Medicaid prior authorization
Medicaid prior authorization is a utilization-management control under which a state Medicaid agency, or a managed care organization (MCO) acting on its behalf, must approve a service, medication, or item before it is delivered in order for it to be eligible for payment. It is a coverage and payment gatekeeping step tied to medical necessity, not a clinical decision to treat. Because Medicaid is jointly funded by federal and state governments and administered by each state, the specific services that require authorization and the submission channels differ by state, by program, and by whether the beneficiary is enrolled in fee-for-service (FFS) or managed care, while decision timeframes run to outer limits set by federal regulation that a state may shorten. Providers confirm current requirements through the applicable state Medicaid agency or plan and treat authorization as a distinct step from eligibility verification and claim submission.
Updated 7 min read
Reviewed by Anwaar Tayyab
Director of Billing Operations ·
On this page
Key takeaways
- Medicaid prior authorization requires approval before a designated service, drug, or item is furnished, and the requirement exists to confirm medical necessity and coverage rather than to authorize care itself.
- Which services require authorization and how requests are submitted vary by state, by program, and by whether the beneficiary is in fee-for-service or managed care; federal regulation caps how long standard and expedited decisions may take, and a state may set shorter timeframes within those caps.
- In managed Medicaid, the enrollee's MCO — not the state agency — typically sets and administers authorization rules, so providers identify the correct payer before submitting.
- An authorization is not a guarantee of payment; eligibility, timely filing, coordination of benefits, and matching billed services to authorized units still apply.
- Federal EPSDT protections for beneficiaries under 21 can affect how authorization and medical-necessity review are applied to children's services.
What Medicaid prior authorization means
Prior authorization is a form of utilization management in which the payer reviews a proposed service against its coverage and medical necessity criteria before the service is rendered. Under Medicaid, this control is authorized within the federal-state framework but implemented at the state level, which is why practices treat it as a state-and-plan-specific requirement rather than a uniform national rule. The general concept mirrors prior authorization across other payers, but the covered service lists, forms, and portals are set by each Medicaid program.
An approved authorization confirms that the payer agrees a service meets its criteria at the time of review. It does not by itself guarantee payment, because a claim must still clear eligibility verification, timely filing, coordination of benefits, and coding requirements before it is paid.
Authorization is not eligibility
Who administers authorization: FFS versus managed care
The single most important determination before submitting a request is which entity owns the authorization rules. In fee-for-service Medicaid, the state agency or its contracted utilization-management vendor reviews requests. In managed Medicaid, the beneficiary's managed care organization sets its own covered-service lists, criteria, and forms, and applies the decision timeframes its state contract establishes within the outer limits federal regulation sets. The distinction between fee-for-service and managed Medicaid therefore drives where and how a request is filed.
| Dimension | Fee-for-service Medicaid | Managed Medicaid (MCO) |
|---|---|---|
| Who sets the rules | State Medicaid agency or its UM contractor | The enrollee's contracted health plan |
| Where requests are filed | State program portal or designated vendor | Each plan's provider portal or intake channel |
| Service lists and criteria | Published by the state program | Set by the plan within its state contract |
| Where to confirm current rules | State Medicaid agency | The specific MCO's provider resources |
Both models operate within federal Medicaid requirements, but day-to-day authorization details vary by state and plan and change over time.
Confirm the right plan first
How authorization requests are typically handled
While the specifics differ by program, the general flow of a Medicaid authorization request follows a recognizable sequence. Documentation expectations are set by the applicable state or plan, while decision timeframes and expedited (urgent) pathways operate within outer limits set by federal regulation.
Identify the requirement
Determine whether the specific service, drug, or item requires authorization under the beneficiary's current program or plan, since lists differ and are periodically updated.Confirm the responsible payer
Establish whether FFS or a named MCO administers the benefit on the date of service, and locate that payer's intake channel.Assemble supporting documentation
Gather the clinical information the payer uses to assess medical necessity. General guidance appears in gathering documentation for authorization.Submit through the required channel
File via the portal, form, or electronic pathway the payer designates. Many programs increasingly support electronic prior authorization.Track the decision and units
Record the authorization number, approved units, and validity dates, then reconcile them against billed services. See matching authorized units to billed services.
When a request is denied, programs generally provide review options that may include a peer-to-peer discussion and formal appeal rights. The available steps, deadlines, and beneficiary protections are defined by the state and plan.
EPSDT and other Medicaid-specific considerations
Certain Medicaid features shape how authorization and medical-necessity review apply. Under EPSDT — Early and Periodic Screening, Diagnostic, and Treatment — federal law establishes broad coverage obligations for beneficiaries under 21, which can affect how services for children are reviewed and approved. Providers consult program guidance on EPSDT billing for how these protections interact with authorization.
Because Medicaid is a payer of last resort, other available coverage must meet its legal obligation to pay before Medicaid pays, which is what third-party liability rules govern. For dual-eligible beneficiaries, the interaction between Medicare and Medicaid affects which payer's authorization process applies to a given service.
Variation is the rule
Why authorization matters for the revenue cycle
Authorization failures are a largely preventable source of a denial. A missing, expired, or mismatched authorization can lead to non-payment even when the service was medically appropriate. Building authorization checks into front-end workflows reduces avoidable write-offs and rework.
- Missing authorization when one was required for the service or setting.
- Authorization obtained from the wrong payer after a change between FFS and an MCO.
- Billed units or dates that exceed or fall outside the approved range.
- An authorization that lapsed before the service was rendered.
Related patterns appear in common Medicaid billing denials and in broader guidance on authorization-related denials.
Frequently asked questions
Does every Medicaid service require prior authorization?
No. Only designated services, drugs, items, or settings require authorization, and those lists vary by state, by program, and by plan. Many routine services do not require it. Providers confirm the current requirement for a specific service through the applicable state Medicaid agency or the beneficiary's managed care plan.
Who reviews the request — the state or the health plan?
It depends on the delivery model. In fee-for-service Medicaid, the state agency or its utilization-management contractor reviews requests. In managed Medicaid, the beneficiary's managed care organization administers authorization under its state contract. Identifying the responsible payer on the date of service is the first step before filing.
Does an approved authorization guarantee payment?
No. An authorization confirms the payer's agreement that a service meets its criteria at review, but the claim must still satisfy eligibility, timely filing, coordination of benefits, coding, and unit-matching requirements to be paid. Authorization and payment are separate determinations.
How long does a Medicaid authorization decision take?
It depends on the program and delivery model. Federal regulations set outer limits on how quickly both managed care plans and state Medicaid agencies must decide standard and expedited prior authorization requests, and they also define when a review timeframe may be extended and when a request has to be handled on the expedited track. A state may establish shorter timeframes within those federal limits, and which services require authorization, how requests are filed, and what internal review steps apply still differ by state and plan. There is no single figure that applies to every service or program, so providers verify current timeframes and urgent-request options with the specific state Medicaid program or managed care plan.
How does EPSDT affect authorization for children?
EPSDT establishes broad federal coverage obligations for Medicaid beneficiaries under 21, which can affect how medical-necessity review and authorization are applied to children's services. The precise interaction is defined by each state program and is confirmed through its EPSDT guidance.
Related glossary terms
Key terms that appear throughout Medicaid authorization workflows.
Related reading
Continue with related topics across the Medicaid and prior authorization clusters.
Fee-for-service vs. managed Medicaid
How the delivery model determines which payer administers authorization rules.
Medicaid managed care organizations
How MCOs set and administer benefits, including utilization management.
Prior authorization under Medicaid
A closer look at authorization concepts within the Medicaid context.
Common Medicaid billing denials
Frequent denial reasons, including authorization-related failures.
Verifying Medicaid coverage
Confirming eligibility and coverage before authorization and billing.
Authoritative sources
- 42 CFR 438.210 — Coverage and authorization of services (opens in a new tab)
eCFR. Governs Medicaid managed care. Paragraph (a)(4) permits an MCO, PIHP, or PAHP to place appropriate limits on a service on the basis of criteria applied under the state plan, such as medical necessity, or for the purpose of utilization control. Paragraph (b) requires each state contract to make the plan and its subcontractors have in place, and follow, written policies and procedures for processing requests for initial and continuing authorizations. Paragraph (d) sets the outer timeframes for standard and expedited authorization decisions, the conditions for extending them, and the circumstances that require expedited handling.
- 42 CFR 440.230 — Sufficiency of amount, duration, and scope (opens in a new tab)
eCFR. Governs fee-for-service Medicaid. Paragraph (d) lets the agency place appropriate limits on a service based on such criteria as medical necessity or on utilization control procedures — the authority behind state prior authorization requirements. Paragraph (e) sets the timeframes within which the state Medicaid agency must make standard and expedited prior authorization decisions for items and services, permits states to establish shorter ones, and requires notice of the decision plus fair hearing rights.
- Managed Care (opens in a new tab)
CMS. Describes Medicaid managed care as the delivery of Medicaid health benefits through contracted arrangements between state Medicaid agencies and managed care organizations that accept a capitation payment, and links each state's Medicaid and CHIP managed care profile.
- 42 U.S.C. 1396d(r) — Early and periodic screening, diagnostic, and treatment services (opens in a new tab)
U.S. Code via govinfo. At subsection (a)(4)(B), requires early and periodic screening, diagnostic, and treatment services for individuals who are eligible under the plan and are under the age of 21, and at paragraph (r)(5) defines those services to include such other necessary health care, diagnostic services, treatment, and other measures described in subsection (a) to correct or ameliorate defects and physical and mental illnesses and conditions discovered by the screening services, whether or not such services are covered under the state plan.
- Coordination of Benefits & Third Party Liability (opens in a new tab)
CMS. States that all other available third party resources must meet their legal obligation to pay claims before the Medicaid program pays, and describes the coordination-of-benefits activities states use when an enrollee has other coverage.
- Advancing Interoperability and Improving Prior Authorization Processes (final rule, 89 FR 8758) (opens in a new tab)
Federal Register (CMS). The rule that added the prior authorization decision timeframes now codified at 42 CFR 440.230(e) and 438.210(d). It also requires impacted payers — including state Medicaid fee-for-service programs and Medicaid managed care plans — to implement and maintain a Prior Authorization API that providers can use to determine whether a payer requires prior authorization for an item or service and to query the payer's documentation requirements.