Ask a practice who does prior authorization and the answer is usually a list of names followed by "and whoever is free". The medical assistant does the imaging requests between rooming patients. The front desk handles the referrals. The nurse does the specialty drugs because she understands them. The surgeon's scheduler does the procedures. Nobody owns the queue, nobody knows the turnaround time, and the CO-197 denials (precertification absent) show up in the remittance six weeks later as a surprise.
The AMA's 2024 prior authorization physician survey, published this year, reports an average of 39 prior authorization requests per physician per week and about 13 hours of physician and staff time to complete them. For a five-physician practice that is roughly 200 requests and a full-time-plus equivalent every week. Work at that volume needs a staffing model, not a habit. This article lays out the four models we see, the math behind each, and how to tell whether yours is working.
Key takeaways
- Count first: 90 days of requests split into routine (portal, ten to fifteen minutes) and complex (records, letters, peer-to-peer). A trained specialist handles 30 to 40 routine or 12 to 18 complex requests a day, and that is the number to staff against.
- Four models: embedded, centralized, hybrid and outsourced. Above about four providers, centralized or hybrid wins, usually after a bad quarter of CO-197 write-offs proves it.
- Every model needs one queue with five fields (order, payer, due date, status, reference number), sorted by due date every morning.
- Track turnaround by payer, first-submission approval rate, authorization denials in dollars (CO-197, CO-15, CO-198), peer-to-peer rate and procedures rescheduled for missing authorization.
- 2026 brings faster decision deadlines for Medicare Advantage, Medicaid managed care and marketplace plans, the AHIP voluntary commitments, and, in six states, WISeR prior authorization in traditional Medicare.
The volume math
Start by counting. Pull 90 days of orders and procedures that required authorization and divide by working days. Then sort them into two groups: routine requests that can be completed in a payer portal in ten to fifteen minutes (most imaging, most referrals, many generic specialty drugs), and complex requests that need clinical documentation assembled, a medical necessity letter, or a peer-to-peer call (infusions, surgeries, sleep studies, genetic testing, biologics).
In our experience a trained authorization specialist working full time completes 30 to 40 routine requests a day, or 12 to 18 complex ones, or a mix in between. That is the number to staff against. It also tells you something uncomfortable: a medical assistant doing 15 requests a day between patient rooms is spending half her clinical day on authorization, which is the most expensive way to do it.
Four models
| Model | How it works | Works best for | Weakness |
|---|---|---|---|
| Embedded | Each clinical team handles its own authorizations | Very small practices; specialties with few, complex requests | No queue visibility; clinical staff pulled from patients; inconsistent payer knowledge |
| Centralized | One or more dedicated specialists own every request from a shared work queue | Practices with 4 or more providers and steady volume | Distance from the clinical detail; needs a clean hand-off from the order |
| Hybrid | Centralized team handles routine requests; clinical staff handle complex ones with a specialist coordinating | Multi-specialty groups; practices with infusion or surgical lines | Requires clear rules for which request goes where |
| Outsourced | A billing or RCM partner runs the queue in the practice's systems | Practices that cannot hire or keep specialists; overflow | Depends on system access and same-day communication with clinicians |
Most practices over about four providers end up centralized or hybrid, and the ones that do not usually get there after a bad quarter of CO-197 write-offs. We think the embedded model is defensible only when volume is genuinely low; the argument that "the MA knows the patient" does not survive a look at the denial report.
Building the queue
Whatever the model, the work needs a queue with five fields: the order, the payer, the date the request is due (the appointment or procedure date minus the payer's stated turnaround), the current status, and the reference number. Most EHRs have a worklist that can do this; a shared spreadsheet is better than nothing. The queue is sorted by due date every morning. A request that is due in two days and has not been submitted is the first thing worked.
The hand-off from the order is where centralized models break. The ordering clinician has to answer three questions at the time of the order: what exactly is being requested (CPT code, units, site), what is the clinical justification (the diagnosis and the failed alternatives), and how urgent is it. A template in the order screen captures this once. Without it, the authorization specialist spends half her day chasing clinicians for information that was in their head when they wrote the order.
The metrics that matter
- Turnaround time: days from order to payer decision, by payer. You are measuring the payer as much as your team, and the payer number is what you bring to contract discussions.
- First-submission approval rate: requests approved without additional information or appeal. Below 80 percent for routine requests means the documentation hand-off is weak.
- Authorization-related denials: CO-197 (precertification absent), CO-15 (authorization number missing or invalid), CO-198 (precertification exceeded), as a count and as dollars per month. This is the number that pays for the staff.
- Peer-to-peer rate: how many requests required a clinician call, by payer and by service. Rising peer-to-peer rates on a service usually mean the payer changed its criteria.
- Rescheduled or cancelled procedures due to authorization: the number the surgeon actually cares about.
What changes in 2026 and 2027
Two things are moving in the practice's favor. The CMS Interoperability and Prior Authorization final rule from January 2024 requires impacted payers (Medicare Advantage, Medicaid and CHIP managed care, and marketplace plans) to decide urgent requests within 72 hours and standard requests within seven calendar days beginning in 2026, to give a specific reason for denials, and to publish authorization metrics. From 2027 those payers must support electronic prior authorization through standard APIs, which is what finally lets an EHR submit a request without a portal login.
On June 23, 2025, AHIP and a group of insurers covering roughly 257 million people signed a set of voluntary commitments: reducing the scope of services subject to authorization by January 1, 2026, honoring existing authorizations for 90 days when a patient changes plans, having a clinician review every medical necessity denial, and answering at least 80 percent of electronic requests in real time by 2027. We will believe the volume reduction when we see it in the queue, but the 90-day continuity commitment is worth knowing about now: it changes how you handle patients who switch plans in January.
Traditional Medicare is moving the other way in six states. The WISeR model brings prior authorization to selected services in Arizona, New Jersey, Ohio, Oklahoma, Texas and Washington starting January 1, 2026. If you are in one of those states, that volume belongs in the same queue.
Questions we hear
Should the authorization specialist sit in billing or in clinical operations?
Billing, in our view, with a desk near the clinicians. The specialist needs the payer knowledge and the denial data that live in billing, and the daily access to clinicians that lives in the clinic. Reporting to billing keeps the denial loop closed.
Can we outsource only the overflow?
Yes, and many practices do. The requirement is delegated access to the EHR and payer portals under the practice's control, and a same-day channel to the ordering clinician. Our denial management service includes authorization-related denial prevention for exactly this reason; the request and the denial are the same problem seen from two ends. Rates are on the pricing page.
One payer takes two weeks on routine imaging requests. What can we do?
Three things, in order. Measure it, so the complaint is a number: median days from submission to decision for that payer over 90 days. Take the number to your provider relations representative and, if the plan is a Medicare Advantage, Medicaid managed care or marketplace product, point out that the January 2024 CMS rule holds it to seven calendar days for standard requests starting in 2026. Fully insured commercial plans are governed by state law, and many states have their own turnaround rules worth citing. Meanwhile, set that payer's due date in the queue to the appointment date minus 15 business days, so the request goes in early enough that the payer's slowness does not become the patient's cancelled scan.
What to do this month
- Count 90 days of requests, split routine and complex, and compute the daily volume.
- Pull CO-197, CO-15 and CO-198 denials for the same period in dollars. That is the cost of the current model.
- Pick a model against the volume. If the count supports a full-time specialist, hire or reassign one and give her the queue.
- Build the order template with the three questions.
- Set the five metrics on a monthly report and review them with the clinicians, not just the billing team.
