Prior Authorization Data Is Finally Public. Health Systems Should Treat It as an Operating System.

For the first time, health systems have a clearer public view into how frequently major health insurers approve and deny prior authorization requests across Medicare Advantage, Medicaid managed care, and the Affordable Care Act marketplace. The numbers deserve attention — and they create an operational obligation.

Farzin Espahani

Strategic Advisor, Insurance Growth, Medicare Distribution, and Compliance

Based on 2025 insurer disclosures analyzed by KFF and reported by Becker's Healthcare, standard prior authorization requests were denied at average rates of approximately 12% in Medicare Advantage, 14% in Medicaid managed care, and 18% in the Affordable Care Act marketplace. The variation among insurers was considerably wider. Even more important is what happened when providers appealed: 67% of appealed denials were overturned in Medicare Advantage, 47% in Medicaid managed care, and 43% in the ACA marketplace.

These numbers do not prove that the original denials were inappropriate. The available data does not give us enough information to make that determination. They do show that prior authorization has become a significant operating workflow for health plans, providers, and increasingly patients themselves. Health systems should manage it accordingly.

Denial rates vary substantially by insurer

The new reporting requirements provide a level of payer-specific visibility that health systems have historically had difficulty obtaining consistently. The interactive chart below shows 2025 standard prior authorization denial rates across Medicare Advantage, Medicaid managed care, and the ACA marketplace. Select a market segment to compare insurers.

The differences should not automatically be interpreted as a measure of insurer quality. Patient populations differ. Benefits differ. Provider networks differ. The services requiring authorization differ. Documentation practices differ. Delegated utilization management arrangements can differ. KFF specifically cautions that the current data is too aggregated to determine what services are being denied or whether particular denials were appropriate.

Still, a health system receiving very different results from different payers now has another external data point against which to compare its own experience. That is useful.

The appeal numbers create a different operational question

The appeal data may be more actionable for provider organizations. Among the Medicare Advantage insurers reviewed, the share of appealed denials overturned ranged from 40% at Kaiser Permanente to 93% at Centene. The chart below shows overturn rates across all three market segments — select a tab to explore each.

There is an important selection issue here. Appealed cases are not necessarily representative of all denied cases. Providers may appeal the cases they believe have the strongest clinical or administrative basis for reconsideration. We also do not know from these disclosures how many denied requests were never appealed. So a 67% Medicare Advantage overturn rate should not be interpreted as meaning 67% of all original denials were wrong.

It does tell health systems something operationally important: a denied authorization cannot automatically be treated as the end of the workflow. For some cases, the economic and clinical value of a disciplined appeal process may be substantial.

How to read the denial and appeal numbers

There is an important distinction between the initial denial rate and the appeal overturn rate.

For example, a 15% denial rate means 15% of standard prior authorization requests were denied on the first decision, before any appeals.

An overturn rate such as 93% applies only to the subset of denied requests that providers actually appealed. The public disclosures do not tell us how many denied requests were never appealed.

That means the two percentages cannot be multiplied together to calculate a final or “net” denial rate.

There is also a selection effect. Providers are more likely to appeal cases where they believe they have a strong clinical or administrative basis for reconsideration. That can push overturn rates higher than they would be across the full pool of denied requests.

The public reporting also does not explain why requests were denied.

The data is aggregated across services, and insurers are not required to disclose denial reasons in these metrics. As KFF has pointed out, that makes it impossible to separate a disagreement over medical necessity from a missing-documentation problem, coding error, eligibility issue, or another administrative failure.

That distinction matters because some denials may originate upstream of the payer decision.

An incomplete submission, incorrect code, or missing clinical record can result in a denial even when the underlying service may ultimately qualify for coverage. In those situations, the payer appears in the denial statistics, but part of the underlying failure may sit in the provider’s authorization workflow or with a third-party business process outsourcing (BPO) operation supporting that workflow.

This is one reason future reporting would be more valuable if it included standardized denial reason codes.

Health systems and payers could then see where the problem actually starts. A medical-necessity disagreement requires a different response from a documentation failure, eligibility error, or coding problem.

Without that visibility, each side is left interpreting the same denial statistics through its own experience. Better reason-level reporting would make it easier to assign accountability, fix the right workflow, and reduce avoidable work for both payers and providers.

Prior authorization is also a revenue-cycle problem

Prior authorization is usually discussed as a utilization-management or patient-access issue. For providers, it also sits directly inside the revenue cycle. Consider what happens when an authorization fails. A request may require additional documentation. Staff may need to contact the payer. A physician may need to complete a peer-to-peer review. A procedure may be rescheduled. The patient may need additional communication. An appeal may have to be prepared. Revenue may be delayed or potentially lost.

Each individual case can look like a manageable exception. At health-system scale, thousands of exceptions become a labor, capacity, cash-flow, and patient-experience problem.

The operating question therefore extends beyond how many prior authorizations were denied. Health systems should also know:

Without that visibility, organizations are managing cases rather than managing the system producing the cases.

Turn denial reasons into workflow changes

Once a health system can consistently classify why prior authorization requests are being denied, the next step is to use that information to change the workflow upstream.

Different denial categories require different fixes.

If missing clinical documentation is a recurring problem, the organization can identify which records are typically missing and require them before submission.

If coding errors are driving denials, the issue may sit in coding validation or the handoff between the clinical and authorization teams.

If eligibility problems are common, verification needs to happen earlier.

If one payer repeatedly requests the same additional information for a particular service, that requirement can be built into the submission workflow for that payer rather than rediscovered case by case.

Health systems should track these patterns by payer, service line, facility, and denial reason, then assign an owner to the recurring problems.

The operating measures are straightforward:

• →First-pass authorization approval rate
• →Denials caused by missing or incorrect information
• →Resubmission rate
• →Appeal rate and overturn rate
• →Average time from request to resolution
• →Staff time per authorization
• →Delayed or lost revenue
• →Time from authorization request to patient care

This changes prior authorization management from responding to denials after they occur to reducing the conditions that create avoidable denials in the first place.

Technology can support that process by checking submissions for missing information, matching payer-specific requirements, identifying recurring denial patterns, and routing exceptions to the right team.

Clinical decisions, medical-necessity disputes, and compliance-sensitive cases still require accountable human review.

The goal should be measurable: fewer preventable denials, fewer resubmissions, less rework, and faster access to care.

The patient often carries part of the administrative burden

Prior authorization is an internal workflow until it interrupts care. Then the patient experiences it. A procedure gets postponed. A medication or treatment cannot begin. The physician's office asks the patient to wait while authorization is resolved. The patient may have to call the insurer, provider, or both. Sometimes the eventual request is approved. From an administrative reporting standpoint, that may look like a successful appeal. From the patient's perspective, there may still have been days or weeks of uncertainty and delay.

KFF's consumer research has found that prior authorization remains a substantial burden for insured Americans. In a January 2026 survey, 47% of insured adults said an insurer had denied, delayed, or altered access to a healthcare service, treatment, or medication during the prior two years. The proportion rose to 57% among people with chronic conditions. That is why health systems should measure more than appeal success. They should also measure time to resolution and time to care.

CMS is creating more visibility, but the data is still incomplete

The 2025 disclosures exist because of the Centers for Medicare & Medicaid Services Interoperability and Prior Authorization Final Rule. Beginning in 2026, affected payers must publicly report prior authorization metrics annually, with the first reports covering calendar year 2025. The policy also requires affected payers to meet shorter decision timelines: standard requests generally must receive decisions within seven calendar days and expedited requests within 72 hours as of January 1, 2026.

Beginning in 2027, additional API requirements are intended to support electronic exchange of prior authorization information between payers, providers, and patients. That should improve the infrastructure. It will not automatically fix the operating process around it.

KFF identified several important gaps in the current reporting. The data is aggregated across services. Insurers do not have to publicly identify the reasons behind each denial. Prescription drugs are excluded. The reporting therefore cannot tell a health system whether an insurer is disproportionately denying imaging, rehabilitation, surgery, durable medical equipment, or another category. For healthcare operators, this creates an opportunity to combine public payer data with their own internal data.

Health systems should build their own prior authorization intelligence

The CMS disclosures provide an external benchmark. Provider organizations still need a much more detailed internal view. A useful prior authorization operating system should connect five things:

Payers have an opportunity here as well

This should not be framed as providers becoming better at fighting insurers. Prior authorization exists partly because payers have a legitimate responsibility to manage utilization, administer benefits, protect program integrity, and control healthcare costs. Unnecessary or inappropriate utilization creates costs that eventually affect employers, government programs, taxpayers, and members.

The challenge is designing controls that accomplish those objectives without creating avoidable administrative work or delaying appropriate care. A payer repeatedly reviewing and ultimately approving the same categories of requests is also consuming its own clinical and administrative resources. High approval rates create a reasonable question about whether some services need prior authorization at all — KFF raised exactly that issue in its review of the new disclosures.

Better information can therefore help both sides. Providers can submit cleaner requests. Payers can identify requirements that create work without materially improving utilization management. Both can identify recurring failure points. And patients spend less time caught between two operating systems.

The practical next step

Health systems now have something they did not have before: publicly available payer benchmarks that can be compared with their own authorization performance. They should use them. Start with the largest payers and highest-volume service lines. Compare internal denial rates with the newly disclosed payer benchmarks. Identify the denial categories consuming the most staff time and delaying the most revenue. Measure appeal rates and overturn rates. Then trace the problem upstream to determine which denials could have been prevented before submission.

Human-controlled artificial intelligence can support this work by identifying recurring patterns, matching documentation requirements, flagging incomplete requests, prioritizing appeals, and surfacing payer-specific trends. Governance and human review remain essential, particularly where medical necessity, patient access, or regulatory obligations are involved.

CMS has created more transparency around prior authorization. The next useful measure of progress will be operational: fewer preventable denials, faster resolution of legitimate disputes, less administrative work, and fewer patients waiting while payer and provider workflows catch up with their care.