How to automate prior authorization in 2026 without losing control of the packet

Where prior authorization time goes

The AMA's 2025 prior authorization survey of 1,000 physicians, released in May 2026, found that physicians complete an average of 40 prior authorizations a week and that the work takes an average of 13 hours of physician and staff time each week. Forty percent of physicians employ staff who work only on prior authorization. Ask a practice administrator where those hours go and the answer is rarely the form itself.

A request starts with a question that is harder than it looks: does this payer require authorization for this CPT or HCPCS code under this plan? Most physicians in the same survey said that is difficult to tell. Then someone finds the channel, which may be the payer's portal, Availity, a utilization management vendor or a fax number. They pull the notes, imaging and treatment history the payer's criteria ask for, fill the fields and submit. After that come status checks, requests for more information, peer-to-peer reviews and appeals.

CAQH measures only the request step. Its 2024 Index puts that at 24 minutes when a provider asks for authorization by phone, fax or email and 16 minutes through a portal, the longest portal time of any transaction it tracks. Gathering documents and following up come on top. MGMA's members describe the same pressure from their side: 90% of the more than 230 group practices in its 2026 Regulatory Burden Report said prior authorization burden grew in the past 12 months, with Medicare Advantage ranked the most burdensome payer type and commercial plans next.

What changed on January 1, 2026, and what arrives in 2027

CMS announced the Interoperability and Prior Authorization final rule, CMS-0057-F, on January 17, 2024. It applies to Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities and qualified health plan issuers on the federally facilitated exchanges. Employer plans fall outside its direct reach, and drugs are excluded from its prior authorization provisions.

Since January 1, 2026, impacted payers must decide expedited requests within 72 hours and standard requests within 7 calendar days, and they must give a specific reason for every denial, however the request was sent. Exchange plans are excluded from the timeframes. Payers had to post their first prior authorization metrics on their websites by March 31, 2026. By January 2027, with exact dates that vary by payer type, they must run a Prior Authorization API that lists covered items and services, states documentation requirements and handles requests and responses electronically. The final rule also added an Electronic Prior Authorization attestation measure for MIPS eligible clinicians, starting with the 2027 performance period.

Health plans also made a voluntary pledge through AHIP in June 2025, promising to reduce the scope of prior authorization by January 1, 2026 and to have standardized electronic prior authorization working by January 1, 2027. Only 33% of physicians in the AMA survey believe the pledge will make a meaningful difference.

Shorter payer clocks have not shortened the practice side of the work. Of 178 respondents to an MGMA poll on September 1, 2026, 44% said prior authorization turnaround was slower in 2026 than in 2025, 40% said it was the same and only 7% said it was faster. The bottlenecks they named were status checks, peer-to-peer reviews and documentation requirements. The packet and the follow-up remain your team's work.

Texas practices have two more items to track. Texas is one of six states in CMS's WISeR model for traditional Medicare, which runs from January 1, 2026 to December 31, 2031 and uses technology companies with clinician reviewers to assess selected services. Cohere Health is the Texas participant, and providers choose between prior authorization and a review after the service but before payment. Texas also has a gold card law. For plans subject to it, whether a physician is exempt from preauthorization for a service depends on a statutory approval test and on how often the service was requested during the evaluation period, which since September 1, 2025 is one year with at least five instances. Confirm the plan's status and the current requirements before relying on an exemption. Nationally, only 5% of physicians in the AMA survey said they contract with plans that offer gold card exemptions. These rule summaries are general information, not legal advice.

What to automate and what to keep with your coordinators

A workable rule: the agent does anything a careful new coordinator could do from the payer's published rules and the chart, and a person keeps anything that needs clinical judgment or a decision about the patient's care. The agent drafts only from cited chart evidence, and the coordinator checks for unsupported statements before submission.

The hard cases are requests where the chart falls short of the payer's criteria, for example an MRI request without the documented weeks of physical therapy the policy asks for. The agent's job there is to say what is missing and where it looked. What happens next is the clinician's call.

Denials deserve their own note. Payers covered by the CMS rule must now give a specific reason, so the agent can record each reason as data and tag it to its cause, such as a missing document or a requirement your team did not know about. After a few months, that list shows which payer rules to fix before the next request goes out. The decision to appeal, and any clinical argument in an appeal, stays with the practice and the clinician.

The controls that keep a person in charge

At launch, staff approve every submission. Each packet waits in a queue, where the coordinator sees the order, the payer rule the agent relied on, the pages it pulled and the drafted fields, then submits it or sends it back. Any later automation, such as letting a repeat request for the same service under the same plan go out without review, needs an agreed scope and documented validation.

These are the controls worth insisting on before go-live:

• Every packet cites the chart page behind each fact and the payer rule it relied on.
• The agent reads only the chart sections a packet needs, in line with HIPAA's minimum necessary standard.
• Statements about medical necessity come only from cited chart pages, and nothing goes out signed as a clinician.
• Requests that mention urgency, a peer-to-peer review or an earlier denial go to a person at once.
• A log shows who approved each submission and when, kept as long as your other authorization records.
• A senior coordinator reviews a sample of submitted packets every week.

Worked example: what the hours look like

This is an illustrative example with assumed numbers, not a client result. Take a six-provider orthopedic and pain group that submits 120 prior authorization requests a week. Assume each one takes 35 staff minutes from start to finish, covering the requirement check, the chart pull, the form or portal, the submission and two status checks. That is 4,200 minutes, or 70 staff hours a week. As a rough cross-check, the AMA's average of 13 hours of physician and staff time per physician would put six physicians at 78 hours.

Now assume 90 of those 120 requests are routine: a payer whose rules are known and a chart that already holds what the criteria ask for. With the agent preparing a cited packet, the coordinator spends about 12 minutes reviewing it, submitting it and handling one status check, so 1,080 minutes. The other 30 stay manual at 35 minutes, another 1,050 minutes. The total falls to 2,130 minutes, or 35.5 hours, which gives back 34.5 staff hours a week.

The routine share matters more than any other number here. Spine, pain and imaging-heavy practices with frequent peer-to-peer reviews may sit nearer half. At 50% routine, the total is 47 hours and the saving about 23 hours a week. Count one real week before you trust any estimate, ours included.

Starting small with prior authorization

Pick one group of ordering providers and one ordinary week. Have coordinators log every request with the code, the payer, the channel, the minutes spent and whether it came back with a request for more information. Rank the payers by volume. Then test an agent against last month's requests, on copies, with nothing submitted, and compare its packets with what your team sent.

Measure the same things before and after: staff minutes per request including review, the first-pass approval rate, requests for more information per 100 submissions and days from order to decision. Hours matter most to the practice, and approval rates tell you whether the packets are getting better.

That test is roughly what our five-day AI Workflow Sprint does for $2,500. It runs on sample documents with made-up patient details, on your real layouts, and ends with a ranked list of workflows, the staff hours attached to each and a fixed quote for the build. Full refund if we do not find 10 staff hours a week. Whoever you work with, insist on a test against your own requests before a single packet reaches a payer.

Common questions