State Prior Authorization Reform Laws and Commercial Payer Applicability

Federal prior authorization reform, the CMS interoperability rule finalized in January 2024, reads like a sweeping fix. It isn't. The rule binds Medicare Advantage, Medicaid and CHIP fee-for-service, Medicaid managed care, CHIP managed care, and QHP issuers on the federal exchange, but it leaves employer-sponsored plans, the largest slice of the commercially insured population, completely untouched. What actually governs prior authorization for most commercially insured patients is a patchwork of state law, and that patchwork is where the real regulatory action is happening.

The federal rule itself is worth understanding before turning to the states, because its limits define the gap state legislatures are trying to fill. Covered payers must issue standard PA decisions within seven calendar days and urgent decisions within 72 hours, starting in 2026. They must publicly post PA metrics, including approval rates, denial rates, turnaround times, and appeal outcomes, with the first reports covering 2025 data due by March 31, 2026. A Prior Authorization API and full interoperability requirement lands January 1, 2027. Drugs are excluded from both the API and the process requirements entirely. A separate 2024 rule, CMS-4201-F, restricts Medicare Advantage plans to using PA only to confirm diagnoses or determine medical necessity, but again, that only touches MA. None of it reaches a fully insured commercial plan sold to an employer group by a large national carrier. For that plan, and for the physicians billing against it, state law is the only law that applies. Regulators have floated the idea that employer-sponsored plans could eventually face similar mandates, but no such rule exists today, and nothing in the pipeline suggests one is imminent.

How state legislatures became the primary regulator of commercial PA

States regulate insurance through their own insurance codes, and that's the lever that gives state PA laws actual teeth over commercial carriers. A fully insured plan sold in Ohio has to follow Ohio's PA rules, a fully insured plan sold in Texas has to follow Texas's, and so on. That's a real hook.

Self-funded employer plans are a different story. ERISA preempts state insurance law for those plans, which means a self-insured employer, even one operating in a state with strict PA timelines, can sit outside all of it. Practices need to know which of their commercial patients carry fully insured coverage versus self-funded coverage, because the answer changes which rules actually apply to that claim.

The legislative pace has picked up fast. Ten states passed PA reform legislation in 2024: Colorado, Illinois, Maine, Maryland, Minnesota, Mississippi, Oklahoma, Vermont, Virginia, and Wyoming, according to an AMA report cited by Becker's in August 2024. Since January 1, 2025, at least 18 states have taken legislative action on PA. The year before that, nine states plus Washington, D.C. passed PA reform laws in 2023. This isn't a one-off session of pent-up frustration. It's a multi-year trend that keeps accelerating.

What's driving it isn't hard to find. According to the AMA's 2025 Prior Authorization Physician Survey, physicians complete an average of 40 prior authorizations per week, and that volume eats up roughly 12 staff hours weekly. That's more than a full workday of staff time, every week, spent on paperwork instead of patient care. Once a burden gets that visible and that measurable, it becomes a legislative target, and lawmakers in both parties have found it an easy issue to campaign on.

The result for practices is a patchwork with real teeth but no consistency. States differ on what they require, who they cover, and when the rules take effect. A multi-location practice, or even a single practice seeing patients covered by out-of-state employer plans, has to track overlapping and sometimes contradictory obligations depending on where the plan is regulated.

What state PA laws actually require: the four main categories of reform

Most state PA laws fall into four buckets: decision timelines, transparency requirements, substantive limits on what PA can touch, and continuity of care protections.

Timelines are the most common target, and they vary widely. Alaska, Delaware, Indiana, Iowa, Nebraska, North Dakota, Oklahoma, and Virginia have all enacted urgent and non-urgent decision windows in recent sessions. Urgent timelines run anywhere from 24 to 72 hours depending on the state, non-urgent from 2 to 15 days. Wyoming set 72 hours urgent and 5 calendar days non-urgent in 2024. Oklahoma matched the 72-hour urgent window but gave non-urgent requests 7 days, also in 2024. Iowa's HF 303, passed in 2025, set 48 hours urgent and 10 calendar days non-urgent, and it also requires utilization review organizations to file annual reports with the Insurance Commissioner covering approval and denial rates. Indiana's SB 480, also 2025, went further: 24 hours urgent, 48 hours non-urgent, and if the insurer misses either deadline, the request is automatically approved. That auto-approval trigger is about as strong an enforcement mechanism as any state has written into a PA law.

Transparency rules are the second bucket, and they're mostly about forcing payers to show their work before a request even gets filed. Oklahoma's 2024 law requires PA procedures to be posted on websites accessible to both patients and providers. Illinois, in the same year, requires payers to publish every service that requires PA on their website, alongside tighter provider network directory rules. Nebraska, Arkansas, and North Dakota all require insurers to post PA policies, clinical criteria, and documentation requirements in a clear, accessible format. Oklahoma also requires 60 days' advance notice before any PA change that affects patients with chronic conditions, giving practices time to adjust before a rule shift catches a patient mid-treatment.

Substantive reforms go after what PA can be applied to in the first place. Illinois banned PA for inpatient psychiatric admissions starting in 2026. New Mexico's HB 39, passed in 2025, removed PA and step therapy requirements entirely for patients with rare diseases, including off-label prescribing when it's used to treat one. Alaska and Nebraska now require carriers to base PA determinations on peer-reviewed clinical criteria, not internal guidelines alone. Some states have moved to require that denials be reviewed by a clinician with relevant specialty expertise, so that a cardiology denial, for instance, is not reviewed by someone with no cardiology background. Montana's HB 398, from 2025, goes a step further and says only licensed physicians can issue adverse determinations at all.

Continuity of care is the fourth bucket, and it's aimed at a specific pain point: patients who switch plans mid-treatment and lose an authorization they already had. Wyoming's 2024 law requires payers to honor prior PA approvals when a patient changes plans. Indiana's SB 480 requires a utilization review entity to keep honoring an authorization it already granted when a patient moves to a new health plan. Montana's HB 398 requires a new plan to honor prior approvals for at least three months after a patient switches, and it sets PA approvals for chronic condition patients to remain valid for 12 months. Several other states took up similar continuity protections in their recent sessions. Massachusetts has proposed legislation, still pending as of 2024, that would require new insurers to honor prescription drug PAs from a patient's previous plan for at least 90 days, with chronic condition PAs valid for up to a year.

Gold-card programs: what they are, which states have them, and how they are evolving

Gold-card programs work on a simple premise: if a physician's requests get approved almost every time, why make that physician ask permission at all? Under a gold-card program, a payer exempts a provider from PA requirements for services where that provider has a track record of high approval rates, adjusted for the mix of patients being treated. Most programs set the bar around a high approval rate, though some payer programs push that threshold to 92% or even higher.

Arkansas, Colorado, Louisiana, Texas, West Virginia, and Wyoming all had gold-card legislation on the books before 2025. This year brought amendments that expand those programs rather than just tweak them. Arkansas's HB 1301 removed a provision that let insurers strip a provider's gold-card status if that provider's volume of gold-carded procedures grew by more than 25%, and it extended gold-card status to a provider's entire group practice, not just the individual physician, which matters a great deal for multi-physician groups. Texas's HB 3812 stretched the gold-card look-back period from six months to a full year, giving practices a longer track record to qualify on. West Virginia's SB 833 clarified that pharmaceutical medications sit outside the gold-card exemption entirely, closing a gap that had left drug PA in an ambiguous spot.

UnitedHealthcare announced it would eliminate prior authorization for about 20% of its procedure codes. That's a useful data point: state law is already shaping voluntary commercial behavior well beyond the specific states that passed it.

For practices, gold-carding turns PA approval-rate tracking from a nice-to-have into a requirement. A billing team that can't pull approval rates by payer and by procedure code has no way of knowing whether the practice already qualifies for gold-card status somewhere, or how close it is to qualifying.

AI in prior authorization decisions: the emerging state regulatory layer

CMS issued guidance in 2024 clarifying that Medicare Advantage insurers can use AI and automated tools in PA decisions, as long as they follow existing anti-discrimination and bias rules. Federal rulemaking on AI use in PA has not kept pace with state activity. States are filling that space instead.

Some states have moved to prohibit insurers from letting AI make coverage decisions on its own, requiring a human reviewer in the loop. Maryland's HB 820, also 2025, bars insurers from basing utilization review decisions solely on group-level datasets when AI is involved, requiring decisions to rest on patient-specific information, and it requires insurers to report to the state Insurance Commissioner whenever AI played a role in an adverse determination. Legislation to bar AI algorithms from making coverage determinations outright has gained traction in multiple states, driven in part by a ProPublica investigation that found an AI tool had denied more than 300,000 claims in a two-month span.

This matters operationally in a specific way. A denial with no human clinical reviewer behind it calls for a different appeal strategy than a denial a physician actually reviewed and signed off on. Knowing whether the state governing a given payer requires human sign-off on adverse determinations should shape how a practice frames its appeal and how much priority it assigns to fighting that denial. Montana's HB 398 reinforces the same principle by statute, with requirements around who may issue adverse determinations, which overlaps directly with the broader AI-restriction push happening elsewhere. Expect more states to adopt some version of a human-review mandate in coming sessions. AI restrictions are shaping up as a third distinct category of PA reform, sitting alongside timeline mandates and substantive coverage limits.

What the first public PA denial data reveals about commercial payer behavior

The 2024 CMS interoperability rule forced something that had never existed before: mandatory public disclosure of PA denial data. KFF analyzed the first dataset, published in 2026, covering 14 insurers and roughly 71 million enrollees across 2025.

The topline denial rates alone tell a story. Medicare Advantage insurers denied 12% of standard PA requests. Medicaid managed care insurers denied 14%. ACA Marketplace insurers denied 18%, the highest of the three categories.

Averages hide the more useful finding, though, which is how wildly individual insurers varied. In Medicare Advantage, standard denial rates ranged from 5% at Elevance to 17% at UnitedHealth Group. In Medicaid managed care, the spread ran from 2% at L.A. Care Health Plan to 23% at Independence Health Group. In the ACA Marketplace, GuideWell denied just 3% of standard requests while Centene denied 25%, an eightfold gap within the exact same market segment, covering the exact same category of plan. That range says more about how a given payer runs its utilization review than any single average could.

KFF flagged real limits in the data. Denial figures are aggregated across all services and items with no breakdown by service type, and payers aren't required to disclose why a request was denied. KFF pointed to Massachusetts and Washington as states running more granular reporting models worth watching. Separately, a Komodo Health analysis of more than 4 billion claims found that medical claim denials rose roughly a quarter between 2016 and 2023.

None of this touches employer-sponsored or fully insured commercial plans outside the ACA marketplace. The entire public dataset covers Medicare Advantage, Medicaid managed care, and ACA Marketplace only. Fully insured commercial and employer-sponsored plans produce no equivalent mandatory disclosure, which leaves practices trying to gauge commercial payer behavior with no real benchmark to check it against.

Why denial appeals are underused and what the overturn data implies for practices

Denials get appealed far less often than the outcome data would justify. KFF's analysis of the 2025 public data found that 67% of Medicare Advantage denials were overturned on appeal, 47% of Medicaid managed care denials were overturned, and 43% of ACA Marketplace denials were overturned. Those are not marginal numbers. Nearly half to two-thirds of denials that get appealed end up getting reversed, depending on the plan type.

Insurer-level variation shows up here too. In Medicare Advantage, Centene overturned 93% of appealed denials while Kaiser Permanente overturned 40%. In Medicaid, UnitedHealth Group overturned 81% against CVS's 22%. In the ACA Marketplace, Centene again led at 54%, with Health Care Service Corp. sitting at just 16%.

A denial functions less like a final ruling and more like an opening bid that a properly built appeal often beats. The real question for a practice isn't whether appeals work, the data settles that, it's whether the practice has a workflow built to act on a denial the moment it lands rather than let it sit in a queue.

State law adds specific leverage here that a practice can use directly. Oklahoma requires denial appeals to be reviewed by a provider of the same or similar specialty as the one that submitted the original request. Montana requires that only a licensed physician issue the adverse determination in the first place. Knowing which state's rules govern the payer that issued a given denial should shape the actual argument a practice makes in its appeal, not just whether it bothers appealing at all.

The stakes go beyond reimbursement. The AMA's 2023 physician survey found that one in three physicians could point to at least one adverse patient event they attributed directly to a PA delay. A denial sitting unworked in a queue isn't just a revenue problem. Given both the overturn data and the tightening state deadlines, the only defensible posture for a billing operation is to work every denial immediately rather than let it wait.

The voluntary insurer pledges: what 48 insurers committed to and how much weight to assign them

In June 2025, 48 health insurers pledged, publicly backed by CMS Administrator Mehmet Oz, to simplify and reduce prior authorization requirements. Starting in 2026, the pledge covers reducing the volume of services subject to PA, honoring PA approvals from other plans during coverage transitions, and giving clearer explanations when a request gets denied. By 2027, the insurers committed to real-time approvals on most requests and standardized electronic PA submissions.

Weigh this for what it actually is: a voluntary pledge, not a rule. Nothing in it carries the enforcement teeth of Indiana's auto-approval trigger or Montana's physician-only determination requirement. Insurers can walk it back, slow-walk it, or apply it unevenly across product lines with no legal consequence for doing so. The pledge is worth watching precisely because it echoes the same demands state legislatures have already written into binding law, which suggests the industry sees the state trend as durable enough to get ahead of. But a practice building its operational playbook should treat the state statutes, with their deadlines, penalties, and reporting requirements, as the real floor. The voluntary pledge is a signal of direction, not a guarantee of anything.