What is Authorization in Medical Billing? A Complete Guide
September 24, 2026
Authorization in medical billing can determine whether a medically appropriate service moves smoothly from scheduling to reimbursement or becomes trapped in a cycle of delays, denials, appeals, and unpaid balances.
For doctors, hospitals, clinics, and other healthcare providers, authorization is more than an administrative checkpoint. It connects a payer’s coverage rules with the patient’s diagnosis, the planned procedure, medical necessity, provider network status, and supporting clinical documentation.
A provider may recommend an MRI, surgery, specialty medication, medical device, therapy program, or other service based on clinical need. However, depending on the patient’s insurance plan, the payer may require approval before that service is performed. When this requirement applies, the provider usually needs to submit specific clinical and coding information before treatment begins.
Failure to obtain required authorization can lead to claim denials even when the service itself was medically reasonable.
This guide explains what authorization in medical billing is, how prior authorization works, how CPT, HCPCS, ICD-10-CM, and diagnosis codes affect approval, what causes authorization-related denials, and how providers can improve the process without unnecessarily delaying patient care.
What Is Authorization in Medical Billing?
Authorization, in billing is the process of getting permission from a patients health insurance company to provide certain medical services before those services are given or in some cases just after they are given.
This process is often known as authorization, preauthorization, precertification or prior approval. Even though these words might mean different things to different insurance companies they usually refer to a step where the insurance company checks before the service is offered.
CMS describes prior authorization in the Medicare context as a process in which information is reviewed before the service is rendered and before the claim is submitted. The purpose is to determine whether applicable coverage, documentation, coding, and payment requirements appear to be satisfied.
Authorization does not itself guarantee final reimbursement. Approval generally means that the payer has looked at the information available and decided that the requested service fits its authorization rules.. Payment can still be affected by things, like eligibility, benefit limits, correct coding, medical necessity, filing deadlines, network status claim edits and other contract rules.
That distinction is extremely important.
Prior authorization is not the same as a guarantee of payment.
Why Do Insurance Companies Require Prior Authorization?
Payers use prior authorization to evaluate whether particular services meet coverage and medical necessity requirements before significant healthcare resources are used.
Services that may require authorization are often expensive, specialized, elective, frequently utilized, or subject to specific coverage criteria.
Examples include advanced diagnostic imaging, inpatient admissions, outpatient surgery, specialty medications, durable medical equipment, certain injections, rehabilitation services, spinal procedures, genetic testing, home healthcare, and selected behavioral health services.
The exact requirement varies significantly between plans. The same CPT code may require authorization under one insurance product but not another.
For that reason, providers should not assume that authorization rules are identical simply because two patients have insurance from the same company.
Authorization vs. Eligibility Verification
Authorization and eligibility verification are closely related, but they perform different functions.
Eligibility verification determines whether the patient’s insurance coverage is active and helps identify information such as effective dates, copayments, deductibles, coinsurance, network benefits, and sometimes service-specific coverage.
Authorization asks a different question:
Does this particular service require payer approval, and has that approval been obtained?
A patient can have active coverage and still have a claim denied because required authorization was missing.
Similarly, an authorization number does not necessarily mean the patient’s policy remained active on the date of service.
A strong revenue cycle workflow therefore verifies both eligibility and authorization requirements before scheduled services whenever possible.
How Does Prior Authorization Work?
The process normally starts before the planned procedure or service.
The provider first determines what service is being considered and identifies the relevant procedure code or expected code range. The clinical record must then support why the service is being ordered.
The patient’s insurance benefits are reviewed to determine whether authorization is required.
If authorization is necessary, information is submitted through the payer’s portal, electronic authorization system, fax workflow, phone process, or other approved channel.
The payer may request information such as the patient’s demographic data, member ID, provider information, diagnosis, ICD-10-CM codes, CPT or HCPCS codes, treatment history, imaging results, laboratory results, progress notes, medications attempted, conservative treatment history, and the anticipated date and place of service.
The request may then be approved, denied, returned for additional information, or referred for further clinical review.
When authorization is approved, the provider should record the authorization number, approved CPT or HCPCS codes, service dates, units, facility or rendering provider information, and expiration date.
These details need to match the service eventually performed and billed.
What Information Is Commonly Required for Authorization?
Successful prior authorization depends heavily on documentation quality.
A payer needs enough information to understand what is being requested and why the patient meets the applicable clinical criteria.
For example, an MRI authorization request for chronic low-back pain may require documentation showing symptoms, neurological findings when applicable, previous imaging, duration of symptoms, conservative treatment, physical therapy, medications, and other interventions.
Submitting only an ICD-10-CM diagnosis code may not provide enough information.
A code communicates the diagnosis, but clinical documentation explains the patient’s individual circumstances.
That distinction often determines whether an authorization request moves forward or is returned for additional information.
Are There CPT Codes for Prior Authorization?
There is no single universal CPT code that represents obtaining prior authorization.
Instead, CPT and HCPCS codes identify the service being requested.
For example, if a provider requests authorization for an MRI, the payer evaluates the applicable MRI CPT code. If the request involves durable medical equipment, the relevant HCPCS Level II code may be reviewed. If authorization is required for a procedure, the procedure code submitted with the authorization request needs to correspond with the service ultimately provided.
This is why procedure-code accuracy matters before authorization is submitted.
An incorrect code can create a situation where the payer approves one service but the provider later bills another.
CPT Codes Commonly Associated With Services That May Require Authorization
Authorization requirements vary by payer, plan, diagnosis, place of service, and medical necessity policy. The following examples illustrate services that are commonly subject to authorization review rather than establishing that authorization is universally required.
| Service | Example CPT Code | General Description |
|---|---|---|
| Brain MRI without contrast | 70551 | MRI of brain without contrast |
| Brain MRI with and without contrast | 70553 | MRI of brain with and without contrast |
| Lumbar spine MRI without contrast | 72148 | MRI of lumbar spine without contrast |
| Lower-extremity joint MRI | 73721 | MRI of lower-extremity joint without contrast |
| CT chest with contrast | 71260 | CT of thorax with contrast |
| Echocardiography | 93306 | Complete transthoracic echocardiography |
| Colonoscopy | 45378 | Diagnostic colonoscopy |
| Upper GI endoscopy | 43235 | Diagnostic upper gastrointestinal endoscopy |
| Total knee arthroplasty | 27447 | Knee replacement procedure |
| Total hip arthroplasty | 27130 | Hip replacement procedure |
| Lumbar epidural injection | 62323 | Epidural injection, lumbar/sacral |
| Physical therapy evaluation | 97161–97163 | PT evaluation codes based on complexity |
| Therapeutic exercise | 97110 | Therapeutic exercises |
| Neuromuscular reeducation | 97112 | Neuromuscular reeducation |
These examples should never replace payer verification. A payer may require authorization for one code but not another, impose frequency limits, require step therapy, restrict certain places of service, or apply different policies to commercial, Medicaid, Medicare Advantage, and employer-sponsored plans.
HCPCS Codes and Authorization
HCPCS Level II codes are especially important for durable medical equipment, supplies, prosthetics, orthotics, injectable drugs, ambulance transportation, and certain other services.
CMS maintains specific prior-authorization requirements for selected DMEPOS items. Importantly, appearing on CMS’s DMEPOS Master List does not automatically mean prior authorization is required; an item generally must also appear on the applicable Required Prior Authorization List for that requirement to apply.
Another clear example involves repetitive, scheduled, non-emergent ambulance transportation. CMS identifies HCPCS A0426 and A0428 as transport codes subject to its applicable prior-authorization process.
Providers should also remember that HCPCS Level II changes occur throughout the year. CMS publishes quarterly HCPCS updates, so organizations using static code lists risk working from outdated information.
What Are DX Codes in Authorization?
“DX code” simply means diagnosis code.
In most professional and outpatient billing workflows, the diagnosis is reported using ICD-10-CM.
Diagnosis codes help explain why a requested procedure, medication, device, or treatment is medically relevant.
Suppose a provider requests an MRI of the lumbar spine.
The procedure code identifies what is being requested.
The ICD-10-CM code identifies why it is being requested.
The payer may then compare the procedure, diagnosis, clinical documentation, and coverage policy to determine whether the authorization criteria are satisfied.
Examples of ICD-10-CM Codes Used in Authorization Requests
There is no universal group of “authorization diagnosis codes.” The correct diagnosis must come from the patient’s documented condition.
Some examples include:
| ICD-10-CM Code | Diagnosis | Possible Authorization Context |
|---|---|---|
| M54.50 | Low back pain, unspecified | Spine imaging or therapy |
| M54.16 | Radiculopathy, lumbar region | Lumbar MRI or interventional treatment |
| M25.561 | Pain in right knee | Knee imaging or therapy |
| M17.11 | Unilateral primary osteoarthritis, right knee | Joint treatment or knee surgery |
| M25.551 | Pain in right hip | Imaging or orthopedic treatment |
| G43.909 | Migraine, unspecified, not intractable, without status migrainosus | Imaging or selected therapies |
| R51.9 | Headache, unspecified | Diagnostic evaluation or imaging |
| G47.33 | Obstructive sleep apnea | Sleep-related equipment or treatment |
| C50.919 | Malignant neoplasm of unspecified site of unspecified female breast | Oncology treatment/testing depending on circumstances |
| I50.9 | Heart failure, unspecified | Cardiac services, devices, or treatment |
| J44.9 | COPD, unspecified | Respiratory treatment or equipment |
| E11.9 | Type 2 diabetes mellitus without complications | Certain medications, devices, or supplies |
The presence of one of these diagnoses does not automatically justify authorization.
The patient’s record must support the diagnosis and the medical necessity of the requested service.
Why CPT and ICD-10 Codes Must Match the Authorization
Coding consistency is one of the most important parts of prior authorization.
Consider a provider who obtains authorization for a lumbar MRI without contrast but, following a change in the clinical plan, performs a study with contrast.
The CPT code billed may no longer match the approved procedure.
Unless the authorization is updated or the payer allows the change, the claim may be denied.
Similar problems occur when authorization is approved for one anatomical site but treatment is performed on another site, when fewer or additional therapy units are provided, when the authorization expires, or when the rendering provider differs from the provider identified in the approval.
The authorization record should therefore be compared with the final scheduled service before treatment.
Medical Necessity and Prior Authorization
Medical necessity is at the center of many authorization decisions.
Payers frequently maintain clinical criteria describing when a service is considered appropriate for coverage.
For example, advanced imaging may require a documented period of conservative management before MRI approval unless warning signs or other qualifying clinical circumstances exist.
A surgical procedure may require documentation of symptoms, examination findings, diagnostic studies, previous treatments, and evidence showing why less invasive treatment is no longer appropriate.
A specialty medication may require documentation of diagnosis, previous medications, contraindications, laboratory findings, or treatment failure.
Copying a diagnosis code into the authorization request without supporting the clinical story can therefore result in a denial or request for additional documentation.
Authorization for Hospital Outpatient Services
Medicare maintains prior-authorization requirements for certain hospital outpatient department services.
CMS currently identifies categories including blepharoplasty, botulinum toxin injections, panniculectomy, rhinoplasty, vein ablation, implanted spinal neurostimulators, cervical fusion with disc removal, and facet joint interventions under the applicable hospital outpatient prior-authorization program.
CMS states that this process does not change existing medical-necessity documentation requirements. Instead, the documentation needed to establish coverage is reviewed earlier in the process.
This distinction illustrates an important principle for providers:
Authorization does not replace proper documentation.
It depends on it.
Prior Authorization Changes Providers Should Understand in 2026
Prior authorization is increasingly moving toward more standardized and electronic workflows.
Under the CMS Interoperability and Prior Authorization Final Rule, CMS-0057-F, impacted payers are subject to several operational requirements beginning in 2026, while certain API requirements generally have compliance dates beginning in 2027.
Among the 2026 provisions, impacted payers must provide a specific reason when denying applicable prior-authorization requests. The rule also establishes decision timeframes for impacted payers, generally 72 hours for expedited requests and seven calendar days for standard requests, subject to the rule’s scope and exceptions. The provisions described by CMS exclude prior authorization for drugs in this rule.
For providers, greater specificity in authorization denials can make it easier to identify missing documentation, correct an incorrect code, clarify medical necessity, or prepare an appeal.
Common Authorization Denials in Medical Billing
Authorization-related denials are not all caused by the same problem.
One of the most straightforward situations is no authorization obtained. The payer required approval before the service, but the provider did not secure it.
Another common issue is authorization does not match the billed CPT or HCPCS code. The payer approved one procedure while the claim contains another.
A claim may also be denied when authorization was obtained for the wrong anatomical site, wrong rendering provider, wrong facility, incorrect place of service, or dates outside the authorized period.
Unit limits are another frequent problem. For example, an insurer may authorize a defined number of physical therapy visits or medication units. Once that limit is exceeded, later claims may deny unless additional authorization was obtained.
Medical necessity can create a separate denial. A payer may determine that the documentation does not demonstrate that the requested treatment satisfies its coverage criteria.
Some requests fail because clinical documentation is incomplete. Missing imaging reports, physician notes, medication history, conservative treatment records, laboratory results, or previous therapy documentation may prevent the reviewer from reaching an affirmative decision.
Authorization-Related CARC and RARC Messages
Claim denials are communicated through the remittance advice using Claim Adjustment Reason Codes and, when applicable, Remittance Advice Remark Codes.
Authorization problems may appear with reason codes indicating that required precertification, notification, authorization, or utilization review requirements were not satisfied.
A commonly encountered example is CARC 197, which generally indicates that precertification, authorization, or notification was absent.
However, denial handling should never be based solely on the CARC number.
The provider should review the associated RARC, payer portal, authorization history, claim information, clinical record, explanation of benefits, and payer policy before determining the corrective action.
An authorization denial may require a corrected claim, retroactive authorization request where permitted, reconsideration, medical-necessity review, documentation submission, peer-to-peer review, or formal appeal.
Can Providers Obtain Retroactive Authorization?
Sometimes, but providers should never assume it is available.
Retroactive authorization means requesting approval after the service has already been performed.
Certain payers allow it only under narrowly defined circumstances, such as emergency situations, delayed eligibility information, or administrative errors outside the provider’s control.
Other plans may not allow retroactive authorization at all.
If authorization was missed, the provider should immediately check the specific payer’s policy rather than assuming the claim cannot be recovered or, conversely, that retrospective approval will automatically be granted.
What Is a Peer-to-Peer Review?
When an authorization is denied for medical necessity, some payers allow a peer-to-peer discussion.
A treating or ordering provider may speak with a physician reviewer or other qualified clinician representing the insurer.
This gives the provider an opportunity to explain clinical findings, previous treatments, test results, risk factors, and the reasoning behind the requested service.
Peer-to-peer review is particularly relevant when the written documentation did not clearly communicate the complete clinical situation.
However, it should not be treated as a substitute for strong documentation.
A well-documented authorization request may reduce the need for additional review in the first place.
Prior Authorization and Claim Submission
Authorization information must follow the patient through the revenue cycle.
Obtaining approval is only the beginning.
Before the claim is submitted, staff should confirm that the performed service is consistent with the authorization record.
The final CPT or HCPCS code, modifiers where applicable, diagnosis codes, provider, location, units, date of service, and authorization number should align with payer requirements.
If a service changes between authorization and treatment, the authorization may need to be amended.
For example, a physician may initially plan one procedure but determine after additional testing that another procedure is clinically appropriate.
The treatment decision remains clinical, but the coverage implications should be checked before a scheduled non-emergency service is performed whenever possible.
How Authorization Problems Affect Revenue Cycle Performance
Authorization errors can create significant financial consequences.
When services are performed without required approval, reimbursement may be delayed or lost entirely.
The organization may then spend additional time investigating the denial, contacting the insurer, collecting documentation, submitting reconsiderations, arranging peer-to-peer reviews, filing appeals, and correcting claims.
Authorization failures can also interfere with scheduling and patient experience.
A patient who arrives expecting treatment may discover that authorization is still pending, creating frustration for both the patient and provider.
For organizations managing high volumes of imaging, specialty care, surgery, therapy, or procedures, even a relatively small authorization error rate can produce substantial administrative work.
Providers working with an organization such as Utah Billing Service may therefore integrate benefit verification, authorization tracking, coding review, and denial follow-up into a broader revenue cycle workflow rather than treating authorization as an isolated front-office task.
Documentation That Supports Strong Authorization Requests
A good authorization request tells a clear clinical story.
The diagnosis code provides the payer with a standardized diagnosis, but the medical record provides the evidence.
The documentation should identify the patient’s condition, relevant symptoms, severity, duration, examination findings, prior treatments, diagnostic testing, response to previous therapy, and reason the requested service is appropriate.
For repeated services, documentation should demonstrate the patient’s progress and explain why continued treatment is medically necessary.
When payer policy requires specific prerequisites, those prerequisites should be clearly identifiable in the record.
If the insurer requires six weeks of conservative therapy, for example, the chart should not simply say “conservative treatment failed.” It should document what treatment was provided, when it was provided, and what happened.
How Providers Can Reduce Authorization Denials
Authorization accuracy begins before the request is submitted.
The procedure code should be confirmed as precisely as possible, the diagnosis should reflect the documented clinical condition, payer requirements should be checked against the patient’s actual insurance product, and supporting records should be prepared before submission.
The authorization record should then be monitored until a decision is received.
Once approval is issued, the details need to be reviewed rather than simply recording the authorization number.
An approval for the wrong code can create almost the same reimbursement problem as having no authorization at all.
The scheduling and clinical teams should also be informed about authorization limitations, such as approved dates, units, anatomical sites, or facility restrictions.
Finally, recurring denial patterns should be analyzed.
If a practice repeatedly receives authorization denials for the same reason, the problem may be occurring earlier in the workflow.
Authorization and Coding Compliance
Accurate coding remains essential even when a payer’s authorization criteria make a different code easier to approve.
Providers should never select a diagnosis or procedure code merely because it improves the likelihood of authorization.
The CPT, HCPCS, and ICD-10-CM codes must accurately represent the documented service and clinical condition.
Using an unsupported diagnosis to obtain authorization can create compliance risks and may result in recoupments, audits, or other consequences.
Clinical documentation should drive coding, and coding should support an accurate representation of the requested service.
Authorization Is Payer-Specific
Perhaps the most important lesson is that authorization rules cannot safely be generalized across all insurance plans.
Medicare Fee-for-Service requirements differ from Medicare Advantage rules. Medicaid requirements can vary by state and managed-care organization. Commercial insurers maintain their own medical policies, utilization-management systems, network rules, and authorization requirements.
Even within the same insurer, an HMO product and PPO product may follow different requirements.
Providers should therefore verify the patient’s specific plan rather than relying exclusively on historical knowledge.
A procedure that did not require authorization for a previous patient may require it for the next patient.
Keep Coding Resources Current
Authorization processes depend heavily on current codes.
CMS maintains updated ICD-10-CM and ICD-10-PCS files. As of September 2026, CMS has also published the FY 2027 ICD-10-CM files that take effect for applicable encounters beginning October 1, 2026.
HCPCS Level II is updated quarterly, making periodic code review equally important for DME, supplies, medications, and other HCPCS-reported services.
Practices should therefore avoid building permanent authorization workflows around outdated code spreadsheets.
A change, replacement, or deletion of a procedure code can affect both the authorization request and the claim.
Example of an Authorization Workflow
Consider a patient experiencing persistent lumbar pain with radiculopathy.
After examination and conservative management, the physician determines that lumbar MRI is clinically appropriate.
The clinical record documents the symptoms, duration, neurological findings, previous treatment, and response.
The provider identifies the appropriate diagnosis, such as M54.16 for lumbar radiculopathy, when supported by the documentation, and determines the correct MRI procedure code based on the ordered study.
The patient’s insurance plan is checked for authorization requirements.
If authorization is required, the procedure code, diagnosis, provider information, clinical notes, and supporting records are submitted.
Once approval is received, the practice verifies the approved code, dates, site, and authorization number before scheduling.
After the MRI is completed, the claim is compared with the authorization record before submission.
This relatively simple workflow can prevent a considerable amount of denial work later.
How Authorization Connects With Denial Management
Authorization and denial management should not operate separately.
Denial data can reveal where the authorization process is breaking down.
For example, repeated “authorization missing” denials may indicate an eligibility or pre-service verification problem.
Repeated CPT mismatch denials may show that the procedure code is changing after authorization without communication between clinical and administrative staff.
Repeated medical-necessity denials may indicate that documentation does not sufficiently address payer criteria.
Repeated expired-authorization denials may reveal inadequate scheduling controls.
When the root cause is identified, providers can correct the workflow rather than repeatedly appealing the same type of denial.
A coordinated revenue cycle partner such as Utah Billing Service can support this type of approach by connecting authorization information with claim submission, accounts receivable follow-up, and denial analysis while the provider remains responsible for accurate clinical documentation and patient-care decisions.
Does Prior Authorization Guarantee Payment?
No.
This is one of the biggest misconceptions surrounding authorization in medical billing.
Even when prior authorization has been obtained, a claim may still encounter payment issues because of inactive coverage, incorrect coding, non-covered services, benefit limits, provider network problems, coordination-of-benefits issues, missing modifiers, duplicate billing, claim filing errors, or other payer requirements.
Authorization should therefore be viewed as one component of claim compliance rather than a promise of reimbursement.
Why Authorization Matters for Providers
Prior authorization sits at the intersection of clinical care and reimbursement.
When managed correctly, it can help clarify coverage before planned services are performed and reduce preventable claim problems.
When managed poorly, it can delay treatment, create administrative burden, produce authorization denials, increase accounts receivable, and require time-consuming appeals.
The strongest authorization process starts with accurate patient insurance information, continues through correct CPT or HCPCS coding and diagnosis selection, and depends on documentation that clearly demonstrates medical necessity.
It also requires close coordination between scheduling, clinical documentation, coding, authorization, and claims functions.
Final Thoughts
Understanding what authorization in medical billing is requires looking beyond the authorization number itself.
Prior authorization is a payer review process used for selected services before treatment. CPT and HCPCS codes identify what the provider intends to perform, while ICD-10-CM or DX codes help explain the patient’s diagnosis and clinical reason for the service. Documentation then provides the evidence needed to connect those two pieces.
There is no single authorization CPT code, no universal authorization diagnosis code, and no one approval rule that applies to every insurance plan.
That is why providers should verify requirements for the patient’s specific payer and plan, confirm the exact procedure being authorized, use diagnosis codes supported by the medical record, submit complete clinical documentation, monitor authorization dates and units, and compare the approval with the final claim.
As payer requirements and electronic authorization standards continue evolving, organizations that treat prior authorization as an integrated part of the revenue cycle are better positioned to reduce preventable denials, protect reimbursement, and minimize unnecessary interruptions in patient care.