💰 Prior Authorization Approval Workflow

CDS Hooks and Da Vinci CRD — Catching the Prior Authorization Requirement at the Point of Order

Roughly 40–50% of prescriptions for specialty biologics and a growing share of high-cost imaging and procedures require prior authorization before a payer will reimburse them. Historically, clinicians discovered this only after the pharmacy claim rejected — days after the patient expected treatment. HL7’s Da Vinci Project closes that gap with Coverage Requirements Discovery (CRD), a CDS Hooks-based service that queries payer coverage rules at the moment of order entry, inside the EHR, before the clinician signs off.

• 94%: Physicians reporting PA-caused care delay (AMA 2023 Prior Auth Physician Survey)
• 14.4: PA requests per physician / week (AMA survey, avg. across specialties)
• 13: Staff hours spent on PA / week (per physician practice, AMA 2023)
• <2 sec: Da Vinci CRD response target (synchronous CDS Hooks call)

CDS Hooks architecture and the order-select trigger

CDS Hooks is an HL7 standard that lets an EHR call out to an external clinical decision support (CDS) service at defined points in the clinical workflow, and receive back structured "cards" the clinician can act on:

Hook firing sequence: • Clinician selects a drug, procedure, or DME item in CPOE • EHR fires the order-select hook: POST request containing FHIR context (patient, encounter, draft order, coverage) to the CRD service registered for that payer • CRD service evaluates the order against payer coverage policy in real time (typically backed by a rules engine indexed on NDC/HCPCS/CPT + ICD-10 + place of service) • Response returns as a CDS Hooks "card": informational (no PA needed), or an actionable card offering a SMART app link that launches the DTR questionnaire

Why point-of-order matters: • Catching the PA requirement before the order is signed lets the clinician immediately choose a covered alternative, start documentation gathering same-visit, or proceed knowing the downstream steps • Historically this same information only surfaced at the pharmacy counter or the scheduling desk, adding 3–10 days of round-trip delay per missed requirement • Da Vinci CRD implementation guide (HL7 FHIR R4-based) is now supported by major payer coverage-rules vendors and required as part of several state and federal e-PA mandates

CMS’s Interoperability and Prior Authorization Final Rule (CMS-0057-F, January 2024) does not itself mandate CRD, but it requires impacted payers (Medicare Advantage, state Medicaid/CHIP fee-for-service and managed care, and QHP issuers on the FFEs) to build FHIR-based Prior Authorization APIs — creating the regulatory and technical substrate that makes point-of-order CRD checks broadly interoperable across the industry starting with compliance dates in 2026 and 2027.

DTR, Medical Policy Matching, and Evidence-Based Criteria — InterQual and MCG

Once a PA requirement is confirmed, Da Vinci DTR (Documentation Templates and Rules) launches a SMART-on-FHIR questionnaire that auto-populates as many fields as possible directly from the chart — labs, prior therapies, diagnosis codes, staging — and asks the clinician to fill in only what cannot be inferred. Behind the scenes, the payer’s medical policy engine cross-references the requested NDC/HCPCS against evidence-based utilization management criteria to determine exactly which clinical facts justify approval.

• ~90%: Payers licensing InterQual or MCG criteria (commercial + MA plans, industry est.)
• 60–75%: Fields auto-populated by DTR from chart (typical for structured EHR data)
• $13.98: Manual PA transaction cost (provider) (CAQH Index 2023, fully manual)
• $2.25: Electronic PA transaction cost (provider) (CAQH Index 2023, fully electronic)

DTR questionnaire generation and CQL-based auto-population

DTR pairs FHIR Questionnaires with Clinical Quality Language (CQL) rules so that most of the burden of "filling out the PA form" is shifted from the clinician to the data already in the chart:

• Payer publishes a FHIR Questionnaire + companion CQL library per policy (e.g. "PA criteria for anti-CGRP monoclonal antibodies, migraine") • DTR SMART app retrieves the questionnaire, evaluates each CQL expression against the patient’s FHIR resources (Observation, Condition, MedicationStatement, DiagnosticReport) • Auto-answerable items (two prior failed oral triptans on record, ICD-10 G43.709, BMI, most recent HbA1c) are pre-filled and shown to the clinician for confirmation • Remaining items — usually free-text medical necessity narrative, or data that lives outside structured fields — are flagged for manual entry • Completed QuestionnaireResponse is bundled with supporting clinical documents (chart notes, imaging reports) ready for the submission step

Coverage rules matching: • Requested code set (NDC for drugs, HCPCS/CPT for procedures and DME) is matched to the payer’s medical policy library, itself typically licensed from InterQual (Level of Care, or LOC, criteria) or MCG (formerly Milliman Care Guidelines) • Step-therapy and site-of-care rules are applied automatically: e.g. a biologic requiring two documented failures of a lower-cost formulary alternative, or infusion drugs restricted to a lower-cost outpatient/home site rather than hospital outpatient department • NCCN Clinical Practice Guidelines are frequently cited as the reference standard for oncology PA criteria; deviation from NCCN-preferred regimens raises the documentation bar substantially

The economics of manual versus electronic prior authorization

The CAQH Index — an annual industry benchmark of administrative transaction costs across U.S. healthcare — consistently identifies prior authorization as the single most expensive and least automated transaction type:

• Fully manual PA (phone, fax, payer portal re-entry): provider-side cost ≈ $13.98 per transaction, driven almost entirely by staff time • Fully electronic PA (X12 278 or FHIR-native, minimal manual intervention): provider-side cost ≈ $2.25 per transaction • Industry-wide, CAQH estimates several hundred million dollars in annual administrative savings are achievable simply by moving remaining manual PA volume onto electronic transactions • Despite HIPAA having designated X12 278 as a standard transaction since the late 1990s, CAQH Index data shows prior authorization has for years remained among the least electronically adopted transactions in the entire administrative stack — well behind eligibility verification and claim status

This cost gap is the central economic argument behind the Da Vinci Project and the CMS Interoperability and PA Final Rule: automating discovery, documentation, and submission is not merely a convenience, it removes a measurable and disproportionate share of U.S. healthcare administrative overhead.

X12 278 and Da Vinci PAS — Moving the Request From Provider System to Payer UM Platform

With documentation assembled, the request is packaged into a standardized transaction and sent to the payer. The legacy path is the ASC X12N 278 Health Care Services Review transaction, HIPAA-designated since the 1990s but historically wrapped around fax and portal workarounds. The modern path is the Da Vinci PAS (Prior Authorization Support) FHIR implementation guide, which represents the same 278 semantics as a FHIR Bundle and can return a real-time or asynchronous determination.

• X12N 278: HIPAA-standard PA transaction (005010X217 version)
• Da Vinci PAS: FHIR PA implementation guide (built on FHIR R4 + X12 278 mapping)
• SCRIPT: NCPDP standard for pharmacy ePA (retail/specialty pharmacy benefit PA)
• <20 sec: Real-time PAS response (where supported) (vs. days for portal/fax workflows)

X12 278 transaction structure and the clearinghouse role

The X12N 278 transaction set carries a Health Care Services Review Request and its corresponding Response in a rigidly structured EDI format:

• 2000A/2000B loops: carry the requesting and servicing provider identifiers (NPI), subscriber and patient demographics • 2000E/2000F loops: carry the service-level detail — procedure/HCPCS/NDC codes, diagnosis pointers, quantity, and service dates • UM03/HCR segments: carry the certification/authorization number and the decision code (certified, pended, denied) once the payer responds • Most provider systems do not connect directly to payer UM platforms; a clearinghouse (Availity, Change Healthcare/Optum, Waystar) translates and routes the 278 between the EHR/practice management system and the payer, similarly to how eligibility (270/271) and claims (837) transactions are routed

Pharmacy-benefit drugs (as opposed to medical-benefit infused/injected biologics) instead flow through NCPDP SCRIPT ePA transactions, typically via Surescripts, integrated directly into e-prescribing workflows so the pharmacist sees PA status at the point of dispensing rather than the point of prescribing.

Da Vinci PAS — FHIR-native submission and the shift to synchronous decisions

Da Vinci PAS reframes the same 278 content as FHIR resources — Claim, ClaimResponse, Bundle — submitted over a standard FHIR REST API, enabling three response modes:

1. Auto-decision (synchronous): rules-engine-only cases (e.g. routine imaging meeting all documented criteria) return an approved ClaimResponse in the same HTTP call, often in under 20 seconds 2. Pended for review (asynchronous): the Bundle passes initial validation but requires human clinical review; the payer returns a tracking number and the provider polls or receives a callback 3. Needs more information: the payer returns a FHIR Questionnaire identifying exactly which DTR fields are missing, looping back to the documentation stage without a full resubmission

Because PAS reuses the same FHIR resources and CDS Hooks/SMART infrastructure as CRD and DTR, a fully Da Vinci-conformant payer-provider pair can, in principle, take a case from order-select to auto-approval in a single continuous digital session — collapsing what used to be a multi-day fax-and-portal cycle into minutes for the subset of requests that meet criteria outright.

Nurse-Level Screening, Medical Director Escalation, and the Peer-to-Peer Call

Cases that clear the automated rules engine but do not meet auto-approval thresholds enter human clinical review. A UM nurse applies InterQual or MCG criteria against the submitted documentation; cases that fail nurse-level criteria — but are not obviously non-covered — escalate to a board-certified medical director, often in the same or a related specialty, who may request a peer-to-peer conversation with the ordering physician before finalizing an adverse determination.

• ~6–7%: Initial PA denial rate (all services) (AHIP-reported commercial average)
• 15–30%: Specialty drug / oncology denial rate (higher-cost, higher-scrutiny categories)
• ~80%: Medicare Advantage denials overturned on appeal (HHS OIG / KFF analyses, 2022–2023)
• 1–3 business days: Peer-to-peer scheduling window (standard) (NCQA/URAC UM accreditation norms)

Two-tier review: algorithmic screening then licensed clinical judgment

NCQA and URAC utilization management accreditation standards require that any decision to deny or reduce a service on medical necessity grounds be made or directly supervised by a licensed physician (or other appropriately licensed clinician) — nurses may approve, but they generally cannot issue a denial:

Tier 1 — UM nurse screening: • Applies InterQual Level of Care criteria or MCG care guidelines line by line against submitted documentation • Clear-pass cases (all criteria elements documented and met) are approved at this tier without physician involvement • Cases with a documentation gap are pended, generating a request back to the provider for the missing element rather than an outright denial • Cases that fail criteria outright, or involve off-label/investigational use, escalate to Tier 2

Tier 2 — Medical director review: • A physician, ideally board-certified in a specialty relevant to the request (a requirement under many state PA-reform laws and NCQA standards), reviews the full clinical record • The medical director may approve despite a criteria gap if clinical judgment supports medical necessity, request a peer-to-peer discussion, or issue an adverse determination • Peer-to-peer calls let the ordering physician present clinical context criteria checklists cannot capture — prior intolerances, comorbidities, disease trajectory — and are associated with meaningfully higher approval rates than paper review alone

Why review timing is the central operational bottleneck

Reviewer queue depth, not algorithmic complexity, is the dominant driver of turnaround time variance in this stage:

• A UM nurse typically carries 15–30 open cases at varying stages simultaneously; complex specialty-drug and oncology cases can take 30–60 minutes of dedicated review time each • Medical director capacity is the tighter constraint: a health plan may have only a handful of specialty-matched physicians available for peer-to-peer calls on a given service line, creating scheduling backlogs even when the clinical decision itself is straightforward • Expedited requests (patient health seriously jeopardized by the standard timeline) legally jump the queue: CMS and most state prompt-decision statutes require expedited determinations within 72 hours, versus up to 7 (or historically 14) calendar days for standard requests • Because the clock for both timelines starts at receipt of a complete request, incomplete documentation effectively extends real-world turnaround well beyond the nominal SLA — reinforcing why the DTR/CRD front-end automation of Stages 1–2 has an outsized effect on overall cycle time

Approval, Adverse Determination, and the Regulatory Guardrails Around Turnaround Time

The final step issues a formal determination — approval, partial approval, or adverse determination — accompanied by the specific denial reason and legally mandated appeal rights. This stage is where prior authorization intersects most directly with federal regulation: ERISA claims procedure rules, the CMS Interoperability and Prior Authorization Final Rule, and state "gold-carding" statutes that exempt high-performing physicians from PA altogether.

• ≤7 days: CMS mandated standard decision (from 2026) (CMS-0057-F compliance date Jan 2026)
• ≤72 hours: CMS mandated expedited decision (from 2026) (urgent/expedited requests)
• ≤30 days: ERISA internal appeal response (pre-service) (plan must decide, 15 days if urgent)
• ~10+: States with gold-carding statutes (2024) (TX, WV, MI, LA and others)

The CMS Interoperability and Prior Authorization Final Rule

CMS-0057-F, finalized January 2024, is the most consequential federal PA regulation to date. It applies to Medicare Advantage organizations, state Medicaid and CHIP fee-for-service and managed care plans, and Qualified Health Plan issuers on the Federally Facilitated Exchanges:

• Turnaround mandates: standard PA decisions within 7 calendar days (down from the prior 14-day Medicare Advantage standard); expedited decisions within 72 hours, effective for compliance beginning primarily in 2026 • Specific denial reason: impacted payers must provide a specific reason for any denial, whether communicated through a portal or other means, to reduce the "black box" denial letters that historically named only a policy number • Public reporting: payers must publicly report PA metrics annually — approval/denial rates, average and median turnaround times, and appeal overturn rates — starting with 2026 reporting • API build-out: Patient Access API must include PA status; a new Provider Access API and Payer-to-Payer API must expose PA and claims data for treating providers and when patients switch plans, with compliance dates extending into 2027

The rule does not set substantive medical necessity standards (payers still define their own coverage criteria) — its leverage is entirely procedural: transparency and speed.

An HHS Office of Inspector General review of Medicare Advantage denials (2022) found that when beneficiaries or providers appealed a denied prior authorization or payment request, plans overturned their own denial roughly 75–80% of the time on appeal — evidence that a substantial share of initial adverse determinations were avoidable, and a key data point cited in support of the CMS-0057-F transparency and turnaround requirements.

ERISA appeal procedure and external review

For employer-sponsored plans governed by ERISA, denied prior authorizations trigger a formal, legally structured appeal pathway distinct from Medicare/Medicaid administrative appeals:

• Internal appeal: the claimant (patient or authorized provider) has 180 days to file; the plan must decide within 15 days for a pre-service urgent claim, 30 days for a pre-service non-urgent claim, and generally may not simply rubber-stamp the original reviewer’s decision — the appeal must involve a different, appropriately qualified reviewer than the one who issued the original denial • External review: under ACA-era rules extended to most ERISA plans, an adverse determination that survives internal appeal can be escalated to an Independent Review Organization (IRO), a third party with no financial relationship to the plan, whose decision is typically binding on the payer • State-level analogues: fully-insured (non-ERISA, state-regulated) plans follow state external review statutes, generally modeled on the NAIC Uniform External Review Model Act, with similar independent-reviewer requirements

This is the structural reason PA denial rates and PA overturn-on-appeal rates are tracked as two separate, and often strikingly different, metrics: a high initial denial rate paired with a high overturn rate signals that the friction is concentrated in the first-pass review, not in the underlying medical necessity determination.

Gold-carding — exempting high-performing physicians from prior authorization

A newer regulatory trend addresses PA burden from the opposite direction: rather than speeding up every review, "gold-carding" laws exempt physicians with a strong track record from PA requirements for the specific services they consistently get approved.

• Texas HB 3459 (effective 2021) was the first statewide gold-carding law: physicians whose PA requests for a given service were approved at least 90% of the time over a rolling evaluation period become exempt from PA for that service for a subsequent period, subject to periodic re-evaluation • Similar statutes have since passed in West Virginia, Michigan, Louisiana, and several other states, with variation in the qualifying approval threshold (commonly 80–90%), the lookback window, and which service lines qualify • Gold-carding does not eliminate documentation requirements entirely — claims remain subject to post-payment audit — but it removes the pre-service delay for physicians whose ordering patterns already reliably match payer coverage criteria • Payer trade groups have generally supported narrowly scoped gold-carding (it reduces low-value review volume) while raising concerns about audit and re-evaluation cost when thresholds are set too low or lookback periods too short