Medicaid Prior Authorization Requirements

Medicaid prior authorization (PA) is a utilization management tool that requires providers to obtain approval from a state Medicaid agency or its managed care contractor before delivering certain covered services. The requirement applies across prescription drugs, durable medical equipment, specialty procedures, and behavioral health services, with specific scope varying by state. PA decisions directly affect whether and when beneficiaries receive care, making the mechanics of the process consequential for both providers and enrollees. A broader overview of Medicaid's structural dimensions is available on the Medicaid Authority homepage.

Definition and scope

Prior authorization under Medicaid is a prospective review mechanism — meaning approval must be secured before service delivery, not after. This distinguishes it from retrospective review (conducted after a claim is submitted) and concurrent review (conducted during an ongoing course of treatment such as an inpatient stay).

The Centers for Medicare & Medicaid Services (CMS) does not mandate a uniform prior authorization list across states. Instead, 42 C.F.R. § 440.230 permits states to "place appropriate limits on a service on the basis of criteria such as medical necessity or utilization control." Within that authority, each state's Medicaid program defines which services require PA, the clinical criteria for approval, and the timelines governing decisions.

Federal rules establish minimum procedural floors. Under 42 C.F.R. § 438.210, managed care organizations (MCOs) contracting with state Medicaid programs must resolve standard PA requests within 14 calendar days, with a possible 14-day extension under defined circumstances. Expedited requests — those involving an urgent clinical situation — must be resolved within 72 hours.

The Consolidated Appropriations Act of 2023 added new CMS rulemaking obligations to standardize electronic prior authorization timelines and transparency requirements across Medicare Advantage, Medicaid managed care, and CHIP, reflecting congressional recognition that PA delays had become a systemic access barrier.

How it works

A prior authorization request moves through a defined sequence of steps:

1. Trigger identification — The provider's billing or clinical system flags a service, drug, or procedure code as PA-required under the patient's Medicaid plan.
2. Clinical documentation compilation — The provider assembles supporting records: diagnosis codes, treatment history, lab results, and, where applicable, documentation of step-therapy requirements (prior trial of a lower-cost alternative).
3. Submission — The request is submitted to the MCO or state fee-for-service (FFS) program via phone, fax, web portal, or, increasingly, electronic prior authorization (ePA) using NCPDP SCRIPT or X12 278 transaction sets.
4. Clinical review — A plan clinician or delegated utilization management vendor reviews the request against plan-specific clinical criteria, which must be based on — though are not always identical to — evidence-based guidelines.
5. Decision and notification — The plan issues an approval, denial, or partial approval. Federal rules require written notice of denials that includes the specific clinical rationale and information about appeal rights.
6. Appeals pathway — Denied requests can be appealed through the plan's internal process and, if upheld, through an external independent review or a Medicaid fair hearing before the state agency.

Common scenarios

Prior authorization requirements appear most frequently in four service categories:

Specialty pharmaceuticals — High-cost drugs, including biologics for autoimmune conditions and direct-acting antivirals for hepatitis C, routinely require PA. Step-therapy protocols — requiring documented failure of a first-line drug before the requested agent is approved — are common in this category.

Behavioral health services — Inpatient psychiatric admissions, residential substance use disorder treatment, and applied behavior analysis (ABA) therapy for autism spectrum disorder are among the behavioral health services most frequently subject to PA. The federal Mental Health Parity and Addiction Equity Act (MHPAEA) constrains but does not eliminate PA use in this domain; plans may not apply PA more stringently to behavioral health than to analogous medical/surgical benefits (CMS MHPAEA guidance).

Durable medical equipment (DME) — Powered wheelchairs, home oxygen equipment, and continuous positive airway pressure (CPAP) devices typically require PA, with documentation requirements specifying functional assessment scores or sleep study results.

Non-emergency medical transport (NEMT) — Transportation to covered medical appointments is a mandatory Medicaid benefit; PA requirements for NEMT vary but are common in broker-managed programs.

Decision boundaries

The distinction between approvals and denials in PA turns on the application of clinical criteria to submitted documentation.

Standard vs. expedited review contrasts on urgency grounds: a request qualifies as expedited when the standard 14-day timeline could seriously jeopardize the enrollee's life, health, or ability to attain, maintain, or regain maximum function — language drawn directly from 42 C.F.R. § 438.210(d)(2).

Approvals vs. denials hinge on whether submitted documentation satisfies the plan's coverage criteria. A denial based on "not medically necessary" differs legally from a denial based on "not a covered benefit" — the former is challengeable through medical necessity appeals with independent clinical review, while the latter is a coverage interpretation question resolved through plan or state policy review.

Partial approvals — in which fewer units, a shorter duration, or a lower-cost alternative is authorized — represent a distinct category that triggers the same appeal rights as a full denial for the portion not approved.

The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), published in 2024, mandates that Medicaid FFS programs and MCOs implement PA APIs by January 1, 2027, enabling electronic decision exchange and requiring public reporting of PA approval and denial rates by service category — creating a new layer of accountability for how decision boundaries are applied in practice.

For questions about specific state procedures, the frequently asked questions resource addresses eligibility and coverage topics, and the how to get help for Medicaid page outlines assistance pathways for beneficiaries navigating disputes.