News From Our Perspective

Navigate the Healthcare System with Ease

23
Apr 2026

What Hospitals Should Do With Payers’ Newly Public Prior Authorization Data

Joy Stephenson-Laws, Managing Partner
 

For the first time, health plans have to post how often they deny prior auth requests. Here is what the numbers show, what they leave out, and how hospitals can use them.

Something changed on March 31, 2026, that every hospital billing office and CFO should know about. For the first time, health plans have to post their prior authorization numbers on their own public websites. How often they approve. How often they deny. How long they take to decide. How often they lose on appeal.

The rule covers Medicare Advantage plans, state Medicaid and CHIP plans, and plans sold on the ACA exchanges. Drugs are not included. The first reports cover all of 2025.

For hospitals, the new data is both less and more than it looks like. Less, because the numbers are self-reported by the payers. They sit on dozens of different websites. There is no single place to find them. Some payers make them hard to locate. More, because for the first time, a payer’s denial rate, appeal-overturn rate, and decision time are on the public record in the payer’s own words, hospitals can point to those numbers in contract talks. In appeal letters. In regulatory complaints. In court.

The question is not whether this changes the prior auth landscape. It does. The question is what hospitals should do with the data before payers learn how to manage what they report in the next cycle.

What the rule requires

CMS finalized the Interoperability and Prior Authorization Rule (CMS-0057-F) in January 2024. It built on an earlier rule from 2020. The new rule applies to Medicare Advantage plans, state Medicaid and CHIP plans, Medicaid and CHIP managed care plans, and plans sold on the federal ACA exchanges. CMS calls all of these impacted payers.

Two things took effect on January 1, 2026.

First, most impacted payers — but not ACA exchange plans — must decide on standard prior auth requests within seven calendar days. Urgent requests must be decided within 72 hours. The old standard was up to 14 days. There is a catch. Payers can extend the seven-day window by up to 14 more days in certain cases. That means a “compliant” decision can still take three weeks. When a payer denies a request, it must give a specific reason. The payer can send that reason by portal, fax, email, mail, or phone.

Second, the public reporting rule kicked in. The first reports were due March 31, 2026. Medicare Advantage plans report at the contract level. State Medicaid and CHIP report at the state level. Managed care plans report at the plan level. ACA exchange plans report at the issuer level. The numbers include the list of services that need prior auth, the share of standard and urgent requests approved and denied, the share of denials overturned on appeal, and the average decision time.

The rule also requires new data-sharing tools (called APIs) that take effect January 1, 2027. Those are the bigger structural fix. But the 2026 public numbers are what hospitals can use right now.

What the first numbers show — and what they hide

KFF, a respected health policy research group, took a first look at the new data on April 2, 2026. Its finding was blunt. The data, as posted, does not tell you much about what payers are actually approving and denying.

UnitedHealthcare’s Medicare Advantage report shows the problem. UHC reports that 97.5 percent of its MA medical claims do not require prior auth at all. Of the prior auth requests it does review, it approves 95.4 percent. Average decision time: 24 hours. Those are strong numbers.

But read the footnotes. UHC excludes prior auth requests sent to capitated-delegated providers. It excludes behavioral health delegates. Physical health delegates. Dental delegates. It excludes transitions to post-acute care. It excludes members in plans run by non-integrated entities. And it excludes drugs entirely, as the rule requires.

That list of exclusions matters. Post-acute care — like skilled nursing after a hospital stay — is exactly the type of decision at the heart of Estate of Lokken v. UnitedHealth Group. That is the class action challenging UHC’s use of an AI tool called nH Predict to cut off skilled nursing coverage for Medicare Advantage patients. On March 9, 2026, the federal court in Minnesota ordered UHC to turn over internal documents. Those documents include AI governance records, cost-savings analyses tied to the NaviHealth acquisition, and performance metrics for UHC’s clinical staff. UHC’s response is due April 29, 2026. The decisions at the center of that lawsuit are the exact decisions UHC’s public report does not cover.

KFF also flagged broader problems with the reporting rule. There is no consistent place to find the reports on payer websites. Some payers put them on one page. Others spread the numbers across many pages. The data is lumped together across all services. A hospital cannot tell whether imaging, orthopedic procedures, or behavioral health makes up most denials. Payers do not have to say why they denied a request. And there is no central CMS dashboard that collects everyone’s numbers in one place. Each payer posts on its own site in its own format. Some states — Washington and Massachusetts — already require more useful data, broken out by service and including drugs. KFF suggests the federal rule should follow their lead.

There is one more gap worth naming. The rule has no independent audit. Payers post their own numbers, on their own websites, in their own chosen format. CMS can enforce compliance if a payer fails to report. But there is no routine third-party check on whether what gets posted is accurate or complete. For now, the reports are the payer’s word. Hospitals should treat them that way — useful, citable, and on the record, but not verified.

WHAT PAYERS MUST REPORT

For 2025 data, posted by March 31, 2026:

  • The list of services that require prior auth
  • Share of standard requests approved and denied
  • Share of urgent requests approved and denied
  • Share of denials reversed on appeal
  • Average time for standard and urgent decisions
  • Share of requests where the timeline was extended

Not required: drug prior auths (a separate CMS rule from April 2026 would add them — public comments close June 15, 2026). The data is not broken out by service type. Payers do not have to say why they denied a request.

For CFOs: three ways to use the data

The new numbers give hospital finance leaders leverage they did not have before. Here is where to put them to work.

  1. Contract talks with payers. When you sit down to negotiate a payer contract, the payer’s own numbers are now on the record. If a plan claims its prior auth process runs smoothly but its public report shows a high denial rate and most of those denials get overturned on appeal, the gap is visible. The payer has to explain it or fix it. Use these numbers in rate talks. Use them when you push for services to be carved out of prior auth. Use them when you negotiate faster peer-to-peer review.
  2. Payer scorecards and benchmarking. If your hospital tracks payer performance, you can now compare your own experience against the payer’s self-reported national numbers. If you see denial rates with a payer that are much higher than what the payer reports publicly, that is a red flag. It means one of two things. Either your hospital is seeing something unusual and you need to dig into why. Or the payer’s public numbers leave out the decisions you are actually fighting. Either way, it is a data point for escalation and a talking point for the next contract cycle.
  3. Revenue forecasting. Denials and appeals affect cash flow. Now that you can see what a payer’s overturn rate looks like — and KFF’s data shows more than 80 percent of appealed Medicare Advantage denials were reversed in 2024 — you can make more accurate assumptions about recovery rates. A denial pattern that regularly reverses on appeal is also a pattern worth investing appeal-team resources against. The payoff is measurable.

For billing and revenue cycle teams: how to use it day to day

The people who actually fight prior auth denials get something they have not had before — the payer’s own numbers to quote back.

  1. Stronger appeal letters. Pull the payer’s 2025 report and work the relevant numbers into your appeal templates. For example: “This payer’s own public report shows that X percent of denials are reversed on appeal. This decision fits that pattern.” Use the payer’s own voice against its own decision. Courts, regulators, and the payer’s own appeals reviewers respond to a payer being confronted with its own numbers. It is harder to dismiss than a general claim about unfair denials.
  2. Complaints to state insurance regulators. State insurance commissioners now have a public baseline to work from. If you file a complaint about a payer’s conduct, you can point to where the payer’s practice differs from what the payer has reported to the public. That gives your complaint more weight than an individual account of what happened with one patient.
  3. Watching for the footnotes. This is the single most important tip. Do not take a payer’s top-line numbers at face value. Read the footnotes. Find out what the payer excluded. UHC’s report, as we noted, leaves out post-acute care transitions, delegated providers, and behavioral health delegates. Those are often the exact cases your team is fighting. If the payer’s public numbers look good but your appeals queue tells a different story, the answer may be in the footnotes. Document the gap. It is useful in every setting — contract talks, appeals, complaints, and, if needed, litigation.

The numbers behind the rule

Some context. KFF analyzed CMS data and published the findings on January 28, 2026. Medicare Advantage insurers made nearly 53 million prior auth decisions in 2024. They fully or partially denied 4.1 million of them. That is a 7.7 percent denial rate. Only 11.5 percent of denied requests were appealed. But of the appeals that were filed, 80.7 percent were partially or fully overturned. That pattern has held every year since 2019. More than eight in ten appealed denials get reversed.

The burden on the physician side is big, too. The American Medical Association surveyed 1,000 physicians at the end of 2024. The results: an average of 39 prior auth requests per physician per week. Roughly 13 hours of physician and staff time per week, per doctor. Ninety-three percent of physicians said prior auth delays patient care. Eighty-nine percent said it contributes to burnout.

There is also a voluntary effort in motion. In June 2025, HHS Secretary Kennedy and CMS Administrator Oz convened a roundtable. About 50 insurers signed a voluntary pledge at the time. More than 60 have since joined. Together they cover about 257 million Americans across commercial, Medicare Advantage, and Medicaid managed care plans. In April 2026, the insurer trade group AHIP reported that participating plans have cut prior auth requirements by 11 percent since the pledge. The reduction is more than 15 percent in Medicare Advantage. The open question is whether those reductions actually show up in the 2025 public reports — or whether the services being cut are the ones that were already easy approvals anyway.

Why the courts matter here too

The new public data also matters in court. That may feel far removed from a billing office or a CFO’s desk, but it is closer than it looks.

The Lokken case is the clearest example. It is a class action filed in Minnesota federal court against UnitedHealth Group and its subsidiary NaviHealth. The families of Medicare Advantage patients claim that UHC used an AI tool called nH Predict to deny skilled nursing and post-acute care coverage. The lawsuit alleges the AI tool has about a 90 percent error rate — that is the share of denials that get overturned when patients appeal. In February 2025, the judge allowed the core claims (breach of contract and bad faith) to move forward. In March 2026, the court ordered UHC to turn over internal documents. Those include records of how UHC governed the AI tool, how it calculated cost savings from the NaviHealth deal, and how it measured its clinical staff. UHC’s response is due April 29, 2026.

Why should a hospital CFO or billing director care about that case? Because what a payer says publicly about its prior auth practices — and what the evidence shows about how those decisions were actually made — can be used in court. The public reports that just came out are the payer’s voice on the record. If there is ever a dispute about a pattern of denials, those reports are now part of the evidence. The same is true in False Claims Act cases, in ERISA disputes, and in bad-faith insurance cases. A hospital does not have to be a litigator to benefit from this. You just have to preserve the documentation.

What to watch next

Four things to keep an eye on in the next 12 months.

First, the drug rule. CMS proposed a new rule in April 2026 that would extend the public reporting requirement to prescription drugs. It would also set 24-hour urgent and 72-hour standard decision deadlines for drug requests. The comment period closes June 15, 2026. If your hospital has views on service-category reporting or denial-reason reporting, this is the time to weigh in.

Second, the January 1, 2027 API deadline. That is when the new electronic data-sharing tools are supposed to be live. The voluntary industry pledge promises that at least 80 percent of electronic prior auth approvals will be answered in real time by that date. Hospitals should check with their practice management and EHR vendors now about readiness.

Third, AI-denial litigation. Lokken is not alone. States like Connecticut and Indiana have moved to limit payer use of AI in coverage decisions. A ruling against UHC — or a big settlement — would change how every payer uses AI in prior auth. The April 29, 2026 document production deadline is the next moment to watch.

Fourth, the next reporting cycle. The 2025 data is a snapshot. The real test is March 2027, when payers post 2026 numbers. If hospitals start pulling the reports now and tracking them over time, they will be ready to spot any changes — better or worse — as soon as the second cycle arrives.

The bottom line

The March 31, 2026 reports are not perfect. They leave out drugs. They lump services together. They exclude whole categories of decisions through footnote carve-outs. They do not say why payers deny. Any hospital that treats the numbers as a full picture will be misled.

But for the first time, payers are on the record about their own prior auth numbers. That changes what hospitals can demand in contract talks. What they can document in appeals. What they can point to in complaints to regulators. What they can prove in court. The 2026 reports should be treated as the first cycle of data on the record — not the last word. What hospitals do with the data this year will shape whether payers report more honestly, or more carefully, next year.

 

Sources and references

All sources verified as of April 17, 2026. Links are to primary sources — government agencies, court dockets, independent research organizations, and the payers themselves.

The rule itself

What the numbers show

The voluntary insurer pledge

The Lokken case

State-level reporting examples

Federal oversight background

Our Partners Have a Combined Legal Experience of Over 100 Years

Meet our experts