Some payors, including Cigna, require specific forms or channel the request through their provider portal, so confirm the required paperwork before the call.

Medical necessity and level-of-care criteria

Medical necessity is the payor's test for whether the level of care is justified. Behavioral health UR teams typically map documentation to the ASAM Criteria, published by ASAM, for SUD levels of care. Step-down means the payor believes the client meets criteria for a lower level; tracking length of stay against those criteria is what keeps concurrent reviews from turning into denials.

What happens if your insurance denies a prior authorization?

A denial is a decision, not the end of the request. Most denials come down to a few causes: the payor says the documentation does not establish medical necessity, the level of care requested exceeds what the notes support, the service needed prior authorization and none was on file, or the authorization window lapsed before the stay started. A missing note or a delayed assessment can trigger the denial on its own.

The pattern behind most denials is a gap between what the chart contains and what the packet showed. A reviewer judging an IOP request sees three progress notes where the clinician wrote five, or a psychosocial assessment dated two days after the requested admission date, and the medical necessity argument collapses on paper even though it was sound in the building. This is why UR nurses who assemble packets against a checklist, with every note dated before submission and every ASAM dimension addressed, win approvals that equally clinical teams lose. The denial letter's CARC code usually tells you which gap the reviewer found, which is the next thing to read.

Reading the denial: CARC and RARC codes

Every denial letter carries a CARC code (the reason) and often a RARC code (the remark). CO-50, for example, means the payor judged the service not medically necessary; CO-197 means precertification was absent. Look up the exact code in the payor's denial letter rather than guessing, because the code tells you whether the fix is clinical documentation, a corrected service request form, or a peer-to-peer call.

Appeal deadlines and levels of appeal

You typically start with an internal appeal, and payors set the deadline in the denial letter, often 180 days but sometimes far shorter for behavioral health levels of care. A successful peer-to-peer between your clinician and the payor's reviewer can reverse an initial denial before a formal appeal is even filed, especially when the denial hinged on a note the reviewer never saw. If internal appeals fail, external review by an independent third party is the next level. Log every deadline per case, because one missed date converts a winnable appeal into write-off.

What jobs and roles handle health insurance authorization behind the scenes?

On your side, three roles do most of the work. The UR coordinator owns the authorization calendar: service request forms, concurrent review due dates, and step-down deadlines across payors. The UR nurse gathers the clinical documentation that proves medical necessity, often pulling notes from Kipu under deadline. An authorization specialist, when the facility hires one, handles submissions and portal follow-up so clinical staff stay clinical.

On the payer side, a utilization reviewer checks your request against the payor's medical necessity criteria, and a medical director signs off on denials. If a denial is upheld after peer-to-peer, a different reviewer must handle your appeal, and federal claim procedures give plans a defined window to decide it. Many smaller facilities split these UR duties across existing nurses rather than hiring dedicated staff.

How do UR teams track authorizations without losing cases in spreadsheets?

Spreadsheets and shared inboxes: where they break

A spreadsheet can hold authorization windows, but nothing in it watches the clock. When a payor changes a concurrent review date or a peer-to-peer lands in a shared inbox nobody owns, the row goes stale and the denial shows up later. One missing note or delayed assessment can trigger hours of rework or an automatic denial, and the spreadsheet has no way to flag that before it happens.

Tracking inside Kipu EMR

Kipu keeps clinical documentation and census in one place, so UR staff can work from the chart instead of retyping into a tracker. Its limits are real: payor-specific criteria, service request form deadlines, and P2P follow-ups still live in your process, not the EMR. Teams often end up back in spreadsheets for anything cross-payor.

Where dedicated tooling helps, and where it doesn't

Dedicated RCM tools like CriteriaIQ sit on top of the EMR you already run, tracking authorization windows and concurrent review dates across payors so cases don't slip. Ritten and Behave Health take a broader approach to behavioral health operations. Honest limits: no tool guarantees an authorization, and your clinical documentation still has to support medical necessity. CriteriaIQ reduces tracking failures, not the review itself.

FAQ

Does prior authorization guarantee the payer will pay the claim?

No. An authorization number confirms the payer approved the service for a specific length of stay and date range, but payment still depends on the claim matching that authorization. If the actual services, dates, or level of care differ from what was approved, or the authorization window lapsed, the payer can deny or recoup payment despite the prior approval.

How long does a prior authorization stay valid before it expires?

It varies by payor and level of care, but every authorization carries a date range and an approved length of stay, so it always expires. Concurrent reviews re-authorize residential, PHP, and IOP stays in increments, often every few days. If treatment continues past the approved window without a new review, the additional days are typically not covered.

Can a prior authorization be backdated if treatment already started?

Usually no. Payers expect the request approved before services are delivered, and some plans deny claims when no authorization was on file at the time of admission. In urgent situations, you can request retroactive authorization or an expedited review, and some payors allow a grace period, but success depends on the payor's rules and strong clinical documentation.

Who is responsible for getting prior authorization, the provider or the patient?

The provider, in practice. Contracted treatment facilities handle verification, submission, and tracking as part of utilization review, which is why UR coordinators and UR nurses own the authorization calendar. Patients technically hold the benefit, but payors direct service request forms and clinical documentation questions to the treating provider, and a missing authorization puts the facility's payment at risk.

What is the difference between prior authorization and precertification?

The terms overlap heavily and many payors use them interchangeably. Precertification often refers to verifying that a service is a covered benefit and confirming the requirement, while prior authorization is the full clinical review that produces an approval number with a length of stay. Cigna, for example, publishes precertification lists and routes level-of-care requests through its behavioral company.