Gondley Consulting
Prior authorization in 2026: the 72-hour and 7-day deadlines payers now have, and how a practice tracks them
Ayush Gondley · 2 November 2026 · 5 min read
Every request gets a date, and the date says when to chase.
Key takeaways
- Under CMS's final rule CMS-0057-F, Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans and CHIP managed care entities must decide prior authorization requests within 72 hours for urgent requests and 7 calendar days for standard ones, from 1 January 2026.
- Those deadlines do not apply to Qualified Health Plan issuers on the federal exchanges, and the rule's denial-reason requirement does not apply to drugs.
- From 2026, the payers covered must give a specific reason for a denied request, however it was sent. That reason is what your appeal or resubmission answers.
- A practice that records the date and the payer of every request knows on which day to follow up, and can tell the patient when to expect an answer.
Prior authorization is where a practice's week leaks away: forms sent, phone queues, and patients asking whether their procedure is still on. Since January, many payers have hard deadlines for their answers, and that changes the routine. The waiting is no longer open-ended, so the follow-up can be on a date, not on a feeling.
What changed on 1 January 2026
CMS published the Interoperability and Prior Authorization Final Rule, CMS-0057-F, in January 2024. Its operational parts generally began on 1 January 2026.1
| The request is | The payer must decide within |
|---|---|
| Expedited (urgent) | 72 hours |
| Standard (non-urgent) | 7 calendar days |
The payers covered are Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans and CHIP managed care entities.1 The rule also covers Qualified Health Plan issuers on the federal exchanges for some requirements, but the decision deadlines do not apply to them.1 Commercial plans outside the rule keep their own timelines, so your tracking has to know which kind of payer each request went to.
A reason for every denial
From 2026, the payers covered must give a specific reason for a denied prior authorization decision, however the request was submitted. That does not apply to decisions about drugs.1 Our recommendation is to save the reason with the request, word for word. It tells you whether to send missing records, ask for a peer-to-peer review, or appeal.
The rule also asks these payers to publish prior authorization numbers on their websites each year, starting by 31 March 2026, and to offer a prior authorization API from 1 January 2027.1 The published numbers are worth a look when you compare how quickly your main payers really decide.
A tracking routine
Our recommendation is one line per request, filled in the day it is sent:
- the patient, the service and the date it is scheduled;
- the payer, and whether it is covered by the rule's deadlines;
- standard or urgent, and the date and time it was sent;
- the date the answer is due: 7 calendar days or 72 hours later for the payers covered, or the payer's own timeline for others;
- the decision, the reference number, and the reason if it was denied.
Then two checks a day: requests due today with no answer, and scheduled services within a week whose request is still open. The first gets a call or a portal message to the payer. The second gets a call to the patient. The same list starts with the coverage checks in our insurance verification checklist.
Messages you can copy
Replace the words in brackets. Keep patient texts to the facts they need, as in our appointment reminder texts guide.
To the patient · the day the request is sent
Hello [Name], this is [Practice]. We have asked your insurance plan to approve your [service] on [date]. They usually answer by [due date]. We will let you know as soon as we hear, and you do not need to call them.
To the payer · the day the answer is due, by portal or phone
We are following up on prior authorization request [reference] for [patient], sent on [date] as a [standard / expedited] request. The decision was due by [due date]. Please confirm its status and, if it was denied, the specific reason.
To the patient · when it is approved
Hello [Name], good news from [Practice]: your insurance plan has approved your [service] on [date]. See you then. Reply or call [phone] if anything changes.
To the patient · when it is denied
Hello [Name], this is [Practice]. Your insurance plan has not approved your [service] yet. We are [sending more information / asking them to review it] and will call you by [date] with next steps. Your appointment on [date] stays booked for now.
What can run by itself
- The due date, worked out from the payer and the type of request when it is logged.
- The daily list of answers due and open requests close to their service date, sent to the person who handles them.
- The patient messages when a request is sent, approved or denied, as in our front desk automation guide.
- The denial reason, saved with the request, and a note to the clinician when records are what is missing.
What stays with your team
- Which requests are urgent, a clinical decision.
- Peer-to-peer reviews and appeals, which need the clinician.
- Patients whose service may move, who need a call, not a text.
More of what we write for practices is on the blog.
Questions practices ask
How long do payers have to decide prior authorization requests in 2026?
Under CMS-0057-F, the payers covered must decide within 72 hours for expedited requests and 7 calendar days for standard requests, from 1 January 2026.
Which payers do the deadlines apply to?
Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans and CHIP managed care entities. They do not apply to Qualified Health Plan issuers on the federal exchanges.
Do payers have to say why a request was denied?
Yes, the payers covered must give a specific reason for a denied prior authorization decision from 2026, except for drugs.
Does the rule cover prescription drugs?
No. The prior authorization API and the denial-reason requirement exclude drugs.
When should we follow up on a request?
Our recommendation: on the day the answer is due, 7 calendar days or 72 hours after sending for the payers covered, and sooner when the service is within a week.
Sources
- Centers for Medicare & Medicaid Services, CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) fact sheet, 17 January 2024.
About the author
Ayush Gondley founded Gondley Consulting, which automates front-desk work for small US medical, therapy and veterinary practices. Before that he was a marine engineer at Maersk, keeping complex systems running at sea. Gondley Consulting on LinkedIn
