How long does prior authorization actually take?
It varies by payer and service, from same-day to several weeks under current practice. Under a 2026 CMS rule, impacted payers must decide expedited requests within 72 hours and standard requests within seven calendar days; that is a ceiling on the decision itself, not on submitting a complete request in the first place.
The detail
There is no single turnaround time across every payer and service today; some decisions come back same-day through an automated system, others take one to several weeks, especially where the payer requests additional clinical information mid-review.
Starting in 2026, CMS's interoperability and prior authorization final rule, CMS-0057-F, requires impacted payers to send prior authorization decisions within 72 hours for expedited requests and seven calendar days for standard requests. That compliance date began 1 January 2026 and applies to the payers named in the rule, not to every payer nationwide.
What slows a request in practice is almost always an incomplete submission, missing clinical documentation or the wrong code, rather than the payer's own processing time. See /services/prior-authorization/ for how a dedicated seat keeps requests complete the first time.
Does outsourcing prior authorization reduce denials?
It can, mainly by making submissions complete and tracked the first time rather than by any special leverage over the payer. Most prior-authorization denials trace back to a missing field, the wrong code, or a request nobody followed up on before it expired; a dedicated seat focused only on this queue catches those before they become a denial.
The detail
A prior-authorization denial is rarely a judgment call the payer made against the clinical case; it is far more often an administrative gap, a missing clinical note, an expired authorization window, or a code that does not match what was actually billed later. Outsourcing reduces denials by closing that administrative gap, not by negotiating with the payer.
A dedicated prior-authorization seat tracks every request to a decision, follows up before an authorization expires, and resubmits immediately when a payer asks for more information, rather than letting a request sit while someone attends to other work. See /services/prior-authorization/ for the seat's published price and scope.
Who is responsible for getting prior authorization: the practice or the payer?
The practice or the ordering provider is responsible for requesting prior authorization before the service is delivered; the payer is only responsible for deciding the request, within the timeframe its own rules or CMS-0057-F now set. A service delivered without a required authorization is usually the practice's financial risk, not the payer's.
The detail
Prior authorization is requested by whoever is ordering or performing the service, typically the referring or treating provider's office, before the service happens. The payer's role is limited to reviewing and deciding that request within its stated or regulated window.
If the service is delivered without the authorization in place, the financial consequence generally falls on the practice: a denial, an appeal, or a write-off, not a penalty against the payer. That is the core reason this task is worth staffing deliberately rather than fitting it in between other front-desk duties.
What is eligibility verification, and why does it prevent denials?
Eligibility verification confirms a patient's active coverage, plan type, benefits and expected patient responsibility before the visit happens. Checking it upfront catches inactive coverage, a wrong plan on file, or a coordination-of-benefits problem before a claim is submitted, which is the cheapest point in the entire cycle to catch any of them.
The detail
Eligibility and coverage issues are consistently one of the largest categories of claim denials industry-wide, and almost every one of them is preventable before the visit rather than fixable after the claim is filed. Verification means checking the patient's coverage status, the specific plan, the benefit level for the service being rendered, and whether another payer should be billed first.
Doing this once, consistently, before every visit is the cheapest denial prevention available, because the alternative is discovering the same problem after a claim has already been submitted, denied and appealed. See /services/eligibility-verification/ for the seat's published price and scope.
What changes to prior-authorization timelines under the 2026 CMS rule?
CMS-0057-F requires impacted payers, including Medicare Advantage plans, to decide expedited prior authorization requests within 72 hours and standard requests within seven calendar days, beginning 1 January 2026. It also requires faster electronic processes by 2027, but the decision-time requirement is already in effect.
The detail
CMS's own fact sheet on the Interoperability and Prior Authorization Final Rule states the requirement directly: impacted payers must send prior authorization decisions within 72 hours for expedited, urgent requests and seven calendar days for standard, non-urgent requests, with that requirement beginning 1 January 2026.
A separate, later deadline, primarily 1 January 2027, covers the application programming interface requirements that let systems exchange prior-authorization data electronically; that is a technical integration deadline, distinct from the decision-time requirement already in force. The rule excludes qualified health plan issuers on the federally facilitated exchanges.
Can a virtual assistant handle prior authorizations and eligibility checks?
Yes, these are among the most commonly delegated tasks for a medical billing virtual assistant, since both are rules-based, repetitive and do not require being physically present. What matters is the same as for any outsourced role: named access, a signed BAA, and a stated process for following up before deadlines pass.
The detail
Prior authorization and eligibility verification are two of the tasks most often handed to a virtual assistant or an outsourced seat, precisely because the work is procedural: gather the right information, submit it through the payer's portal or phone line, and track it to a decision.
The risk is the same as with any offshore or remote role handling patient data: access should be scoped to only what the task needs, under a signed business associate agreement, with a named person accountable for each account. See the virtual-assistants cluster for what a VMA is and costs more broadly.
