Prior authorization rules changed on January 1, 2026 for Medicare Advantage plans and Medicaid managed care plans. Plans now have shorter deadlines to answer standard requests, and every denial must come with a specific reason. A second step follows on January 1, 2027, when plans must offer an electronic way to request and track authorizations. This guide explains what changed, what it means for your practice and your billing company, and what has not changed.
What Changed on January 1, 2026
| Rule | Medicare Advantage | Medicaid managed care |
|---|---|---|
| Standard prior authorization decision | Within 7 calendar days of the request (42 CFR 422.568(b)(1)) | Within the state’s time frame, which may not exceed 7 calendar days for rating periods starting on or after January 1, 2026 (42 CFR 438.210(d)) |
| Expedited decision | No later than 72 hours after the request (42 CFR 422.572) | Set in the same rule, as quickly as the patient’s condition requires |
| Denials | The response to the provider must give a specific reason for the denial (42 CFR 422.122) | Similar requirements apply under the same CMS rule |
Before 2026, a Medicare Advantage plan generally had up to 14 days for a standard request. The new limits apply to items and services; prescription drugs follow separate rules.
The Prior Authorization Timeline
- Before 2026Up to 14 daysFor a standard decision under most plans
- January 1, 20267 days, 72 hoursStandard and expedited limits, with a specific reason for each denial
- January 1, 2027Electronic requestsPlans must offer a prior authorization API
What Comes on January 1, 2027
From January 1, 2027, Medicare Advantage plans must run a prior authorization application programming interface (API) (42 CFR 422.122(b)). In plain terms, systems will be able to ask a plan whether a service needs authorization, send the request with its documentation, and receive the answer electronically. How much of this your practice sees depends on your EHR and on whether your billing company or authorization vendor connects to it.
What Has Not Changed
- Traditional Medicare (Part A and Part B) uses prior authorization only for a limited set of services; most of its rules did not change.
- Commercial plans outside these programs set their own authorization rules in their contracts and policies.
- Authorization is still not a guarantee of payment. Eligibility, coding and medical necessity still decide the claim.
- A missing authorization still produces a denial. On the remittance it often appears as CARC 197.
What to Change in Your Practice
- Track every request with its date and time sent, so you know when the 7-day or 72-hour limit has passed.
- Follow up on day 7. A plan that has not answered is outside the rule, and the record helps if you escalate.
- Read every denial reason. A specific reason tells you whether to send more documentation, correct the request, or appeal.
- Ask your EHR vendor when it will support electronic prior authorization with your largest plans.
Questions to Ask Your Billing or Authorization Company
- Who submits authorizations: your staff or ours? Who follows up, and on which day?
- Do you report on authorization turnaround by plan, and on denials by reason?
- How will you use the plans’ electronic connections from 2027?
- When an authorization is denied, who decides whether to appeal?
You can compare prior authorization companies, see billing companies that handle authorizations as part of their service, or send one request and we will point you to companies that fit.
