Prior Authorization Tracker for a Medical Practice: What to Log, the 2026 Decision Deadlines, and the Link to Denials

A prior authorization tracking template: the columns

One row per authorization request. A spreadsheet is enough to start; so are the authorization fields in the PM, if it has them and the team fills them in every time. The columns:

• Patient reference: the PM account number, not the name or the diagnosis.
• Payer and plan type: Medicare Advantage, Medicaid fee-for-service, Medicaid managed care, an employer plan or another commercial plan. The type decides which deadline applies.
• Service: the CPT or HCPCS code, units or visits requested, ordering and rendering provider, site of service, and the scheduled date.
• Request: date and time sent, channel (portal, fax, phone or electronic), reference number, standard or expedited, and who sent it.
• Decision: date and time received, the result (approved, partly approved, denied, more information requested), and any denial reason in the payer’s words.
• Approval: authorization number, codes and units or visits approved, and the start and end dates.
• Use: units or visits used to date, updated from the schedule or the claims, and the balance left.
• Next action, owner and due date.

A tracker tied to patients is still protected health information, even with names left out. Where it lives, who can open it and how long it is kept are questions for the practice’s privacy or compliance officer; the safe default is inside the practice’s own PM or EHR, or a secured location the practice controls.

The 2026 prior authorization decision deadlines

CMS’s Interoperability and Prior Authorization final rule, CMS-0057-F, published in the Federal Register on February 8, 2024 (89 FR 8758), set decision deadlines that apply from January 1, 2026 to the payers it calls impacted payers. In CMS’s fact sheet, impacted payers, excluding QHP issuers on the federally facilitated exchanges, must send prior authorization decisions “within 72 hours for expedited (i.e., urgent) requests and seven calendar days for standard (i.e., non-urgent) requests.” The regulation text, payer by payer:

• Medicare Advantage: 42 CFR 422.568(b)(1)(ii) sets 7 calendar days for a standard request for an item or service subject to the prior authorization rules in 422.122, beginning on or after January 1, 2026, and 42 CFR 422.572 sets 72 hours for an expedited request. Either can be extended by up to 14 calendar days in the circumstances the rules list, such as a request from the enrollee.
• Medicaid fee-for-service: 42 CFR 440.230(e) sets 7 calendar days for a standard decision and 72 hours for an expedited one, beginning January 1, 2026, unless state law sets a shorter time; a standard decision can be extended by up to 14 calendar days.
• Medicaid managed care: 42 CFR 438.210(d) sets state time frames of no more than 7 calendar days for standard decisions in rating periods that start on or after January 1, 2026, and 72 hours for expedited ones, each with a possible extension of up to 14 calendar days.
• Denial reasons: from January 1, 2026, 42 CFR 422.122(a) requires a Medicare Advantage organization that denies a prior authorization request to give the provider “a specific reason for the denial,” whatever method it uses to send the decision; the fact sheet states the same duty for impacted payers.
• Published metrics: 422.122(c) requires each Medicare Advantage organization to post its prior authorization data for the previous year by March 31, including the list of items and services that need prior authorization, approval and denial percentages, and the average and median time to a decision. The fact sheet says the first set was due by March 31, 2026.

What the rule does not cover matters as much. Drugs are excluded from these provisions. The Federal Register text says the requirements “do not directly pertain to Medicare FFS,” meaning traditional Medicare. Employer group health plans follow the Labor Department’s claims rule, 29 CFR 2560.503-1, which for a pre-service claim — one where the plan conditions a benefit on approval in advance — sets a decision within 15 days, with one extension of up to 15 days, and 72 hours for urgent care. Other commercial plans follow their contracts and state law. The plan-type column tells the practice which rule to read. Not legal advice.

What the request and decision dates show

With request and decision timestamps in the tracker, each payer’s real turnaround is one sort away: median days from request to decision, by payer and by standard or expedited, each month. For a Medicare Advantage or Medicaid plan, that number can sit beside the deadline in its regulation and beside the metrics the plan itself posts. A plan whose decisions in the practice’s log run past its deadline, with no extension the practice knows of, is a specific and dated topic for the plan’s provider representative. Whether and how to escalate further is a question for the practice’s counsel, not for a spreadsheet.

The same dates settle a scheduling question inside the practice. If one payer’s standard decisions come back within a week in the log, a three-week booking buffer for that payer’s procedures is longer than it needs to be; if another payer’s requests keep needing a second round of information, a longer buffer for that payer has earned its place. The tracker turns a habit into a rule per payer.

From the tracker to the claim: checks that prevent CARC 197 and 198

A tracker prevents denials only if someone reads it at three points:

• At scheduling: every service on the payer’s prior authorization list gets a tracker row before the appointment is confirmed, and the request date is set from the payer’s deadline, not from the day before the visit. For Medicare Advantage, the plan’s posted list is the place to check which items and services need approval.
• Weekly: a look-ahead of approvals that end in the next 14 days while visits are still on the schedule, and of approvals with fewer units or visits left than are booked. These are next month’s CARC 198 denials, caught while there is still time to request more.
• At charge entry: the authorization number goes on the claim, and the code, units, date of service, rendering provider and site are checked against the approval. A mismatch caught here is an N54 remark that never happens.

Once a month, the denial log closes the loop: every CARC 197, 198 or 39 denial is matched to its tracker row, or to the missing row, and sorted by which of the three checks would have caught it. Illustrative example: a month shows 12 authorization-related denials worth about $6,000. Five had no tracker row, four had an approval that ended before the date of service, and three billed more visits than were approved. That is one scheduling rule, one weekly look-ahead and one charge-entry check, in that order.

Where does staff lose the most time on prior authorizations?

Staff time on prior authorizations goes into five steps around each request: checking whether the service needs approval and what the payer wants attached, building and sending the request, following it while it is pending, answering a request for more information, and redoing the work after a denial or after an approval ends or runs out of visits. Which of the five costs a given practice the most time shows only in its own records, so the way to find out is to measure it.

Several of these steps are what the federal rule targets. CMS’s fact sheet for the Interoperability and Prior Authorization final rule, CMS-0057-F, says impacted payers must implement a Prior Authorization API beginning January 1, 2027 that is populated with the payer’s list of covered items and services, “can identify documentation requirements for prior authorization approval,” supports the request and response, and reports an approval, a denial with a specific reason, or a request for more information. Impacted payers are Medicare Advantage organizations, Medicaid and CHIP fee-for-service programs and managed care plans, and QHP issuers on the federally facilitated exchanges, and the requirements exclude drugs. For employer plans, other commercial plans and drug requests, each step still runs through whatever channel the payer offers.

To find the largest step, keep a simple time log beside the tracker for one month: one line per touch, with the tracker row, the step, the channel and the minutes. Then total the minutes and touches by step and by payer. The five steps to log:

• Before the request: confirming the service is on the payer’s prior authorization list and finding what documentation that payer wants. Log the minutes and where the answer came from (posted list, portal or phone call); time here points at a one-page reference sheet per payer, kept current.
• Building and sending it: pulling the order, notes and codes from the chart into the payer’s form, portal or fax. Log the channel and the minutes; side by side, the payers show which channel costs the desk the most.
• While it is pending: every status check by portal or phone before a decision arrives is one touch. The request and decision timestamps already in the tracker show the wait; the touch count shows what the wait costs in staff time.
• More information requested: a second round of documents for the same request. Log the date asked and the date answered; a payer whose rows keep landing here is showing the practice what its first submission leaves out.
• After the decision: a denial to resubmit or appeal, an approval that ended or ran out of visits before the care was finished, and any visit rescheduled because of either. Log the denial reason from the tracker’s decision column and the resubmission date, then group this step by reason in the monthly sort.

When a tracker is enough, and when not to buy anything

If the practice orders few services that need prior authorization, a well-kept tracker and a weekly look-ahead are the whole job, and no outside help pays for itself. If the PM has authorization fields that stop a claim from going out without an authorization number, use them, and keep the tracker for the dates the PM does not hold. Software that automates requests, AI tools included, can save staff time once the log shows where the time goes; bought before that, it automates a process nobody has measured.

An outside look earns its fee when authorization-related denials keep arriving without anyone tracing them to a step, when procedures are rescheduled for missing approvals, or when nobody can say how long each payer takes. The Revenue Review takes two weeks; its first pass reads aggregate exports — the tracker or its PM equivalent, denials by reason code, rescheduled visits — not patient names, and it ends with a written report that prices each finding and a 90-day plan. It makes no clinical judgment and does not deal with payers for the practice. A free 20-minute call is enough to tell whether it fits.