Prior Authorization Turnaround Times: What CMS Requires Payers to Meet

Updated November 5, 2026, based on CMS and the Code of Federal Regulations as of that date.

Since January 1, 2026, most Medicare Advantage plans, Medicaid programs and Medicaid managed care plans must decide a standard prior authorization request within 7 calendar days and an expedited one within 72 hours. That comes from the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F). For Medicare Advantage and Medicaid managed care, the standard limit before the rule was 14 calendar days.

The rule has limits. It does not cover drugs. Marketplace plans on the federal exchanges are excluded from the new timeframes. Commercial employer plans follow a different federal rule. Even within the rule, the deadline is an outer limit, and a payer can extend it in some cases. So the turnaround you actually see depends on the payer type, whether the request is for a service or a drug, and how complete the request was when it arrived.

This guide covers the deadlines by payer type, what else changed in 2026 and 2027, and what you can do on your side to keep requests from stalling.

The CMS deadlines: 7 days standard, 72 hours expedited

CMS's fact sheet on CMS-0057-F lists the payers the rule calls "impacted payers": Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan issuers on the federally facilitated exchanges. All of them except the exchange plans must send prior authorization decisions within 72 hours for expedited requests and 7 calendar days for standard requests.

The deadlines live in each program's regulations, and each one starts the clock when the payer receives the request:

• Medicare Advantage: 7 calendar days for standard requests, from January 1, 2026, and 72 hours for expedited requests (42 CFR 422.568 and 422.572).
• Medicaid managed care: 7 calendar days for standard requests, for rating periods starting on or after January 1, 2026, and 72 hours for expedited requests (42 CFR 438.210(d)).
• State Medicaid agency (fee-for-service): 7 calendar days for standard requests, from January 1, 2026, and 72 hours for expedited requests (42 CFR 440.230(e)).
• Employer group health plans (ERISA): 15 days for pre-service claims and 72 hours for urgent care claims (29 CFR 2560.503-1).

Two details in that list matter in practice.

First, the Medicaid managed care deadline turns on the plan's rating period. Under 42 CFR 438.210(d), the 7-day limit applies to rating periods that begin on or after January 1, 2026. Rating periods that started earlier kept the old 14-day limit until they ended. If a plan's contract year doesn't start in January, confirm with the plan when the shorter limit took effect.

Second, these are maximums set by federal rules. States can set shorter ones. 42 CFR 440.230(e) says a shorter minimum timeframe under state law applies to the state Medicaid agency, and 438.210 lets states set managed care time frames within the federal cap. Check your state Medicaid agency's provider manual for its own numbers.

When a payer can take longer

The 7-day and 72-hour limits can be extended in specific cases.

• In Medicare Advantage, under 42 CFR 422.568(b)(2), a plan can extend a standard decision by up to 14 calendar days if the enrollee asks, if the plan needs more medical evidence from a noncontract provider that could change a denial, or in "extraordinary, exigent, or other non-routine circumstances." The plan has to explain the delay in writing.
• In Medicaid managed care, under 42 CFR 438.210(d), a standard or expedited decision can be extended by up to 14 calendar days if the enrollee or provider asks, or if the plan can justify to the state that it needs more information and that the extension is in the enrollee's interest.
• For state Medicaid fee-for-service, under 42 CFR 440.230(e), a standard decision can be extended by up to 14 days if the beneficiary or provider asks, or if the agency needs more information from the provider.
• For employer plans, under 29 CFR 2560.503-1(f)(2)(iii), a pre-service decision can be extended once by up to 15 days for matters beyond the plan's control, if the plan tells the claimant before the first 15 days run out.

Several of these extensions turn on missing information. A complete first submission gives the payer less reason to extend.

What counts as expedited

Expedited review isn't a rush option for any request a patient needs soon. Each program defines it.

For Medicaid managed care, 42 CFR 438.210(d)(2) applies the 72-hour limit when the provider indicates, or the plan determines, that the standard timeframe could seriously jeopardize the enrollee's life, health, or ability to attain, maintain or regain maximum function. For employer plans, 29 CFR 2560.503-1(m)(1) uses a similar test: the delay could seriously jeopardize the patient's life, health or ability to regain maximum function. It adds one more case: in the opinion of a physician who knows the patient's condition, the delay would leave the patient in severe pain that can't be adequately managed without the care. When a physician with knowledge of the patient's condition says the claim involves urgent care, the plan must treat it as urgent.

So a post-surgical patient who needs therapy to recover function may qualify for expedited review under either definition. Document the clinical reason on the request, in the treating provider's words, and check the box or field the portal provides for expedited review.

Drugs follow different rules

CMS-0057-F excludes drugs. The CMS fact sheet says the denial reason requirement doesn't apply to prior authorization decisions for drugs, and the regulations for the new deadlines, metrics and API leave drugs out as well.

Drug requests have their own clocks. In Medicare Advantage, a request for a Part B drug must be decided within 72 hours under 42 CFR 422.568(b)(3), or 24 hours if expedited under 42 CFR 422.572, and neither can be extended. Medicaid managed care plans follow the covered outpatient drug rules referenced in 438.210(d)(3). Pharmacy benefit requests have separate timeframes that vary by program. If your team handles both, keep them in separate queues with separate deadlines.

What else changed: denial reasons, public metrics and APIs

Three other parts of the rule affect how you work with payers: denial reasons, public metrics and a new API.

Starting in 2026, impacted payers must give a specific reason for a denied prior authorization, however the request was sent. For Medicare Advantage the requirement is in 42 CFR 422.122(a). A specific reason tells you what to fix before you resubmit or appeal, instead of calling to ask.

Impacted payers must also post prior authorization data on their websites each year, with the first set due by March 31, 2026. Under 42 CFR 422.122(c) and 438.210(f), the posted data includes the list of items and services that require prior authorization, approval and denial rates, the share approved after appeal, the share approved after an extended review, and average and median decision times for standard and expedited requests. Drug data is excluded. These pages let you see a plan's reported turnaround, not just its legal maximum.

Beginning January 1, 2027, impacted payers must implement a Prior Authorization API. Under 42 CFR 422.122(b), the Medicare Advantage version must list covered items and services (excluding drugs) that need prior authorization, and must communicate whether a request is approved, denied or needs more information. Whether you can use it depends on whether your EHR or practice management system connects to it, so ask your vendor about their plans.

How to keep requests from stalling

The federal deadlines cap how long a payer can take. They don't stop a payer from pending a request for missing information. The part you control is what goes in the first submission.

1. Confirm the requirement first. Check whether the payer requires prior authorization for that CPT code and plan. The payer's posted list of services that need prior authorization is a starting point, and the requirement can differ by plan within one payer.
2. Match the documentation to the payer's criteria. Pull the payer's medical policy for the service and attach what it asks for. If the policy requires conservative treatment first, such as prior therapy or medication trials, include the dates.
3. Use the payer's electronic channel when there is one, and keep the reference number or confirmation it gives you.
4. Ask for expedited review only when it applies, and state the clinical reason so the payer doesn't downgrade it.
5. Track the clock from receipt. Note when the payer received the request and the date the decision is due. Follow up before it lapses.
6. Plan for renewals. Note the authorized visit count and end date on approval, and start the renewal before the authorization runs out.

Write the payer-specific steps down. When one or two coordinators hold all the knowledge of which payer wants what, a vacation or a resignation shows up as a backlog.

Frequently asked questions

Does the 7-day prior authorization rule apply to commercial insurance?

No. CMS-0057-F applies to Medicare Advantage, Medicaid, CHIP and exchange plans on the federal exchanges, and the exchange plans are excluded from the 7-day and 72-hour timeframes. Employer group health plans follow 29 CFR 2560.503-1, which allows 15 days for pre-service claims and 72 hours for urgent care claims. State-regulated plans may also be subject to state law, so check your state's insurance rules.

When does the clock start on a prior authorization request?

Each regulation counts from when the payer receives the request. Keep the portal confirmation, fax confirmation or reference number as your record of the receipt date.

Can a payer extend the 7-day deadline?

Yes, in defined cases. Medicare Advantage, Medicaid managed care and state Medicaid agencies can extend a standard decision by up to 14 calendar days, for example when the enrollee asks or when the payer needs more information. Medicare Advantage plans must explain the delay in writing.

Do the CMS timeframes apply to medication prior authorizations?

No. The rule excludes drugs. Medicare Advantage Part B drug requests have their own 72-hour standard and 24-hour expedited limits, and pharmacy benefit requests follow separate rules.

Where can I see how fast a specific plan decides prior authorizations?

Impacted payers must post annual prior authorization metrics on their websites, starting with data due by March 31, 2026. The posting includes average and median decision times for standard and expedited requests.

For more on how teams submit requests and track decisions across payer portals, see our prior authorization automation guide. When a request is denied, our guide to denial management automation covers getting appeals submitted and followed up.

Submitting prior authorizations across many payer portals?

Champ automates portal work like submitting prior authorizations and checking their status. We set it up and run it, so your staff sees only the finished results. If faster turnaround depends on cleaner submissions and closer follow-up, learn more here.

This post is general information, not legal, compliance or billing advice. Rules vary by payer and state and change often, so confirm with the payer or your state Medicaid agency before acting. Champ is not affiliated with or endorsed by CMS or the other agencies and plans mentioned here.