How to Track Prior Authorization Changes Before Denials

Prior authorization changes reach providers through six kinds of payer pages: code lists, medical policies, reimbursement policies, provider newsletters, provider manuals and vendor or portal notices. Each commercial, Medicare Advantage and Medicaid managed care plan publishes them on its own site and schedule. A code that needed no approval last month can need one today, and for a team that misses the update, the first sign is a denial.

In our monitoring sample of about 2,170 payer policy pages, more than half changed within 93 days. This guide is for revenue-cycle, patient-access and utilization review teams who track payer policy changes across many plans. It shows where each type of change gets published, what the federal CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) makes Medicare Advantage, Medicaid, CHIP and federal Exchange plans post, and what state laws require of state-regulated plans. It also covers how often payer pages changed in 93 days of monitoring data, and a routine that gets each change to its owner before the effective date. For the government side (CMS rules, transmittals and the Federal Register), see our companion guide to Medicare and Medicaid policy changes.

This article describes monitoring workflows. It is not legal, billing or coding advice. Always confirm prior authorization requirements against the payer's current list, portal or provider manual, and your contract.

Key takeaways:

• Payers post prior authorization changes on six kinds of pages, and a payer's own summary can lag its lists. UnitedHealthcare's 2026 summary had no entry after April 1, 2026 (checked September 28, 2026), while its commercial list was reissued July 1 and September 1 with code changes.
• CMS-0057-F covers only Medicare Advantage, Medicaid, CHIP and federal Exchange plans. They must post prior authorization metrics on their websites by March 31 each year. A proposed rule, CMS-0062-P, would extend its prior authorization rules to drugs from October 1, 2027.
• Illinois and Michigan require at least 60 days' notice of most new requirements, and Minnesota 45 days, for state-regulated plans.
• A daily check on the page that shows each list's effective date flags a new list within a day of posting. The median monitor in our sample checked about once a week.

Where to start in this guide:

• Building a payer watch list from scratch: go to the 6-step system to track payer policy changes, then the priority table of payer pages.
• Checking which payers the federal rule covers: go to CMS-0057-F scope and public reports.
• Covering Medicare Advantage plans: go to what MA plans must publish.
• Checking your state's notice rules or gold card law: go to state prior authorization laws.
• Sizing the workload: go to the change data from monitored payer pages.

Each payer publishes its changes on its own pages and schedule

Where to track prior authorization changes on payer sites

Payers spread prior authorization changes across six kinds of pages. A change to one often shows up on another page first, so a watch list that covers only the prior authorization list misses part of the story.

Code lists, policies, newsletters, manuals and portal notices

Prior authorization and precertification code lists

The code list is the document patient-access teams check before scheduling. Payers publish it by product line (commercial, Medicare Advantage, Medicaid, Exchange), often as a PDF per plan type and effective date. UnitedHealthcare's requirements page links each plan type's current list and shows its effective date on the page itself. On September 28, 2026, most read "Effective Sept. 1, 2026." Earlier dated versions stay on the same page under "Previous requirements by plan type."

The commercial list says it "changes periodically" and that updates "are announced routinely in the UnitedHealthcare Network News." The requirements page also tells providers to "Check by member first to get the most accurate response" in the portal, so treat list changes as updates to your scheduling rules, not as a substitute for the member-level check.

UnitedHealthcare also publishes a yearly summary of changes that marks each code "Add" or "Remove" by announcement date. Treat it as a guide rather than the full record. On September 28, 2026, its newest entry carried an April 1, 2026 date.

UnitedHealthcare had reissued the commercial list twice since then. Compared with the April version, the July 1 version dropped codes 29805 and 29830 from its arthroscopy section and 29800 from its outpatient-hospital site-of-service section. The September 1 version added nine drug codes (J9054, J9072, J9074, J9076, J9172, J9184, J9292, J9304 and J9324) under a new "Medical Benefit Therapeutic Equivalent Medications" entry in its chemotherapy section. We found neither change for commercial plans in the summary.

To be fair to UnitedHealthcare, the list itself says updates are announced in Network News, so the company has a second notice channel. The requirements page still links the summary under "Summary of changes to advance notification and prior authorization requirements," and that summary lagged. Comparing the list itself is the reliable check.

Medical policy and reimbursement policy updates

Medical policies (Aetna calls them clinical policy bulletins) set the criteria a service must meet to be covered. Reimbursement or payment policies set how it gets paid: bundling, modifiers, frequency limits and claim edits. Either can create denials without touching the prior authorization list.

Payers often post these as an index page plus a monthly update notice, and some put each month's notice at a new address. UnitedHealthcare, for example, posts each month's medical and reimbursement policy update bulletins on a new news page, such as its September 2026 medical policy updates, linked from that month's Network News overview. Capital Blue Cross announced its April 2026 changes in administrative bulletin 2026-04-004, headed "Notification of new and revised medical policies and preauthorization requirements." Each bulletin appears on its public news and announcements page, while the full details sit on a draft medical policies page behind the provider login.

Provider news bulletins and newsletters

Payers often announce changes here first, and the newsletter can count as your official notice. UnitedHealthcare's Network News page says that "Consistent with your Agreement and applicable law," the company "may provide electronic notice of policy, protocol and payment policy changes" through Network News. It also says UnitedHealthcare sends "30-, 60- and 90-day notices of upcoming changes." Each month's items sit on a new monthly overview page, and the Network News home page links to the current one.

Aetna's OfficeLink Updates newsletter puts it plainly in its policy section: "We're required to notify you of any change that could affect you either financially or administratively." The September 2026 issue alone announced new claim edits starting December 1, 2026. It also covered a Georgia prior authorization exemption program and a changed effective date for a Nevada prior authorization program. Aetna posts a full newsletter each quarter and monthly notices in between, all listed by month on its newsletter archive page.

Provider manuals

Commercial, Medicare Advantage and Medicaid managed care plans each keep a provider manual that describes referral, authorization, appeal and timely-filing rules. Manuals change less often than bulletins, but a manual revision can move a deadline or a submission address for every claim you send that plan. For Medicaid managed care plans, also watch the state Medicaid agency's own bulletins and manuals. Our directory of state Medicaid provider bulletins lists where each state posts them.

Delegated vendors and portal notices

Many plans hand prior authorization for imaging, cardiology, post-acute care or specialty drugs to a utilization management vendor. When the vendor changes, the submission route changes. Aetna's June 2026 quarterly newsletter said WellSky would manage prior authorization requests for skilled nursing and inpatient rehabilitation episodes for Nevada Medicare Advantage and D-SNP members from August 1, 2026. The September issue moved it: "The effective date has been changed to September 1, 2026." A team working from the June notice would have routed August requests to the wrong place. Some notices live only inside a payer portal behind a login, which needs a different monitoring setup (covered below).

Source	What changes	Typical format	What to watch
Prior authorization code list	Codes added or removed, effective dates	PDF per plan type, plus a summary of changes	The page that shows each list's effective date
Medical policy index	Coverage criteria, new and retired policies	HTML index, PDF policies	The index, plus the page that links each month's update notice
Reimbursement policy index	Bundling, modifier and frequency rules, claim edits	HTML index, PDF policies	The index, plus the page that links each new update bulletin
Provider news or newsletter	Announcements of all of the above	Monthly news page or PDF	The page that lists each new issue
Provider manual	Authorization, appeal and filing procedures	Long PDF or HTML chapters	The chapter on authorizations
Delegated vendor page	Who handles which requests, from when	HTML program page	The program page for each vendor

Why removed requirements need an alert too

Much of the 2026 news about prior authorization changes is about requirements going away. In June 2025, HHS and CMS announced a pledge by health plans to cut the volume of medical services subject to prior authorization by January 1, 2026. The pledge also covers real-time answers, and AHIP's announcement of the pledge sets the goal: "In 2027, at least 80 percent of electronic prior authorization approvals (with all needed clinical documentation) will be answered in real-time." In April 2026, leading health plans announced that they had eliminated 11% of prior authorizations across a range of medical services. CMS repeated the figure in its blog on prior authorization progress, "representing 6.5 million fewer prior authorizations for patients."

Some payers are going further. UnitedHealthcare announced in May 2026 that it would eliminate an additional 30% of remaining prior authorizations by the end of 2026. The cuts include select outpatient surgeries, some diagnostic tests and certain outpatient therapies, and the company promised to post "a full list" on UHCprovider.com in advance. Its provider notice, posted September 1, 2026, set the start date at October 1, 2026, across its commercial, Medicare Advantage, Community Plan, Individual Exchange and Oxford plans.

A removal still needs to reach your team. If scheduling keeps requesting approvals the payer no longer requires, staff hours go to requests nobody needs. Review also continues after a removal. UnitedHealthcare's summary of changes says that "post-service determinations may still be applicable based on criteria published in medical policies," so the medical policy page still decides whether the claim pays.

Additions keep coming too. UnitedHealthcare's April 1, 2026 entry added prior authorization for several injectable drugs and for some cardiology and radiology codes in certain Community Plan markets. The same entry removed it for some chemotherapy and orthotics codes. Every one of those changes shows an April 1, 2026 effective date, the same day as the announcement. For changes like these, the only lever you control is how fast the update reaches scheduling.

Payers remove prior authorization requirements as well as add them

Which payers CMS-0057-F covers and the reports they must publish

The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) set 2026 denial-reason rules and public metrics for Medicare Advantage, Medicaid, CHIP and federal Exchange plans. It also set decision deadlines for all of them except the Exchange plans, and it requires prior authorization APIs from 2027. It does not cover commercial payers in general. CMS released it on January 17, 2024, and the Federal Register published it on February 8, 2024 (89 FR 8758). It took effect April 8, 2024.

Which payers it applies to

The rule applies only to what CMS calls "impacted payers": Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and individual-market Qualified Health Plan (QHP) issuers on the Federally-facilitated Exchanges. Issuers that offer only stand-alone dental plans are excluded. Small-group plans on the federal Small Business Health Options Program (SHOP) Exchanges would join the list under CMS-0062-P. Employer group plans, off-Exchange individual plans and plans sold only on state-run Exchanges are not on that list, so for most commercial business, state law and your contract set the rules. The prior authorization provisions also exclude drugs; they cover medical items and services.

CMS-0057-F provisions and compliance dates

Provision	What it requires	Compliance date	Who
Decision timeframes	Decisions within 72 hours for expedited requests and 7 calendar days for standard requests, for non-drug items and services (the standard limit had been 14 days in Medicare Advantage and Medicaid managed care)	January 1, 2026	Impacted payers except QHP issuers on the Exchanges. Medicaid managed care: rating periods starting on or after this date
Denial reasons	A specific reason for every denied request, however it was submitted	January 1, 2026	All impacted payers
Public prior authorization metrics	A yearly report on the payer's public website covering the previous calendar year, including the list of items and services that need approval	March 31, 2026 for 2025 data, then every March 31	All impacted payers
Patient Access API usage metrics	Yearly usage figures reported to CMS	From 2026	All impacted payers
Patient Access API	Adds prior authorization information (excluding drugs) to the data patients can pull into apps	January 1, 2027	All impacted payers (dates by payer type below)
Provider Access API	Shares patient data with in-network providers who have a treatment relationship with the patient	January 1, 2027	All impacted payers
Payer-to-Payer API	Sends claims, encounter, clinical and prior authorization data (excluding drugs) to a patient's new payer, for services in the past five years	January 1, 2027	All impacted payers
Prior Authorization API	Lists covered items and services, identifies documentation requirements, and carries requests and decisions between provider and payer systems	January 1, 2027	All impacted payers
Electronic Prior Authorization measure	A yes/no attestation (or an exclusion)	CY 2027 performance and EHR reporting period	MIPS eligible clinicians, and hospitals and critical access hospitals in the Medicare Promoting Interoperability Program

For the API requirements, January 1, 2027 applies to MA organizations and Medicaid and CHIP fee-for-service programs. Medicaid and CHIP managed care plans must comply for rating periods starting on or after that date, and Exchange QHP issuers for plan years starting on or after it.

The rule lists three HL7 FHIR (Fast Healthcare Interoperability Resources) Da Vinci implementation guides as recommended for the Prior Authorization API: Coverage Requirements Discovery (CRD), Documentation Templates and Rules (DTR) and Prior Authorization Support (PAS). In a February 28, 2024 enforcement discretion statement, HHS said it won't enforce the HIPAA X12 278 transaction standard against covered entities that build an all-FHIR Prior Authorization API.

Sources: the CMS fact sheet. Decision timeframes: 42 CFR 422.568(b)(1) and 422.572(a)(1) for Medicare Advantage, 42 CFR 440.230(e) for Medicaid fee-for-service and 42 CFR 438.210(d) for Medicaid managed care. Denial reasons, APIs and public reporting: 42 CFR 422.122 and 45 CFR 156.223. We checked these dates against the Federal Register and eCFR on September 29, 2026.

Three dates that changed what payers must do and publish

The public reporting requirement

Each impacted payer must post its prior authorization metrics on its own website every year. Medicare Advantage plans report at the contract level, Medicaid and CHIP fee-for-service programs at the state level, managed care plans at the plan level and Exchange issuers at the issuer level. Per 42 CFR 422.122(c), aggregated for all items and services, the report covers:

• A list of all items and services that require prior authorization
• The percentage of standard requests approved, denied, and approved after appeal
• The percentage of requests approved after the review timeframe was extended
• The percentage of expedited requests approved and denied
• The average and median time from submission to decision, for standard and for expedited requests

The first reports, covering 2025, were due March 31, 2026. In an August 2026 analysis of the largest insurers' reports, KFF found that Medicare Advantage insurers denied 12% of standard requests, Medicaid managed care insurers 14% and ACA Marketplace insurers 18%. In Medicare Advantage, appeals reversed 67% of the denials they challenged. KFF's first look in April found "no consistent way to locate where on an insurer's website this information is posted."

CMS's metrics reporting template shows a sample format, and it warns that posting the metrics "only through password-protected provider or member portals" doesn't meet the rule's "publicly accessible" requirement. Aetna's Medicare Advantage metrics report, for example, carries the template's title, "Prior Authorization Metrics for Medical Items and Services (Excluding Drugs)," and that phrase works as a site search term. UnitedHealthcare's CMS-0057-F reporting page links separate metrics pages for its Medicare Advantage, Medicaid and ACA Marketplace plans.

For a compliance monitoring team, that report is one more page per payer. It includes the full list of services that need approval, and a new version arrives every March.

What's proposed next

In April 2026, CMS published a proposed rule, CMS-0062-P, that would extend these requirements to drugs and fill some of the gaps above. Its main proposals:

• Impacted payers would "support electronic prior authorization for all drugs through the Prior Authorization API and NCPDP standards beginning on October 1, 2027." The API would carry drugs covered under the medical benefit, and the National Council for Prescription Drug Programs (NCPDP) standards would carry the pharmacy benefit. Medicaid, CHIP and Exchange payers would also have to give a specific reason for every drug denial.
• QHP issuers on the federal Exchanges would have to send providers decisions on non-drug items and services within 72 hours for expedited requests and 7 calendar days for standard ones, the limits CMS-0057-F left out for them. For drugs, the proposal sets 24 hours for expedited requests and 72 hours for standard ones.
• The CRD, DTR and PAS guides that CMS-0057-F only recommends would become required for the Prior Authorization API, and HHS would adopt HL7 FHIR as the HIPAA standard for prior authorization (referral certification and authorization) transactions.
• From 2028, payers would post prior authorization metrics for drugs, add counts and six new metrics on extensions and appeals, and report API usage to CMS. Medicaid and CHIP managed care plans would report within 90 days after each rating period.
• Small-group QHP issuers on the federal SHOP Exchanges would become impacted payers.

Most of these proposals carry an October 1, 2027 compliance date, and the new metrics start in 2028. Comments closed June 15, 2026. HHS has finalized one piece, the rule's health IT standards part (CMS-0062-F), in the FY 2027 inpatient rule, published August 4, 2026. It adopts newer versions of the Da Vinci and related FHIR guides as HHS standards; the proposal to make payers use them is still pending. The drug proposals, including the October 1, 2027 date, were still proposals as of September 29, 2026. Following a proposal from comment period to final rule is the job of regulatory horizon scanning.

One more federal program sits outside this guide. CMS's WISeR Model adds prior authorization for selected services in Original Medicare in six states from January 1, 2026, and doesn't apply to Medicare Advantage. Providers can submit a prior authorization request or accept a post-service, pre-payment review instead. Because it covers Original Medicare, it belongs on your government agency watch list (CMS and your Medicare contractor) rather than your payer list.

What CMS-4201-F requires Medicare Advantage plans to publish

A federal rule gives Medicare Advantage teams a page to watch. The 2024 Medicare Advantage final rule (CMS-4201-F) requires MA plans to follow Traditional Medicare's coverage rules, including national and local coverage determinations (NCDs and LCDs). Where those rules aren't fully established, a plan may apply internal coverage criteria. Under 42 CFR 422.101(b)(6), it must then make them publicly accessible, with "a summary of evidence that was considered," a list of the sources and "an explanation of the rationale."

The same rule protects care already under way in most MA plans (coordinated care plans such as HMOs and PPOs). Under 42 CFR 422.112(b)(8), an approved prior authorization for an active course of treatment stays valid for as long as medically necessary, and new enrollees get a transition period of at least 90 days for an active course of treatment. Every MA plan must also have a utilization management committee that reviews its prior authorization policies at least once a year.

For a monitoring team, the internal coverage criteria page is the Medicare Advantage counterpart of a commercial medical policy index. Add it to each MA plan's watch list and read each change against the NCD or LCD it supplements, the same way you'd monitor regulatory changes at CMS.

State prior authorization laws and gold card rules to track

State laws add two things a monitoring team can use: advance-notice periods, which tell you how early a change should appear, and gold card programs, which exempt high-approval providers from prior authorization. These laws generally reach state-regulated, fully insured plans. Under ERISA section 514, self-funded employer plans are generally outside state insurance law. Some statutes say so directly: section 10 of the Illinois Prior Authorization Reform Act (215 ILCS 200/10) makes an exception for "employee or employer self-insured health benefit plans" under ERISA. Medicare Advantage plans answer to federal standards, which supersede most state law for MA plans, so a state notice period generally won't cover your MA business. The federal rules they follow instead are in the previous section.

Notice and posting laws

State	Statute	What payers must do
Illinois	215 ILCS 200/20	Publish the list of services needing prior authorization on a public website with no login. Give contracted providers written notice at least 60 days before a new or amended requirement, and don't implement it until the payer updates its website
Michigan	MCL 500.2212e	Keep a public, readily accessible list of all benefits that need prior authorization. Post a new or amended requirement on the public website before it takes effect, and notify contracted providers through the provider portal at least 60 days ahead (45 days for prescription drugs)
Minnesota	Minn. Stat. 62M.10	Post new or amended requirements on the website and give Minnesota-based in-network professionals at least 45 days' written or electronic notice. Since January 1, 2026, the state's Medicaid fee-for-service program must also post its requirements and give its providers 45 days' notice
West Virginia	W. Va. Code 33-24-7s and parallel sections (33-15-4s, 33-16-3dd, 33-25A-8s)	Keep a prior authorization portal on the insurer's webpage with a comprehensive list of everything that needs prior authorization
Vermont	18 V.S.A. 9418b	Keep a current public list of services and supplies that need prior authorization. Since January 1, 2025, the same section has barred prior authorization for services ordered by an in-network primary care provider, except for prescription drugs and out-of-network care

Minimum notice before a new or amended requirement applies

A 60-day notice rule helps only if someone sees the notice. Under Michigan's law, the notice goes through the provider portal, so it reaches whoever holds that login. Monitoring the payer's public posting gives a second route to the same news. The laws themselves keep changing too (Texas amended its gold card rules in 2025), so follow pending bills in your states with legislative tracking.

Gold card laws

State	Law	Threshold and schedule	Effective
Texas	Insurance Code Chapter 4201, Subchapter N, as amended by HB 3812 (2025)	No preauthorization for a service if the plan approved, or would have approved, at least 90% of the provider's requests in the most recent one-year evaluation period, and the provider performed the service at least five times. Evaluated once a year (previously every six months)	HB 3812: September 1, 2025
West Virginia	W. Va. Code 33-24-7s and parallel sections	An average of 30 procedures a year and a 90% final approval rating over six months exempts the practitioner for at least the next six months	Plans on or after January 1, 2024
Arkansas	Act 575 of 2023	Exemption when the insurer approved at least 90% of requests in a six-month evaluation period, reviewed every 12 months	Exemptions from January 1, 2024
Georgia	SB 5 (2025), O.C.G.A. 33-46-20.1	Each insurer using prior authorization must run a program that reduces requirements based on provider performance. Criteria "shall be at the discretion of the insurer," with an annual filing due from July 1, 2026	July 1, 2025

Georgia shows why the payer's own program page matters. The statute leaves the criteria to each insurer, so the rules live on the insurer's site. Aetna's September 2026 newsletter says its Georgia program began July 1, 2026 for fully insured commercial members. It covers providers who sent at least 10 requests for a service in the prior calendar year with an approval rate of 90% or higher.

Michigan takes a similar approach: under MCL 500.2212e(16), each insurer must adopt a program, developed with participating providers, that promotes changes to prior authorization requirements based on factors such as providers' adherence to evidence-based guidelines. Voluntary national programs work the same way: UnitedHealthcare runs a National Gold Card program with its own criteria page, and it lists the eligible codes in a separate CPT list PDF, so watch both. When those criteria change, an exemption you counted on can change with them.

How often payer pages change: 93 days of monitoring data

To size how often prior authorization changes and policy edits appear, we looked at a sample of about 2,170 active Visualping monitors on payer policy pages. The sample covers prior authorization lists, medical, drug and reimbursement policies, provider news and bulletins, and provider manuals. They sit on 49 payer websites, almost all of them health plan sites (commercial, Blue Cross Blue Shield, Medicare Advantage and Medicaid managed care plans), and 37 accounts set them up. The window runs from June 28 to September 29, 2026, the full 93 days of check history available for this analysis. We classified page types by URL and page title and left out privacy, legal, careers, login and error pages. The sample also leaves out Visualping's internal accounts and any monitor created after the window opened.

• More than half of the monitored payer policy pages (about 57%) changed at least once in 93 days. The rate stayed between 56% and 62% when we removed the largest account or the two largest, tightened the page-type rules or widened the list of payer sites.
• About half of the medical, drug and reimbursement policy pages changed (about 1,850 monitors, 30 accounts). Two large watchlists hold nearly three quarters of these pages; across the other 28 accounts, about four in ten changed.
• For the typical account watching three or more payer policy pages, about two in three of its pages changed (16 accounts).
• More than a third of the monitored payer policy pages were PDF documents.

The median monitor ran 16 checks in the window, about one a week. At that pace, a change that takes effect on its announcement date can sit unseen for most of a week, which is why code lists and news pages deserve a daily check.

More than half of monitored payer policy pages changed in 93 days, however we cut the sample

A 6-step system to track payer policy changes

Trek Health published a 2026 survey of 161 provider organizations with the Healthcare Financial Management Association (HFMA). Only 26% of those organizations proactively track and model policy changes across major payers before the changes affect reimbursement (Becker's summary of the report). The six steps below build that habit one payer at a time.

Step 1: Build the payer inventory from your contracts

List every payer and product line you bill: commercial, Medicare Advantage, Medicaid managed care and Exchange plans, by state. Add each plan's delegated vendors (for imaging, cardiology, post-acute care, specialty drugs or therapy). The contract list is better than the claims list, because a plan you rarely bill can still change a rule for the one service you do.

Step 2: Map each payer to its source pages

For each payer, find the six page types from the table above. Add the CMS-0057-F metrics page for any impacted payer, the gold card program page where one exists and, for Medicare Advantage, the plan's internal coverage criteria page. That's up to nine pages per payer and product line. Record the URL, who owns the page on your side and how often it tends to change.

Step 3: Monitor the page where the change actually appears

Before you set up a monitor, open the page and confirm that the thing you care about appears on that page itself. Often it sits one click deeper, and a monitor on the parent page never fires for it.

Code lists are the usual trap. Payers often publish each version as a new file: UnitedHealthcare's commercial list effective April 1, 2026 and the one effective July 1, 2026 are separate PDFs, with the date in the file name. A monitor on the April file would never see the July list. The requirements page that links them does show each list's effective date as text, so a new version appears there as a change.

News works the same way. UnitedHealthcare puts each month's Network News items on a new monthly page, and Aetna's archive lists each issue by month, so monitor the page where the new issue appears, then read the issue. Policy update notices follow the same pattern. When a payer posts each month's notice at a new address, monitor the index or overview page that links to it. A monitor on one month's notice goes quiet once the next month's arrives.

Two more traps sit on payer policy sites. Some lists appear only after you pick a filter. On Aetna's clinical policy bulletin index, for example, Status, Month and Date menus drive the list of additions, revisions and deletions. Set those menus with a pre-check Action, or watch Aetna's newsletter archive, where policy updates are announced. And if a payer shows a CPT license or disclaimer screen ("I accept") before its policies, add an Action that accepts it, or the monitor will watch that screen instead of the policy.

Files named by year need a calendar reminder. UnitedHealthcare's summary of changes is one PDF per year, so each January, add a monitor on the new year's file. If you only have budget for one monitor per payer, put it on the page that shows each plan's current list and effective date.

Step 4: Tell the monitor what matters to you

More than half of the payer policy pages in our sample changed within 93 days, and most items on a provider news page won't touch your services. Write an "Alert me when" prompt for each page type (our guide to monitoring a web page with AI covers the setup), for example:

• Requirements page: "Alert me when the effective date changes for the commercial or Medicare Advantage list, or when a list for a new plan type is added."
• A code list kept at one stable address: "Alert me when prior authorization is added or removed for any radiology or cardiology code."
• Medical policy index: "Alert me when a policy on cardiac imaging or sleep studies is new, revised or retired."
• Provider news page: "Alert me when a bulletin announces a new prior authorization requirement, a new utilization management vendor, or a changed effective date."

Step 5: Route each change to an owner with a deadline

Every alert about prior authorization changes should land with one person who knows what to do with it. The effective date sets the deadline. This is the same owner-and-deadline logic that anchors any regulatory change management program, applied to payers.

Change type	Owner	Action before the effective date
Code added to a prior authorization list	Patient access or utilization review lead	Update scheduling rules and the payer authorization matrix
Code removed from a list	Patient access lead	Stop requesting approvals; confirm the medical policy still applies
Medical policy revised	Coding, CDI or clinical documentation lead	Check documentation templates against the new criteria
Reimbursement policy or claim edit	Billing or denials lead	Update claim scrubber edits; watch the first remits
New vendor or submission route	Patient access lead	Update payer contact sheets and portal logins
Manual or contract amendment	Managed care or contracting lead	Compare against the contract; decide whether to respond

Every payer change needs one owner and a deadline

Step 6: Keep a dated history for appeals

When a denial cites a missing authorization, the question is what the payer's list said on the date of service. A dated snapshot of the list answers it. Payers do get this wrong. In an October 2025 announcement, Washington's insurance commissioner reported a $100,000 fine against Regence BlueShield for incorrectly denying 954 claims "based on a lack of preauthorization" between 2020 and 2022. After Regence reprocessed the claims, the amount it paid rose from $11,139 to $85,982.

When your monitor flags a new list, download the file and store it with the date. UnitedHealthcare keeps earlier versions on its requirements page, but a payer can take an old file down. For lists kept at one stable address, Visualping's timestamped capture of each change gives your appeals team a record of the page as it was. Keep in mind that a capture is your own dated record of the page; for a certified copy, ask the payer.

Visualping keeps change history for 3 months by default on every plan, and Business plans can extend it to a year per monitor. Longer retention covers only captures made after you switch it on, so set it before you need it. An appeal can come up months after the date of service, so save the captures you may need. On a Business plan, the Google Sheets integration also logs every detected change to a spreadsheet you own.

A dated copy of the list answers what applied on the date of service

Ready to try this with one payer? Start with five pages free: your largest payer's requirements page, the page that links its medical policy updates and its provider news page.

Setting up payer page monitoring in Visualping

Watch the part of the page that matters

Point each monitor at the table of codes, the list of policy updates or the news listing, rather than the whole page with its menus and banners. Fewer alerts fire for layout changes nobody needs to read.

Use Actions for pages behind clicks or a login

Some payer pages show content only after you pick a state, a plan type, a line of business or a month, or after you accept a license screen. Visualping Actions run before each check and click through those steps, so the monitor sees what your analyst would see. Actions are available on every plan, including Free.

For pages behind a login, see our guide to monitoring password-protected websites. For portals that require multi-factor sign-in, the Chrome extension can check the page in your own signed-in browser while it's open. Point monitors only at pages that carry no patient information, such as a portal's news or announcements page.

Let Visualping AI sort the changes

Add your "Alert me when" prompt to each monitor. Every detected change then comes with an AI summary of what changed and a binary Important flag that tells you whether the change matches your prompt. Without a prompt, Visualping AI judges importance against its default criteria, so write one for each page type. Your team triages from the email and opens only the pages that need a closer look. For more examples, see our playbook for writing Important-alert prompts.

Cover PDFs, spreadsheets and archives

More than a third of the payer policy pages in our sample were PDFs. Visualping monitors online PDFs, but it checks only the first 100 pages of each PDF. Text-mode monitors show a warning when a PDF hits that limit; AI and Visual mode monitors show no warning. For a long provider manual, monitor the chapter on authorizations or the page that lists the chapters. Visualping can monitor Excel files directly, but when a payer renames the spreadsheet for each update, the page that links to it is the better target. Visualping can't monitor ZIP archives, so for a code set or fee schedule shipped as a ZIP, watch the page that links to it.

Send alerts where the team works

Email alerts and webhooks work on every plan, and the Visualping API (also on all plans) lets you pull changes into a tracker or ticketing system. Alerts in Slack, Microsoft Teams, Discord, Google Chat or Google Sheets need a Business plan.

For more on running many regulator and payer sites at once, see our guide to tracking changes across multiple regulatory websites.

Check for broken monitors

Payers move pages when they redesign their provider sites. Visualping's failure alerts are on by default on every plan and email you after a run of failed checks, for example when a page returns a 404 error, times out or blocks the check. The wait depends on how often the monitor runs: 7 days of failures for a daily monitor. A page that redirects to a new address shows up as a content change instead, so open any alert where the whole page was replaced. A monitor on a dead URL can't report prior authorization changes, so fix those the same week.

No monitoring setup catches everything. Some notices go out only by mail, portal message or a provider representative. Treat page monitoring as one layer of your regulatory compliance monitoring, next to your payer newsletter subscriptions, your contract notices and your own denial trend reporting.

Which payer pages to monitor first

If you're starting from nothing, this order gets the most coverage for the least setup:

Priority	Page	Why it's first	Suggested check
1	Requirements page that shows each plan's current list and effective date	A new effective date means a new list, the direct cause of authorization denials	Daily
2	Page where each new newsletter issue or news item appears	Announces vendor, date and policy changes first	Daily
3	Current year's summary of changes, if the payer publishes one	Adds and removals by date in one place (check it against the list)	Weekly
4	Page that links each medical policy update notice (the policy index or monthly overview)	Criteria changes that deny paid claims	Weekly
5	Internal coverage criteria page (Medicare Advantage plans)	Criteria MA plans apply where Medicare's own coverage rules aren't fully established	Weekly
6	Reimbursement policy index	New claim edits and bundling rules	Weekly
7	Gold card or exemption program page	Criteria for exemptions you rely on	Weekly
8	Page that lists the payer's CMS-0057-F metrics reports (impacted payers)	Annual list of services requiring approval	Monthly, daily in March
9	Provider manual authorization chapter	Procedures, appeal and filing rules	Monthly

Frequently asked questions

What is the new CMS rule on prior authorization?

It's the CMS Interoperability and Prior Authorization Final Rule, CMS-0057-F, published February 8, 2024. It applies to Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and QHP issuers on the Federally-facilitated Exchanges, not to commercial payers in general. From 2026, those payers must give a specific reason for denials and publish yearly prior authorization metrics. All of them except the Exchange issuers must decide expedited requests within 72 hours and standard requests within 7 calendar days. The Prior Authorization API follows from January 1, 2027.

If you've seen news of a newer rule, that's probably CMS-0062-P, a 2026 proposal that would extend electronic prior authorization to drugs from October 1, 2027 and set decision timeframes for Exchange plans. Only its health IT standards piece had been finalized as of September 29, 2026.

What are the CMS-0057-F compliance dates?

January 1, 2026 for the decision timeframes and denial reasons, March 31, 2026 for the first public metrics report (then every March 31), and January 1, 2027 for the Patient Access, Provider Access, Payer-to-Payer and Prior Authorization APIs. Medicaid and CHIP managed care plans follow their rating periods, and Exchange QHP issuers their plan years. The Electronic Prior Authorization measure for clinicians and hospitals starts with the CY 2027 reporting period.

What changed in prior authorization for 2026?

Four things. The CMS-0057-F decision timeframes and denial-reason requirements took effect January 1, 2026, and the first public metrics were due March 31, 2026. Many payers cut requirements after the 2025 industry pledge; UnitedHealthcare's October 1, 2026 removals are one example. And CMS's WISeR Model began adding prior authorization for selected services in Original Medicare in six states. Finally, CMS proposed extending the federal rules to drugs (CMS-0062-P), with most of the proposals set for October 1, 2027.

How much notice do payers give before a new prior authorization requirement?

It depends on the state, the contract and the plan type. Illinois and Michigan require at least 60 days' notice to contracted providers for most new or amended requirements, and Minnesota requires 45 days. Where no statute applies, your contract and the payer's own policy set the notice period, and some prior authorization changes take effect the day they're announced.

What is gold carding?

Gold carding exempts a provider from prior authorization for a service when the payer has approved a high share of that provider's past requests. Texas uses a 90% threshold over a one-year evaluation period, West Virginia and Arkansas use 90% over six months, and Georgia requires insurers to run a program but lets each set its own criteria. Many payers also run voluntary national programs.

What's the difference between a medical policy and a reimbursement policy?

A medical policy defines when a service is medically necessary and covered. A reimbursement or payment policy defines how the payer pays a covered service, such as bundling, modifier and frequency rules. A claim can meet the medical policy and a reimbursement policy can still deny or reduce it, so both need watching.

Do state prior authorization laws apply to self-funded employer plans?

Generally not. Federal ERISA law preempts state laws that relate to employee benefit plans, and it bars states from treating self-funded plans as insurers under state insurance law. State prior authorization laws mostly reach fully insured, state-regulated plans. Check each plan's funding type before relying on a state notice period, and track state legislation updates so you know when those laws change.

Does CMS-0057-F apply to commercial plans?

Not to commercial payers in general. Its impacted payers are Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and QHP issuers on the Federally-facilitated Exchanges. The individual-market QHPs those issuers sell on the federal Exchanges are the only commercial-market plans it reaches, and stand-alone dental plans are excluded. Employer group coverage, off-Exchange plans and plans sold only on state-run Exchanges fall outside it.

Do Medicare Advantage plans have to publish their prior authorization criteria?

When Medicare's own coverage rules aren't fully established, yes. Under CMS-4201-F, an MA plan that applies internal coverage criteria must make them publicly accessible, with a summary of the evidence, its sources and the rationale (42 CFR 422.101(b)(6)). Otherwise the plan follows Traditional Medicare's coverage rules, including NCDs and LCDs. Under CMS-0057-F, MA plans also list every item and service that needs prior authorization in their yearly metrics report.

Where can I find a payer's prior authorization denial rate?

Impacted payers post yearly metrics on their websites, with the first reports covering 2025. The location varies by payer; KFF found no consistent place to look. Search the payer's site for "prior authorization metrics," "interoperability" or the title of CMS's sample report, "Prior Authorization Metrics for Medical Items and Services (Excluding Drugs)." UnitedHealthcare, for example, posts its metrics on web pages for each line of business, while other payers list one file per contract or plan. Monitor the page that lists the files, because each year's report can arrive as a new file every March. Some payers also post state-required statistics for commercial plans separately, as Aetna does on its prior authorization statistics page.

Start by monitoring your top five payers

On day one, track prior authorization changes for just your five largest payers by revenue. Monitor each one's requirements page, provider news page and summary of changes, and give every monitor an owner and a response rule. Once that routine works, add the medical and reimbursement policy pages, then the rest of your contract list.

Then connect it to the government side with our guide to Medicare and Medicaid policy changes.

To run payer tracking inside a wider program, see how Visualping supports regulatory intelligence teams.

Create a free Visualping account and monitor your first five pages free.