Efforts to rein in the high cost of health care in recent years often have targeted the use of prior authorization by insurers. Patients and providers argue that it can result in delays or denials in receiving needed care, while insurers counter that it helps reduce costs by limiting the use of low-value or unnecessary care.
The Centers for Medicare & Medicaid Services published a rule in 2024 that sought to streamline and automate the authorization process for Medicare, Medicaid and nearly all of the insurance programs it oversees. Each year, payers in these programs must post approval and denial rates, response times and other specified metrics on their websites.
KFF analyzed the largest insurers’ metrics for the 2025 calendar year and found denial rates of 18% in the ACA Marketplace, 14% in Medicaid managed care and 12% in Medicare Advantage. Although appeals are not common, they often are successful. Two-thirds of Medicare Advantage denials were overturned, along with 47% in Medicaid managed care and 32% in the ACA Marketplace.
Response times were similar for all three market segments at about one day for standard prior authorization requests. Expedited request response times varied from about a half-day for Medicare Advantage to a full day for Medicaid managed care (ACA Marketplace. insurers are not required to report response time ranges).
One snag in the CMS reporting system is inconsistent posting practices, such as difficulty in locating and interpreting metrics on insurer websites. Gaps in how and what metrics must be reported limit the usability of this information directly by the public. “Although a target audience of prior authorization reporting is consumers, those who do not have a deep understanding of health insurance terminology and concepts may struggle to interpret these reports,” the report said.
CMS is taking several steps to address these concerns. Last month, it updated its metrics reporting overview and template for insurers. It clarifies that making this information publicly accessible means insurers can’t post it in website locations that viewers can’t reach through ordinary navigation. It also stipulates that response times of less than one day must be listed in hours, not zero days. Although it is not mandated, CMS recommends that insurers also identify and explain any data quality issues or concerns.
The proposed 2026 CMS rule expands the types of data that must be reported under the existing rule. Insurers would be required to post new metrics for non-drug items and services, along with the numeric counts for both the new and existing metrics.
“Together, these changes would provide more insight into prior authorization requests, denials and appeals; make the data easier to interpret; and improve the ability to make comparisons across insurers,” the report concluded. “More-detailed prior authorization metrics could help assess whether initiatives to improve the prior authorization process more broadly, such as the voluntary commitments made by several insurers in June 2025, are leading to meaningful change.”