# Prior Authorization Form: What to Include and Tracking Log

> What a prior authorization form needs, the request process step by step, CMS 2026 decision deadlines, electronic requests (X12 278) and a free tracking log.

Canonical: https://origindatapartners.com/guides/prior-authorization-form
By: Origin Data Partners
Status: Published
Published: 2026-11-13
Updated: 2026-11-14
Sources checked: 2026-11-13

## Quick answer

A prior authorization form asks a health plan to confirm, before the service, that it is medically necessary and covered. Every form needs the patient and plan IDs, the ordering and rendering providers, diagnosis and procedure codes, dates, the site of care and clinical notes that meet the plan's criteria. Under a CMS rule, many public-program plans must decide standard requests within seven calendar days (drug authorizations excluded), generally from January 1, 2026.

## Key points

- Use the plan's own form or portal; the fields below are what almost every one asks for.
- Attach the documentation the plan's policy names, not a general note.
- CMS-0057-F: 72 hours for expedited and seven calendar days for standard requests, for the payers it covers.
- Track every request to its decision, expiry date and any denial reason.

## What is prior authorization?

HealthCare.gov defines preauthorization as "A decision by your health insurer or plan that a health care service, treatment plan, prescription drug or durable medical equipment is medically necessary", and notes it is "Sometimes called prior authorization, prior approval or precertification" ([HealthCare.gov](https://www.healthcare.gov/glossary/preauthorization/)). The practice usually submits the request; the plan approves, denies or asks for more information.


## What does a prior authorization request form include?

Most plans publish their own forms and portals. Almost every one asks for the items below, and a missing item is a common reason a request stalls.

| Section | What to fill in | Tip |
| --- | --- | --- |
| Patient | Name, date of birth, member ID, plan and group number | Copy the ID from a current eligibility check, not an old card |
| Ordering and rendering providers | Names, NPIs, tax ID, phone and fax | Include the facility if the site of care matters |
| Service requested | Procedure or drug codes, units, dates or date range, site of care | Procedure codes come from your coding system; check the plan's list of codes that need authorization |
| Diagnosis | Diagnosis codes that support the request | Match the diagnosis in the clinical notes |
| Clinical justification | Notes, test results, prior treatments tried and their outcomes | Answer the plan's published criteria point by point |
| Urgency | Standard or expedited, with the reason | Use expedited only when waiting could seriously harm the patient |
| Signature and date | Ordering provider or authorized staff | Keep a copy of exactly what was sent |


## What is the prior authorization process, step by step?

The same seven steps work for any plan; only the forms and deadlines change.

- Check: at scheduling, check whether the plan requires authorization for this service, code and site of care.
- Gather: collect the notes and results the plan's policy asks for.
- Submit: send the request through the plan's portal, an electronic transaction or the plan's form, and record the reference number.
- Follow up: track the request against the plan's deadline and answer any request for more information quickly.
- Record the decision: authorization number, approved units and dates, or the denial reason.
- Act on a denial: ask for a peer-to-peer review if the plan offers one, or appeal with the missing evidence.
- Recheck before service: confirm the authorization still matches the date, code and site.


## What are the CMS prior authorization requirements in 2026?

The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) applies to "Medicare Advantage (MA) organizations, state Medicaid and Children's Health Insurance Program (CHIP) Fee-for-Service (FFS) programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan (QHP) issuers on the Federally Facilitated Exchanges (FFEs)", which CMS calls "impacted payers" ([CMS fact sheet](https://www.cms.gov/newsroom/fact-sheets/cms-interoperability-and-prior-authorization-final-rule-cms-0057-f)).

Deadlines: impacted payers, excluding QHP issuers on the FFEs, must "send prior authorization decisions within 72 hours for expedited (i.e., urgent) requests and seven calendar days for standard (i.e., non-urgent) requests". Denial reasons: "Beginning in 2026, impacted payers must provide a specific reason for denied prior authorization decisions". These process provisions apply "generally beginning January 1, 2026", and CMS notes the rule "does not apply to prior authorization decisions for drugs". Payers must also publish prior authorization metrics each year, and build a Prior Authorization API, with API compliance dates "generally beginning January 1, 2027" ([CMS fact sheet](https://www.cms.gov/newsroom/fact-sheets/cms-interoperability-and-prior-authorization-final-rule-cms-0057-f)).

Plans outside the rule follow their own contracts and any state law that applies to them.


## How do electronic prior authorization requests work (X12 278 and FHIR)?

The HIPAA standard for authorization requests is the X12 278, "Health Care Services Review-Request for Review and Response (278)", ASC X12N/005010X217 ([45 CFR 162.1302](https://www.law.cornell.edu/cfr/text/45/162.1302)); CMS lists it for "Prior authorization and referrals" ([CMS](https://www.cms.gov/priorities/key-initiatives/burden-reduction/administrative-simplification/hipaa/adopted-standards-operating-rules)). For payers that build an all-FHIR Prior Authorization API under CMS-0057-F, HHS announced "the use of enforcement discretion" for the X12 278 standard ([CMS fact sheet](https://www.cms.gov/newsroom/fact-sheets/cms-interoperability-and-prior-authorization-final-rule-cms-0057-f)). In practice many requests still go through payer portals or fax.


## Prior authorization tracking log: an example

A tracking log keeps every request in one place from submission to decision and expiry. The [prior authorization tracking log (CSV)](https://origindatapartners.com/downloads/prior-authorization-tracking-log.csv) has these columns with three fictional rows.

| Request | Service and site | Submitted | Decision | Days | Next step |
| --- | --- | --- | --- | --- | --- |
| PA-301 | Knee MRI, outpatient imaging centre | Day 0, portal, standard | Approved, 1 unit, valid 60 days | 3 | Schedule inside the valid dates |
| PA-302 | Lumbar fusion, inpatient | Day 0, portal, standard | More information requested day 4; approved day 9 | 9 | Record the authorization number on the surgery booking |
| PA-303 | Biologic infusion, office | Day 0, fax, standard | Denied: step therapy not documented | 6 | Peer-to-peer requested; appeal with prior treatment history |

Fictional data. Add the payer, the plan's deadline and the denial reason code so you can see which plans and services cause delays.


## Common mistakes with prior authorization requests

These are the avoidable causes of authorization denials.

- Using an outdated form or the wrong plan's form.
- Sending a general note instead of answering the plan's published criteria.
- Getting approval for one site of care and performing the service at another.
- Letting an authorization expire before the service date.
- Not recording the reference number, so follow-up calls start from scratch.
- Missing the denial reason, so the appeal does not address it.


## Your authorization history shows how payers decide

Years of requests with the documentation sent, the decision, the reason and the turnaround record how plans apply their criteria in real cases. Very little of that is public.

AI developers building billing, denial and authorization tools ask for this kind of history, where each request or claim is joined to the payer's decision and what happened next. Only the practice or group that owns the records can agree to share them, and only after de-identification that meets HIPAA (see [de-identifying company data](https://origindatapartners.com/guides/de-identify-company-data-before-licensing)). A billing company holds these records for its clients and needs their written permission.

If your company keeps years of claims, denial and prior authorization records, the [guide for physician groups and billing companies](https://origindatapartners.com/guides/healthcare-billing-denial-prior-auth-data) explains what AI developers ask for and who signs. To see what yours could be worth, [describe them in six questions](https://origindatapartners.com/check-fit?sector=healthcare); no files or system access needed.


## Questions and answers

### What is a prior authorization request form?

The form, or portal screen, a provider uses to ask a health plan to approve a service, drug or device before it is provided. It identifies the patient, providers, the service and diagnosis codes, the dates and the clinical justification.

### What is prior authorization in simple terms?

A health plan's decision, before you get a service, that it is medically necessary and covered. It is also called preauthorization, prior approval or precertification.

### How long does a prior authorization take under the CMS rule?

For payers covered by CMS-0057-F, other than QHP issuers on the federal exchanges, 72 hours for expedited requests and seven calendar days for standard requests, generally from January 1, 2026. It does not cover drug authorizations.

### Can a patient submit a prior authorization themselves?

Usually the provider submits it, because the request needs the provider's orders and clinical notes. Patients can call their plan to ask what is needed and to check the status.

### What happens if a prior authorization is denied?

Plans covered by CMS-0057-F must give a specific reason from 2026; other plans follow their contracts and state law. The provider can ask for a peer-to-peer review where offered, resubmit with missing evidence or file an appeal within the plan's deadline.

### What is the X12 278 transaction?

The HIPAA standard electronic transaction for health care services review requests and responses, version ASC X12N/005010X217, used for prior authorizations and referrals.

### Is there a universal prior authorization form?

Not for every plan. Most plans publish their own forms and portals, so start with the plan's provider site, and use the form or portal that plan names.

### Does prior authorization for a prescription drug follow the same CMS deadlines?

No. The CMS fact sheet on the Interoperability and Prior Authorization Final Rule (CMS-0057-F) says, of its denial-reason provision, "As with all policies in this final rule, this provision does not apply to prior authorization decisions for drugs". A drug request still goes through the plan's own form or electronic request, and HealthCare.gov counts a prescription drug among the things a plan can require preauthorization for.

### Do Medicaid plans have to meet the CMS prior authorization deadlines?

Yes. State Medicaid and CHIP fee-for-service programs, Medicaid managed care plans and CHIP managed care entities are all payers covered by CMS-0057-F, and CMS says their operational provisions apply "generally beginning January 1, 2026". That includes decisions within 72 hours for expedited requests and seven calendar days for standard requests. Use the form or portal of the patient's own program or plan.

## Sources

- [HealthCare.gov glossary: Preauthorization](https://www.healthcare.gov/glossary/preauthorization/)
- [CMS fact sheet: Interoperability and Prior Authorization Final Rule (CMS-0057-F)](https://www.cms.gov/newsroom/fact-sheets/cms-interoperability-and-prior-authorization-final-rule-cms-0057-f)
- [45 CFR 162.1302: standards for referral certification and authorization (X12 278)](https://www.law.cornell.edu/cfr/text/45/162.1302)
- [CMS: Adopted standards and operating rules (HIPAA administrative simplification)](https://www.cms.gov/priorities/key-initiatives/burden-reduction/administrative-simplification/hipaa/adopted-standards-operating-rules)

## Related reading

- [Healthcare Claims Data for AI: Denials and Prior Auth](https://origindatapartners.com/guides/healthcare-billing-denial-prior-auth-data)
- [Denial Codes: CARC, RARC and CO-16, CO-45, CO-97 Explained](https://origindatapartners.com/guides/denial-codes-carc-rarc)
- [Electronic Remittance Advice: How to Read an 835 File](https://origindatapartners.com/guides/835-electronic-remittance-advice)
- [Licensing healthcare operational data for AI: HIPAA basics](https://origindatapartners.com/guides/license-healthcare-operational-data)
- [Who Owns Patient Records? Ownership, Access and Sale](https://origindatapartners.com/guides/who-owns-patient-records)