For the first time, health plans have to post how often they deny prior auth requests. Here is what the numbers show, what they leave out, and how hospitals can use them.

Updated August 18, 2026. This post was written in April 2026, when the first cycle of payer prior authorization reports had just been posted. KFF published its full analysis of that data in August 2026, and the AMA published its 2025 physician survey in May 2026. Both are reflected below, along with corrections to two dates in the litigation section.

Something changed on March 31, 2026, that every hospital billing office and CFO should know about. For the first time, health plans have to post their prior authorization numbers on their own public websites. How often they approve. How often they deny. How long they take to decide. How often they lose on appeal.

The rule covers Medicare Advantage plans, state Medicaid and CHIP plans, and plans sold on the ACA exchanges. Drugs are not included. The first reports cover all of 2025.

For hospitals, the new data is both less and more than it looks like. Less, because the numbers are self-reported by the payers. They sit on dozens of different websites. There is no single place to find them. Some payers make them hard to locate. More, because for the first time, a payer’s denial rate, appeal-overturn rate, and decision time are on the public record in the payer’s own words, hospitals can point to those numbers in contract talks. In appeal letters. In regulatory complaints. In court.

The question is not whether this changes the prior auth landscape. It does. The question is what hospitals should do with the data before payers learn how to manage what they report in the next cycle.

What the rule requires

CMS finalized the Interoperability and Prior Authorization Rule (CMS-0057-F) in January 2024. It built on an earlier rule from 2020. The new rule applies to Medicare Advantage plans, state Medicaid and CHIP plans, Medicaid and CHIP managed care plans, and plans sold on the federal ACA exchanges. CMS calls all of these impacted payers.

Two things took effect on January 1, 2026.

First, most impacted payers — but not ACA exchange plans — must decide on standard prior auth requests within seven calendar days. Urgent requests must be decided within 72 hours. The old standard was up to 14 days. There is a catch. Payers can extend the seven-day window by up to 14 more days in certain cases. That means a “compliant” decision can still take three weeks. When a payer denies a request, it must give a specific reason. The payer can send that reason by portal, fax, email, mail, or phone.

Second, the public reporting rule kicked in. The first reports were due March 31, 2026. Medicare Advantage plans report at the contract level. State Medicaid and CHIP report at the state level. Managed care plans report at the plan level. ACA exchange plans report at the issuer level. The numbers include the list of services that need prior auth, the share of standard and urgent requests approved and denied, the share of denials overturned on appeal, and the average decision time.

The rule also requires new data-sharing tools (called APIs) that take effect January 1, 2027. Those are the bigger structural fix. But the 2026 public numbers are what hospitals can use right now.

What the first numbers show — and what they hide

KFF took a first look at the new data on April 2, 2026, and its initial finding was blunt: the data, as posted, did not tell you much about what payers were actually approving and denying. That assessment has since been overtaken. On August 13, 2026, KFF published a full analysis of the same reports and pulled a great deal out of them. Across Medicare Advantage, Medicaid managed care, and the ACA federally facilitated Marketplace, insurers denied at least one in eight standard prior authorization requests in 2025. Denial rates ranged from about 12 percent in Medicare Advantage to 18 percent in ACA plans, with wide variation between insurers. UnitedHealth Group reported the highest standard denial rate among Medicare Advantage insurers at 17 percent; Elevance reported the lowest at 5 percent. Median response time for standard requests was about one day.

The lesson for hospitals is not that the data is useless. It is that the data rewards patient reading, and that the first look and the careful look produce different conclusions.

UnitedHealthcare’s Medicare Advantage report shows how both readings are possible at once. UHC reports that 97.5 percent of its MA medical claims do not require prior auth at all. Of the prior auth requests it does review, it approves 95.4 percent. Average decision time: 24 hours. Those are strong numbers, and they are hard to square with a 17 percent standard denial rate. The reconciliation is in the footnotes.

UHC excludes prior auth requests sent to capitated-delegated providers. It excludes behavioral health delegates. Physical health delegates. Dental delegates. It excludes transitions to post-acute care. It excludes members in plans run by non-integrated entities. And it excludes drugs entirely, as the rule requires.

That list of exclusions matters. Post-acute care — like skilled nursing after a hospital stay — is exactly the type of decision at the heart of Estate of Lokken v. UnitedHealth Group. That is the class action challenging UHC’s use of an AI tool called nH Predict to cut off skilled nursing coverage for Medicare Advantage patients. On March 9, 2026, Magistrate Judge Shannon G. Elkins granted the plaintiffs’ motion to compel in part and denied it in part, ordering production in some form across all seven categories the plaintiffs sought, while cutting back individual requests within them. UHC must produce documents analyzing or discussing nH Predict, including records of its development, design, and use; cost-savings analyses tied to the naviHealth acquisition as they relate to post-acute care claims; government — but not internal — investigations into UHC’s use of AI in post-acute claims; AI Review Board oversight records; and performance and disciplinary records for post-acute care coordinators, some reaching back to 2017. The court declined to compel the data, rules, source code, and medical guidelines underlying nH Predict itself. The order is narrower than a blanket production, but it reaches the core of the case: how UHC governed nH Predict and how its clinical staff were measured. The order required UHC to produce all responsive documents within 21 days, making the deadline March 30, 2026.

Those exclusions apply to the summary figures on UHC’s landing page. They do not apply to the reports themselves. UHC states that the H-Contract reports cover January 1 through December 31, 2025, including prior authorization requests for transitions to post-acute care and requests submitted to capitated-delegated providers and to behavioral health, physical health, and dental delegates. Only prescription drugs are excluded outright, and non-integrated entities are reported separately. So the gap is between UHC’s headline numbers and UHC’s own filings, not between those filings and the decisions at issue in the litigation. For a hospital, that means the useful data is one click past the summary, and the summary is what most readers will stop at.

KFF’s April review flagged broader problems with the reporting rule itself. There is no consistent place to find the reports on payer websites. Some payers put them on one page. Others spread the numbers across many pages. The data is lumped together across all services. A hospital cannot tell whether imaging, orthopedic procedures, or behavioral health makes up most denials. Payers do not have to say why they denied a request. And there is no central CMS dashboard that collects everyone’s numbers in one place. Each payer posts on its own site in its own format. Some states — Washington and Massachusetts — already require more useful data, broken out by service and including drugs. KFF suggests the federal rule should follow their lead.

There is one more gap worth naming. The rule requires no independent audit. Payers post their own numbers, on their own websites, in their own chosen format. CMS can enforce compliance if a payer fails to report, but nothing requires a third-party check on whether what gets posted is accurate or complete.

UnitedHealthcare’s page illustrates the point rather than answering it. UHC states that FTI Consulting reviewed its approach and key assumptions and recalculated the metrics from summary-level data to confirm there were no computational errors. Read the accompanying language, though: FTI says the review was performed on the basis of documentation provided to it “without independent verification,” and that it “has not subjected the information contained herein to an examination in accordance with generally accepted auditing or attestation standards.” That is a check on arithmetic, not on the underlying data, and FTI says so plainly. It is more than most payers have published. It is not an audit.

Hospitals should treat these reports accordingly: useful, citable, and on the record, but not verified.

WHAT PAYERS MUST REPORT

For 2025 data, posted by March 31, 2026:

• The list of services that require prior auth
• Share of standard requests approved and denied
• Share of urgent requests approved and denied
• Share of denials reversed on appeal
• Average time for standard and urgent decisions
• Share of requests where the timeline was extended

Not required: drug prior auths (a separate CMS rule from April 2026 would add them). The data is not broken out by service type. Payers do not have to say why they denied a request.

For CFOs: three ways to use the data

The new numbers give hospital finance leaders leverage they did not have before. Here is where to put them to work.

1. Contract talks with payers. When you sit down to negotiate a payer contract, the payer’s own numbers are now on the record. If a plan claims its prior auth process runs smoothly but its public report shows a high denial rate and most of those denials get overturned on appeal, the gap is visible. The payer has to explain it or fix it. Use these numbers in rate talks. Use them when you push for services to be carved out of prior auth. Use them when you negotiate faster peer-to-peer review.
2. Payer scorecards and benchmarking. If your hospital tracks payer performance, you can now compare your own experience against the payer’s self-reported national numbers. If you see denial rates with a payer that are much higher than what the payer reports publicly, that is a red flag. It means one of two things. Either your hospital is seeing something unusual and you need to dig into why. Or the payer’s public numbers leave out the decisions you are actually fighting. Either way, it is a data point for escalation and a talking point for the next contract cycle.
3. Revenue forecasting. Denials and appeals affect cash flow. Now that you can see what a payer’s overturn rate looks like, you can make more accurate assumptions about recovery rates. Use the right year. KFF’s analysis of CMS data put the Medicare Advantage overturn rate at 80.7 percent for 2024. KFF’s August 2026 analysis of the newly reported 2025 metrics puts it at 67 percent for Medicare Advantage, 47 percent for Medicaid managed care, and 43 percent for the ACA federally facilitated Marketplace. Forecasts built on the 2024 figure are running about thirteen points high for Medicare Advantage. A denial pattern that regularly reverses on appeal is also a pattern worth investing appeal-team resources against. The payoff is measurable.

For billing and revenue cycle teams: how to use it day to day

The people who actually fight prior auth denials get something they have not had before — the payer’s own numbers to quote back.

1. Stronger appeal letters. Pull the payer’s 2025 report and work the relevant numbers into your appeal templates. For example: “This payer’s own public report shows that X percent of denials are reversed on appeal. This decision fits that pattern.” Use the payer’s own voice against its own decision. Courts, regulators, and the payer’s own appeals reviewers respond to a payer being confronted with its own numbers. It is harder to dismiss than a general claim about unfair denials.
2. Complaints to state insurance regulators. State insurance commissioners now have a public baseline to work from. If you file a complaint about a payer’s conduct, you can point to where the payer’s practice differs from what the payer has reported to the public. That gives your complaint more weight than an individual account of what happened with one patient.
3. Watching for the footnotes. This is the single most important tip. Do not take a payer’s top-line numbers at face value. Read the footnotes. Find out what the payer excluded. UHC’s landing-page summary, as we noted, leaves out post-acute care transitions, delegated providers, and behavioral health delegates, even though its contract-level reports include them. Those are often the exact cases your team is fighting. If the payer’s public numbers look good but your appeals queue tells a different story, the answer may be in the footnotes, or one click past them. Document the gap. It is useful in every setting — contract talks, appeals, complaints, and, if needed, litigation.

The numbers behind the rule

Some context. KFF analyzed CMS data and published the findings on January 28, 2026. Medicare Advantage insurers made nearly 53 million prior auth decisions in 2024. They fully or partially denied 4.1 million of them. That is a 7.7 percent denial rate in aggregate, and the aggregate hides the spread. UnitedHealth Group denied 12.8 percent of the requests it received, the highest share of any insurer, followed by Centene at 12.3 percent and CVS Health at 11.9 percent. Elevance denied 4.2 percent. Only 11.5 percent of denied requests were appealed. But of the appeals that were filed, 80.7 percent were partially or fully overturned. That pattern has held every year since 2019. More than eight in ten appealed denials get reversed.

The burden on the physician side is big, too. The American Medical Association surveyed 1,000 physicians at the end of 2024. The results: an average of 39 prior auth requests per physician per week. Roughly 13 hours of physician and staff time per week, per doctor. Ninety-three percent of physicians said prior auth delays patient care. Eighty-nine percent said it contributes to burnout.

There is also a voluntary effort in motion. In June 2025, HHS Secretary Kennedy and CMS Administrator Oz convened a roundtable. About 50 insurers signed a voluntary pledge at the time. More than 60 have since joined. Together they cover about 257 million Americans across commercial, Medicare Advantage, and Medicaid managed care plans. In April 2026, AHIP and the Blue Cross Blue Shield Association jointly reported that participating plans have cut prior auth requirements by 11 percent since the pledge, with a reduction of more than 15 percent in Medicare Advantage.

Physicians do not see it. The AMA surveyed 1,000 practicing physicians again in 2025, publishing the results on May 13, 2026, ahead of the pledge’s first major deadline. Only one in three believed the pledge would make a meaningful difference. More than a quarter reported that prior authorization had directly caused a serious adverse event for a patient, including hospitalization, permanent harm, or death. Asked to rank insurers by administrative burden, physicians put UnitedHealthcare highest.

That last finding is worth pausing on, because it arrives by a completely different route than the payer reports do. A physician survey and a payer’s own filed metrics both point to the same insurer. When two methods that share no data converge, the finding is harder to dismiss than either would be alone.

Why the courts matter here too

The new public data also matters in court. That may feel far removed from a billing office or a CFO’s desk, but it is closer than it looks.

The Lokken case is the clearest example. It is a class action filed in Minnesota federal court against UnitedHealth Group and its subsidiary naviHealth. The families of Medicare Advantage patients claim that UHC used an AI tool called nH Predict to deny skilled nursing and post-acute care coverage. The lawsuit alleges the AI tool has about a 90 percent error rate — that is the share of denials that get overturned when patients appeal. In February 2025, the judge allowed two core claims to move forward: breach of contract, and breach of the implied covenant of good faith and fair dealing. The court dismissed the plaintiffs’ remaining claims — including insurance bad faith, unjust enrichment, negligence per se, and the state consumer-protection and unfair-competition claims — with prejudice, on Medicare Act preemption grounds.

The March 2026 discovery order described above reached further than its list of documents suggests. It also required UHC to identify the medical directors and care coordinators who issued notices of non-coverage for 300 members of the putative nationwide class. And in setting the scope, the court noted the October 2024 Senate Permanent Subcommittee on Investigations finding that UHC’s denial rate for post-acute claims more than doubled after it began using naviHealth and nH Predict in 2019. A federal magistrate treating that Senate finding as relevant to discovery is a stronger signal than the report standing on its own.

Why should a hospital CFO or billing director care about that case? Because what a payer says publicly about its prior auth practices — and what the evidence shows about how those decisions were actually made — can be used in court. The public reports that just came out are the payer’s voice on the record. If there is ever a dispute about a pattern of denials, those reports are now part of the evidence. The same is true in False Claims Act cases, in ERISA disputes, and in bad-faith insurance cases. A hospital does not have to be a litigator to benefit from this. You just have to preserve the documentation.

What to watch next

Four things to keep an eye on in the next 12 months.

First, the drug rule. CMS proposed a new rule in April 2026 that would extend the public reporting requirement to prescription drugs. It would also set 24-hour urgent and 72-hour standard decision deadlines for drug requests. The comment period closed June 15, 2026. The American Hospital Association filed comments that day. Watch for the final rule and for whether CMS adopts service-category or denial-reason reporting in response.

Second, the January 1, 2027 API deadline. That is when the new electronic data-sharing tools are supposed to be live. The voluntary industry pledge promises that at least 80 percent of electronic prior auth approvals will be answered in real time by that date. Hospitals should check with their practice management and EHR vendors now about readiness.

Third, AI-denial litigation. Lokken is not alone. States like Connecticut and Indiana have moved to limit payer use of AI in coverage decisions. A ruling against UHC, or a big settlement, would change how every payer uses AI in prior auth. Document production was completed under the March 2026 order, and the case is now moving toward class certification, which is the next moment to watch.

Fourth, the next reporting cycle. The 2025 data is a snapshot. The real test is March 2027, when payers post 2026 numbers. If hospitals start pulling the reports now and tracking them over time, they will be ready to spot any changes — better or worse — as soon as the second cycle arrives.

The bottom line

The March 31, 2026 reports are not perfect. They leave out drugs. They lump services together. They exclude whole categories of decisions through footnote carve-outs. They do not say why payers deny. Any hospital that treats the numbers as a full picture will be misled.

But for the first time, payers are on the record about their own prior auth numbers. That changes what hospitals can demand in contract talks. What they can document in appeals. What they can point to in complaints to regulators. What they can prove in court. The 2026 reports should be treated as the first cycle of data on the record — not the last word. What hospitals do with the data this year will shape whether payers report more honestly, or more carefully, next year.

Sources provided upon request.