The Black Box Opens: Prior Authorization Denial Rates Go Public — and the Numbers Are Damning

For decades, the prior authorization process operated as one of American healthcare’s most consequential black boxes. Physicians submitted requests. Insurers approved or denied them. And almost no one outside those transactions knew the aggregate numbers — how often plans said no, how long they took, how often patients fought back and won. As of today, that changes. March 31, 2026 marks the first public reporting deadline under CMS’s Interoperability and Prior Authorization Final Rule (CMS-0057-F), requiring health insurers to post their prior authorization metrics — approval rates, denial rates, appeal overturn rates, processing times — on their public websites for all to see. The first reports cover calendar year 2025.

The data that has already emerged from earlier transparency filings and research analyses is striking enough on its own. The full picture, as more insurers publish 2025 numbers in the days ahead, will be more complete. But we already know enough to draw serious conclusions — about the scale of the problem, the insurers driving it, the patients most affected, and the regulatory battle that’s far from over.

The Numbers That Define the Crisis

Nearly 53 million prior authorization requests were submitted to Medicare Advantage insurers in 2024, up from 49.8 million in 2023, driven by growing enrollment in Medicare Advantage plans. Of those, insurers fully or partially denied 4.1 million requests — roughly 7.7% of the total. And more than eight in ten appealed denials were ultimately overturned.

That last figure deserves to sit with the reader for a moment. More than 80% of appealed denials reversed. If the initial denials were medically justified — if they reflected sound clinical judgment about the appropriateness of care — that reversal rate would be near zero. It is not near zero. It has, in fact, been remarkably consistent above 80% for years. The most straightforward interpretation is that a substantial share of initial prior authorization denials are not clinically defensible. They function instead as administrative friction — a mechanism that bets, correctly, that most patients and physicians won’t fight back.

The ACA marketplace tells a similar story from a different angle. Insurers on HealthCare.gov denied 19% of in-network claims in 2024 — and only 5% of those denials were for lack of medical necessity. The most common stated reasons were “Other” at 36% and administrative reasons at 25%. Fewer than 1% of denied claims are ever appealed, yet 44% of internal appeals overturn the denial. The system exploits the perception of futility. The reality is that most denials that go unchallenged would, if appealed, be reversed.

The physician survey data from the American Medical Association confirms the scale of the burden at the practice level. 93% of participating physicians reported that prior authorization leads to care delays patients would not otherwise have experienced, and 82% reported that PA processes can cause patients to abandon treatment altogether. The aggregate burden on physician practices is severe: the average physician handles approximately 39 prior authorization requests per week, consuming roughly 13 hours of staff time.

Not All Insurers Are Equal

Aggregate national statistics obscure significant variation at the plan level. Among ACA marketplace insurers reporting Plan Year 2024 data, denial rates ranged from 2% to 49% across 175 reporting plans. The highest-denying major national insurer, Oscar Health, had a denial rate of 25.3%, nearly 20 percentage points above Kaiser Permanente’s roughly 6%.

In the Medicare Advantage market, the KFF analysis of CMS data identified a counterintuitive pattern worth highlighting: marketplace-focused plans tend to have higher administrative denial rates partly because they rely more heavily on prior authorization protocols to control costs. Plans that require prior authorization for fewer services tend to deny a higher percentage of the requests they do receive — suggesting that prior authorization is being deployed selectively around services the insurer intends to deny at elevated rates, rather than as a neutral utilization management tool.

Traditional Medicare’s denial rate in 2024 was approximately 23%, based on CMS denying about 143,000 of the prior authorization requests it processed. Medicaid managed care organizations denied more than 2 million prior authorization requests in 2019 alone, for an overall denial rate of nearly 13%, according to a 2023 federal report.

The AI Problem No One Has Solved

The use of algorithmic and AI-based tools in prior authorization has become one of the most contested issues in health policy. Humana and UnitedHealth are both facing lawsuits alleging that they used AI algorithms to wrongfully deny care to Medicare Advantage members — though insurers maintain they do not use AI to make denial decisions.

A Senate report accused three major Medicare Advantage insurers of specifically targeting post-acute care denials to cut costs, and found that skilled nursing facility stays were refused nine times more often after the plans adopted AI tools. The pattern is consistent with how automated batch-denial systems work: when an algorithm reviews thousands of requests simultaneously, systematic errors can produce thousands of wrongful denials, each of which individually requires a physician or patient to appeal — a burden that falls entirely on parties who may lack the resources or stamina to fight every case.

In 2024, CMS issued guidance that MA insurers could use AI and automation in prior authorization, but that such tools must comply with agency guidelines including those around discrimination and bias. In 2025, the agency declined to implement formal rules regulating AI use in prior authorization. California, notably, implemented state regulations prohibiting insurers from using AI alone to make coverage decisions. The federal regulatory gap persists.

The Equity Crisis: Who Gets Denied Most

The transparency rule’s most significant gap — at least as it currently stands — is the absence of demographic breakdowns. Aggregate denial rates don’t tell you whether specific populations are being targeted by more aggressive denial practices. The data that does exist on this question is alarming.

CMS data showed that Medicare Advantage beneficiaries who are dually eligible for Medicaid face denial rates up to twice those of non-dual enrollees — despite, on average, having fewer prior authorization requests. These are typically lower-income individuals with higher rates of disability.

The CY 2025 final rule would have required Medicare Advantage plans to conduct and publish health equity analyses showing denial and approval rates by population — including dually eligible individuals, low-income enrollees, and those with disabilities. The Trump Administration announced in June 2025 it would not enforce these requirements. The practical effect is that the most vulnerable insurance enrollees in the country continue to face the highest denial rates, with no public accountability mechanism to track or address it.

The Regulatory Architecture: What CMS-0057-F Actually Requires

To understand today’s milestone, it helps to understand the full structure of the rule behind it. CMS-0057-F was finalized in January 2024 and is built on a 2020 interoperability rule that established foundational data exchange standards.

Starting in 2026, payers must make prior authorization decisions faster: seven calendar days for standard requests (down from 14), and 72 hours for urgent or expedited requests. When a request is denied, payers must now provide a specific reason, communicated through one of five channels: portal, fax, email, mail, or phone.

By January 1, 2027, payers must implement four HL7 FHIR-based APIs: Patient Access, Provider Access, Payer-to-Payer, and a Prior Authorization API enabling electronic submission and real-time status tracking of requests. These interoperability requirements represent the more structurally significant part of the rule — they shift the underlying technology of prior authorization from phone calls and faxes toward a standardized digital infrastructure.

The reporting requirement that took effect today requires impacted plans to post annually: the list of services requiring prior authorization; the percentage of standard and expedited requests approved and denied; the percentage approved after appeal; and average and median decision processing times.

Industry Response: Pledges Under Pressure

In June 2025, the Trump administration announced a voluntary pledge by many of the largest health insurers to “fix the broken prior authorization system.” Commitments included reducing the scope of prior authorization requirements, implementing common electronic PA data standards based on FHIR, and improving transparency about authorization decisions and appeals.

CMS Administrator Mehmet Oz called the move “a step in the right direction toward restoring trust and easing burdens on providers.” AMA President Bobby Mukkamala welcomed the recognition that the system is not working, but said physicians needed specifics demonstrating the initiative “will yield substantive actions.”

A recent KFF poll found that two-thirds of insured adults — 66% — believe delays and denials of health care services by insurance companies are a “major problem.” One-third of insured adults reported that an insurer had denied coverage for a service or medication prescribed by their doctor in the past two years. And 55% of Americans told KFF that closer regulation of insurer denial decisions should be a “top priority” for Congress.

Voluntary pledges made under political pressure, without enforcement mechanisms or defined metrics, have a weak track record in American healthcare. The same insurer coalition made similar commitments in earlier years with limited measurable follow-through. What’s different now is the reporting requirement: the numbers will be public, they will be updated annually, and they can be compared.

States Filling the Federal Void

Where the federal government has pulled back, states have moved forward. At least 18 states took action on insurer prior authorization practices in 2025. Indiana enacted a law with a particularly sharp enforcement mechanism: if an insurer misses the decision deadline, the prior authorization request is automatically approved.

Nebraska, Arkansas, and North Dakota now require insurers to publicly post prior authorization policies, clinical criteria, and documentation requirements in clear, accessible formats for patients. Multiple states in 2025 enacted measures requiring plans to report PA data to state regulators — going beyond what federal rules require.

The patchwork of state laws creates a heterogeneous environment where the PA experience depends heavily on geography. A patient in Indiana has a legal backstop if their insurer drags out a decision. A patient in a state without such protections does not. The case for a uniform federal standard remains strong — it just isn’t being made with the same urgency at the federal level as it was two years ago.

Five Things Practitioners and Policymakers Should Watch

1. Insurer-level variation in the new public reports. Now that plans must post their own data, direct comparisons become possible for the first time. Watch for outliers — plans with denial rates well above the national average or appeal overturn rates that suggest systematic over-denial.

2. The AI litigation trajectory. The lawsuits against UnitedHealth and Humana over algorithmic denial tools are proceeding. Court rulings will define whether AI-assisted denial constitutes a legally distinct liability from human review — with major implications for how insurers deploy these tools.

3. Whether voluntary insurer pledges produce measurable results. The 2025 commitments set a January 2026 implementation target. The 2025 reporting data, now being published, will provide the first real test of whether insurer denial behavior changed.

4. State-level momentum. With federal equity requirements suspended, states are the only venue for accountability around demographic disparities in denial rates. Watch whether more states follow Indiana’s auto-approval enforcement model.

5. The 2027 API deadline. The FHIR prior authorization API requirement — requiring electronic submission and real-time status tracking — represents the most structurally significant reform in the rule. Whether insurers build compliant systems on schedule, or seek delays, will determine how transformative the rule actually is.

***

The opening of the black box is genuinely significant. For the first time, patients, employers, researchers, and policymakers will be able to look at a given insurer and ask: how often do you say no? How long does it take you to decide? When you say no and someone pushes back, how often are you wrong?

Those are reasonable questions. The answers are going to be uncomfortable for a lot of payers. And that discomfort — the reputational and regulatory pressure that comes from public data — may accomplish more than any single rule provision. Sunlight is not a complete solution to a broken system. But it is a prerequisite for fixing one.

If you enjoyed this piece, subscribe to our monthly newsletter to receive even more in-depth insights.

Sources

1. DistilINFO, “Prior Authorization Denial Rates Now Go Public” — distilinfo.com (March 31, 2026)
2. KFF, “Medicare Advantage Insurers Made Nearly 53 Million Prior Authorization Determinations in 2024” — kff.org (January 28, 2026)
3. KFF, “Claims Denials and Appeals in ACA Marketplace Plans in 2024” — kff.org (March 2026)
4. National Association of Insurance Commissioners (NAIC), Prior Authorization White Paper, adopted December 10, 2025 — naic.org
5. Georgetown University Center on Health Insurance Reforms, “CMS Suspends New Medicare Advantage Prior Authorization Transparency Rules” — medicare.chir.georgetown.edu (November 2025)
6. McKnight’s Long-Term Care News, “As CMS Grapples With Prior Authorization, States Step Into the Void” — mcknights.com (December 2025)
7. Becker’s Payer Issues, “Prior Authorization in 2025: What to Know” — beckerspayer.com (July 2025)
8. Muni Health, “Which Insurance Company Denies the Most Claims? Denial Rates by Insurer 2026” — muni.health (March 2026)
9. PriorAuthTraining.org, “Navigating New Prior Authorization Challenges Amid CMS Reforms” — priorauthtraining.org (2025)
10. CMS, Interoperability and Prior Authorization Final Rule (CMS-0057-F), January 2024