Medicaid Prior Auths Have a 7-Day Clock. First Data: 14% Denied, 47% Reversed

Since January 1, 2026, every state Medicaid fee-for-service program and every Medicaid managed care plan has had to decide standard prior authorization requests within seven calendar days and expedited ones within 72 hours, and to give a specific reason for any denial. The rule's last deadline is January 1, 2027, when plans generally must start delivering prior-auth decisions and denial reasons through new electronic interfaces.

The first public data is out too. Plans had to post their 2025 prior-auth metrics by March 31, 2026. KFF's analysis of eight Medicaid managed care insurers found they denied 14% of standard requests on average, ranging from 2% to 23%, and that 47% of appealed standard denials were overturned.

The turn: a federal clock your ABA reauth falls under

The rule, CMS-0057-F, never mentions ABA. That's what makes it useful: it covers every item and service except drugs, so it covers your 97153 reauthorization the same way it covers an MRI. Virginia's DMAS described the change as cutting its standard from 14 days to 7. A reauth that sits for three weeks without an extension notice is now a compliance question for the plan, not just a scheduling problem for you.

What the rule says

• Clock: 7 calendar days for standard requests, 72 hours for expedited. Virginia's bulletin notes a standard request can be extended by up to 14 calendar days if the member or provider asks, or if the plan needs more information and the extension is in the member's interest.
• Denials: a specific reason is required, however the request was sent: portal, fax, email, mail or phone.
• Metrics, posted annually on the plan's website: the percentage of standard requests approved and denied, the percentage approved after appeal, the percentage approved after an extended review, expedited approval and denial rates, and average and median decision times. All aggregated across services.
• January 1, 2027 (CMS says exact dates vary by payer type): a Prior Authorization API that returns approval with an end date, denial with a specific reason, or a request for more information; and a Provider Access API that lets in-network providers pull a patient's claims and prior-auth information.
• Drugs are excluded throughout.

The limits

KFF's figures are from 2025, before the clock took effect, and cover eight insurers with 54% of Medicaid managed care enrollment. Plans report percentages only, with no request counts and no breakdown by service, so nothing in them is ABA-specific. Fee-for-service programs weren't analyzed. KFF also notes there's no automatic external review of upheld denials in Medicaid managed care; after the plan's appeal, the route is the state fair hearing.

What you must know or do

• Billing leads: pull every Medicaid ABA authorization request from the last three months and record the submission and decision dates. Flag each standard request that took more than 7 calendar days with no extension notice.
• Owners: take the flagged list to each plan's provider representative and cite the seven-day requirement. If the pattern holds, send the same list to your state Medicaid agency, which holds the plan's contract.
• Owners: find each plan's posted prior-auth metrics on its website. Write down its standard denial rate and the share approved after appeal. Across the eight insurers KFF read, that last figure ran from 22% to 81%.
• BCBAs: when a denial doesn't say what was missing, ask the plan for the specific reason before you write the appeal. The rule requires one, and an appeal written against a named reason is easier to win.