Prior Authorization Approval and Denial Rate Reporting Under New CMS Transparency Requirements

CMS-0057-F just forced payers across the country to publish, for the first time, hard numbers on how often they approve prior authorization requests, how often they deny them, and how often those denials get reversed on appeal. That data set is now public, it covers calendar year 2025, and it turns what used to be guesswork about payer behavior into something a billing office can read and act on. The averages in this data are close to useless. The spread between payers is where the money is.

What the first round of published data actually shows about how payers behave

KFF's analysis covers 14 insurers across Medicare Advantage, Medicaid managed care, and ACA marketplace plans, representing roughly 71 million enrollees. Standard PA denial rates average about 12% in Medicare Advantage, 14% in Medicaid managed care, and 18% in ACA Marketplace plans. Forget those averages. They flatten a market where individual payers behave nothing alike, and averaging them together is exactly the kind of move that makes prior authorization look like a neutral clinical process instead of a set of business decisions made independently at each company.

Look at the spread within a single market and the picture changes fast. In Medicare Advantage, denial rates range from 5% at Elevance to 17% at UnitedHealth. In Medicaid managed care, one large county-level plan denies just 2% of standard requests while Independence Health Group denies 23%. In the ACA Marketplace, Guidewell sits at 3% and Centene sits at 25%. A patient covered by Centene faces roughly eight times the denial risk of a patient covered by Guidewell for functionally the same category of request. That is not clinical variation. That is a business decision each payer makes about how aggressively to say no.

UnitedHealthcare's numbers are worth sitting with because they moved so much in a single year. Its ACA Marketplace denial rate dropped from 33% in Plan Year 2023 to 20% in 2024, a substantial year-over-year improvement. Its Medicare Advantage denial rate, meanwhile, held around 17%, among the highest in the country for that segment. The company can clearly move its own denial rate when it wants to. That it hasn't moved it in Medicare Advantage tells you where the incentive currently sits. Its commercial appeal deadline runs 65 days, the shortest window in the industry, which matters directly to any billing office managing appeal calendars.

Median response times look tight on paper, clustering around one day across all three segments for standard requests and roughly half a day to a day for expedited ones. Response time isn't the number that should worry a billing office, though. Appeal overturn rate is. Medicare Advantage denials get reversed on appeal 67% of the time. Medicaid managed care denials get reversed 47% of the time. ACA Marketplace denials get reversed 43% of the time. Within Medicaid managed care alone, UnitedHealth Group overturned 81% of appealed denials, Molina overturned 48%, and CVS overturned just 22%. When two out of three Medicare Advantage denials collapse the moment someone pushes back, the initial denial was never really a clinical judgment. It was a bet that most practices wouldn't appeal, and that bet mostly pays off, because most practices don't.

Medicaid managed care deserves a separate look. Denial rates there already run higher than the Medicare Advantage average, and appeal overturn rates in that segment lag well behind those in Medicare Advantage. Stack those two facts and the harm compounds in both directions at once: patients lose access to care they qualified for, and practices leave collectible revenue on the table because nobody filed the appeal.

How payers gamed the first round of transparency reporting

A national physicians' association reviewed 15 Medicare Advantage contracts to check early compliance with CMS-0057-F. What it found wasn't refusal. It was technical compliance engineered to be unreadable, which is arguably worse, because it lets a payer point to a filed report while making sure almost nobody can use it.

One plan published an 832-page list of billing codes with no plain-language description attached to a single one of them. Several buried the required disclosures behind physician or member portals, so a visitor arriving from the payer's public website through ordinary navigation would never find them. Some published statistics that were mathematically impossible and left them uncorrected. Turnaround times appeared without units, so a figure like "1" could mean one day or one hour with no way to tell which. Entire categories, including behavioral health and post-acute services, were left out of the reporting altogether. One plan attached a note to its own published data warning that it "should not be relied upon."

CMS answered with updated guidance in August 2026, according to coverage from ACDIS and Healio. Password-protected portals no longer satisfy the public-accessibility requirement. Procedure codes without plain-language descriptions no longer satisfy the disclosure requirement. Every turnaround-time metric now needs explicit units, and any median under one calendar day has to be reported in hours rather than rounded down to "0 days." Plans must publicly list every medical item and service that requires PA, category by category. CMS also recommended, though didn't mandate, that plans use bar charts or pie charts and report raw counts alongside percentages, so a reader gets some sense of volume rather than a floating proportion.

The AMA calls the update a meaningful step forward, and it is one, but the gaps that remain are the ones that matter most. The current definition of prior authorization doesn't clearly reach rebranded versions of the same practice, things labeled "precertification" or "advance notice," or decisions made by third-party utilization management vendors acting on a payer's behalf. The AMA wants these metrics shown to people before they enroll, through public-facing enrollment tools, instead of buried in a report someone has to go digging for after they've already signed up. It also wants standardized reporting formats required rather than merely suggested, because without a common structure, comparing one payer's report against another's is still guesswork wearing a data costume.

KFF has made the sharpest point about all of this: even a fully compliant report stays limited, because every figure gets aggregated across all items and services with no breakdown by service type. As KFF has noted, these statistics offer limited insight into how insurers actually handle prior authorization case by case. The right way to read this first generation of data is as a floor, not a ceiling. The numbers that are there are real. The categories that are missing might just mean the payer didn't report them, not that no PA requirement exists for that service.

Why AI-driven denial tools by payers make the transparency data more urgent, not less

Several major payers now run algorithmic tools that make or shape prior authorization decisions at scale. The new transparency data gives practices the first quantified, aggregate look at what those tools actually produce, and it should change how anyone reads a denial letter.

The clearest case is playing out in federal court in Minnesota, where Estate of Lokken v. UnitedHealth Group proceeds as a class action alleging that UnitedHealth's nH Predict algorithm was used to improperly deny post-acute care coverage for Medicare Advantage enrollees. The plaintiffs allege the algorithm generated denials at a scale that produced a high rate of reversals on appeal. A federal magistrate judge has ordered UnitedHealthcare to turn over an extensive set of discovery documents, and though a federal judge dismissed five of the seven counts, the suit continues on the remaining two.

Cigna faces a parallel allegation in Kisting-Leung v. Cigna, filed in California federal court, where plaintiffs claim the company's PXDX algorithm auto-denied more than 300,000 claims without individual clinical review ever taking place. Humana faces a comparable suit in Kentucky, Barrows v. Humana, framed around fraud allegations for delegating clinical review decisions to AI systems instead of clinicians.

Three separate payers, three separate courts, and the same fact pattern each time: high-volume algorithmic denial, high overturn rates on appeal, and no clinician who ever actually looked at the case before it was denied. That is precisely the dynamic the transparency data is starting to render visible in numeric form, lawsuit or no lawsuit.

One rollback deserves to be named plainly, because it closes off the one window that might have proven algorithmic bias directly. The Trump Administration announced in June 2025 that it would not enforce a CY2025 requirement forcing Medicare Advantage plans to break down denial and approval rates by population, covering dually eligible individuals, low-income enrollees, and people with disabilities. That was the one mechanism in the rule built to reveal whether algorithmic tools produce disparate denial rates across different groups of patients. Without it, the question sits unanswered, and it will keep sitting unanswered until something forces the issue back onto the agenda.

A payer showing both a high denial rate and a high appeal overturn rate is showing the data signature of systematic over-denial, algorithmic or otherwise. That combination is now sitting in public reporting for the first time, and a practice that doesn't act on it is leaving the exact revenue the data just pointed to on the table.

How to read a payer's transparency report as a practice intelligence document

Start with the denial rate, but don't stop at the aggregate figure. Find the insurer-specific number for the exact market segment a given patient falls into, Medicare Advantage, Medicaid MCO, or ACA Marketplace, because the blended figure across all three tells you almost nothing about your own patient mix.

Then cross that denial rate against the appeal overturn rate for the same payer. A payer with a high denial rate and a high overturn rate is the single most useful signal in the entire report: it points to systematic over-denial that's recoverable on appeal, and it justifies putting staff time into appealing more aggressively against that specific payer. A payer with a low denial rate and a low overturn rate is a different animal. Denials that hold up there more likely reflect real documentation gaps on the submission side than reflexive friction on the payer's side, and that calls for fixing internal paperwork, not fighting the payer.

Turnaround time data belongs in the scheduling conversation, not just billing. Now that median response times under a day have to be reported in hours instead of rounded to zero, practices can build scheduling windows around actual payer behavior instead of a guess. Any payer whose numbers sit consistently close to the 7-day standard limit is a cash-flow risk, and that calls for earlier submission timelines built specifically around that payer's cases.

Pay close attention to what's absent from a plan's published PA list. Behavioral health and post-acute services were both documented as omitted categories in the first round of reporting. If a payer's report says nothing about a service category the practice bills heavily, treat that silence as a gap to call the payer about directly. Don't treat it as permission to assume no authorization is required.

Check whether the report pairs counts with percentages. A 25% denial rate on 12 requests is a completely different operational risk than 25% on 12,000 requests, and CMS currently recommends counts without requiring them under the 2024 final rule (CMS-0062-P proposes changing that). Confirm the report is actually reachable through ordinary navigation on the payer's public site rather than hidden behind a portal login. If it's hidden, that's noncompliance worth reporting to CMS directly, not a quirk to work around quietly.

Track the numbers year over year. UnitedHealthcare's ACA Marketplace denial rate moving from 33% to 20% in a single plan year is the kind of shift that should change appeal strategy and authorization workflow priorities for any practice dealing with that payer. Treat any report with internal inconsistencies, like the plan that flagged its own data as unreliable, as incomplete rather than confirmed. A practice that tracks these metrics by payer, year after year, builds a behavioral map that survives staff turnover. A practice that reads one year's report and files it away starts from zero again next year, no better off than a practice that never looked at all.

Where the data does not reach yet, and what practices must do in the gap

The single biggest limitation, per KFF's Pestaina, is aggregation. Every metric rolls up across all items and services with no service-level breakdown, so nothing in the public report tells a practice whether its specific procedures get denied more or less often than the reported average. A cardiology practice and a behavioral health practice reading the same payer's report are staring at the identical opaque number, despite facing entirely different authorization realities on the ground.

The health equity rollback makes this worse. Because the Administration chose in June 2025 not to enforce population-level breakdowns, practices serving large numbers of dually eligible or low-income Medicare Advantage patients have no way to check whether their specific population faces higher denial rates than the plan-wide average suggests.

Gold carding laws offer a partial workaround at the state level, but coverage is uneven and nobody should mistake it for a solution. As of 2025, at least six states have gold carding legislation on the books, exempting providers with strong track records from routine prior authorization. Most of these programs have limited scope, and the coverage and enforcement vary considerably across states. Texas strengthened its version this year: HB 3812, effective September 1, 2025, extends the evaluation window from six months to a full year of prior authorization history, giving providers a fairer shot at qualifying.

The industry has also made its own promises, separate from the CMS rule and worth exactly as much skepticism. In June 2025, around 60 health insurers pledged to reduce and simplify prior authorization requirements, with implementation phased in over multiple years. Physicians aren't buying it. The AMA Prior Authorization Physician Survey found that only 33%, one in three, believe the pledge will change anything in practice, and a voluntary pledge with no enforcement mechanism behind it has earned that skepticism.

Until service-level and population-level data actually exist, practices are stuck doing by hand what the report can't yet do for them: matching payer-level denial and overturn patterns against their own claims history, procedure by procedure, to find where the real friction sits. The federal data set is a genuine improvement over having nothing. It's a start, not a finish line, and any practice that treats it as more than that will leave real money uncollected.