What is an authorization center?
An authorization center is the hospital team that requests, tracks and controls health plan authorizations for procedures, admissions, stay extensions and supplies. It brings into one team work that used to be spread across the front desk, physician offices, the surgical center and billing.
In Brazil, a health plan (operadora) is any company that sells private health coverage, regulated by ANS, the National Agency for Supplementary Health. Each authorization generates an authorization code (senha). The hospital reports it on the claim form of the TISS standard (Troca de Informações na Saúde Suplementar, Brazil's mandatory data exchange standard). Without a valid code for each item, the claim is likely to be denied. What prior authorization is, the ANS deadlines and how to handle denials are covered in the pillar guide Prior authorization.
This guide covers how to organize the team: staff, rules, routine and KPIs.
Why is the authorization center where denials are cheapest to prevent?
Because an authorization error happens before care, when it can still be fixed with a supplementary request. After discharge, the same error becomes a denial, an appeal, rework and a longer collection period.
Denials weigh heavily in Brazil. At hospitals in the Anahp network, the initial denial was 15.93% of amounts receivable from health plans in 2025, before negotiation. The denial accepted as a loss was 1.72% of gross health plan revenue [7]. Anahp does not break down how much of this comes from authorization.
Authorization-related denials are administrative: they depend on internal process, not on clinical debate. Table 38 of TUSS (Terminologia Unificada da Saúde Suplementar, the standard code set) lists specific reasons for them [6]:
| Code (table 38) | Reason | Where the center acts |
|---|---|---|
| 1414 | Authorization code expired | Expiry tracking with an alert before it lapses |
| 3103 | Authorization outside the agreed deadline | Request within the contract deadline, including in urgent care |
| 1917 | Missing extension for the number of days billed | Daily inpatient follow-up |
| 3292 | Quantity above the authorized amount | Check of what was authorized before the procedure |
| 1818 | Charge for a procedure that requires prior authorization, such as one using OPME | Link with the surgical center and supply chain |
The full list is in the guide TISS denial codes. Codes and descriptions should be checked against the current TUSS version.
The health plan rule map is the foundation of the center
There is no single list of what requires authorization: each contract defines its own. Law 9,656/1998 lists, among the mandatory clauses of the provider contract, the acts that depend on health plan authorization [2]. RN 503/2022 (ANS Normative Resolution 503/2022) adds detail: the contract must identify those acts and set the operating routine, each party's responsibilities and the response deadline, with any denial justified under the TISS standard [1].
The rule map turns those clauses into one sheet per health plan, checked for every request. A minimum template:
| Rule map field | What to record | Where it comes from |
|---|---|---|
| What requires authorization | Procedures, tests, therapies and supplies | Contract and health plan manual |
| Request channel | Portal, TISS web service, email | Contract and manual |
| Required documents | Physician order, report, test results, OPME quotes | Health plan manual |
| Agreed response deadline | Business days for elective, high-complexity and inpatient requests | Contract (RN 503/2022) |
| Code validity | Days of validity and renewal rule | Contract and manual (ANS sets no deadline) |
| Extension rule | When to request and with which document | Contract and manual |
| Urgent care | How and how fast to notify the health plan | Contract |
| Escalation contact | Name, channel and hours | Health plan |
ANS does not set how long an authorization code stays valid, and it varies across health plans. That is why it belongs in the map, with its source. The map needs an owner, a last-review date and an update with every amendment or new manual. What the contract must include is covered in RN 503/2022: what the payer contract must say.
How should the team be structured?
The setup that tends to work best splits the team by type of request, not by health plan. Each type has different deadlines, documents and risks.
| Function | What it does | Main interface |
|---|---|---|
| Coordination | Keeps the rule map, assigns the queue, escalates cases, tracks KPIs | Billing, contract management, health plans |
| Elective and outpatient | Requests authorization for tests, therapies and elective surgery before scheduling | Scheduling, physician offices |
| Inpatient and extensions | Follows inpatients every day and requests extensions and add-ons | Nursing, attending physicians, bed management |
| High complexity and OPME | Builds requests with attachments, quotes and reports; checks what was authorized before surgery | Surgical center, supply chain, physicians |
| Clinical support | A nurse or physician who reviews clinical justifications before submission | Medical staff |
Staffing depends on daily request volume, the share of requests with attachments and the number of health plans. A practical method is to measure the average time per request type for a few weeks and divide demand by each analyst's capacity. When volume does not justify separate functions, one person can cover several. But the extension queue cannot wait behind the elective queue.
The center also needs coverage when demand arrives. Urgent admissions and procedures added during surgery create requests outside business hours.
What should the center's daily routine look like?
The routine follows the request from intake to denial feedback. The diagram below summarizes the steps.
See the steps as a table
| Step | What happens | Checkpoint |
|---|---|---|
| 1. Request intake | Request arrives with eligibility already confirmed | No |
| 2. Rule-map screening | Checks whether the health plan requires a code and whether documents are complete | Yes |
| 3. Submission | Sent through the health plan channel; OPME, chemotherapy and radiotherapy attachments in the TISS batch | No |
| 4. Contract deadline | Tracks the deadline and escalates stalled requests | No |
| 5. Response | Records code, expiry and items, or the denial and its reason | No |
| 6. Day-before check | Matches what was authorized against the surgical schedule and the OPME set aside | Yes |
| 7. Inpatients | Requests stay extensions before authorized days run out, plus add-ons | Yes |
| 8. Denial feedback | Authorization-related denial returns to the center with code, amount and health plan | No |
- Request intake. The request comes from scheduling, a physician office, the inpatient unit or the surgical center, with eligibility already confirmed (see Eligibility verification).
- Rule-map screening. The team checks whether the item needs authorization with that health plan and whether documents are complete.
- Submission. The request goes through the health plan's channel. OPME, chemotherapy and radiotherapy requests use their own TISS attachments, whose batch must be sent electronically [5].
- Deadline tracking. Each request has a response deadline under the contract. Requests stalled past it are escalated.
- Response. With a code, the center records the number, validity and authorized items. With a denial, it records the reason and decides whether to fix, supplement or involve the physician (see Authorization denial).
- Pre-procedure check. The day before, the center matches what was authorized against the surgical schedule and the OPME set aside.
- Inpatients and add-ons. Every day, it checks each inpatient's authorized days and requests the extension before they run out. In TISS, the extension is linked to the original admission request form [5]. Procedures added during surgery get a supplementary request right after.
- Denial feedback. Every authorization-related denial returns to the center, with code, amount and health plan, so the cause can be fixed.
Details on each sensitive step are in Inpatient stay extension, OPME authorization and Expired authorization code.
The deadlines the center must track
The center deals with two sets of deadlines: those that protect the member, set by ANS, and the one that applies between hospital and health plan, set by the contract.
Under RN 623/2024, in force since July 1, 2025, a health plan must answer a member within 5 business days, or 10 business days for high-complexity procedures and elective admissions. In urgent and emergency care, the answer is immediate [3]. Generic replies such as “under review” do not count as an answer, and a denial must be in writing, with the reason and the clause or rule behind it [3].
The answer cannot exceed the care timeframes of RN 566/2022, such as 21 business days for elective admissions and high-complexity procedures [4]. The full table is in ANS maximum care timeframes.
One limit matters: ANS states that RN 623/2024 does not govern requests made by providers [3]. Between hospital and health plan, the deadline agreed in the contract applies, as RN 503/2022 requires [1]. That is why the rule map must include it, and the center must measure it.
Which KPIs should the center track?
The center needs few KPIs, measured monthly, by health plan and by function. The table below lists the main ones.
| KPI | Formula | Data source | What it shows |
|---|---|---|---|
| Authorization-related denials | Amount denied under authorization codes ÷ amount billed | Claim review statement | The loss the center can prevent |
| Encounters with complete authorization | Encounters with a valid code for every item ÷ encounters that require a code | Hospital information and billing systems | Process coverage |
| Average response time | Average business days from request to response, by health plan | Center log | Health plans that delay scheduling and billing |
| Requests past the contract deadline | Requests unanswered within the contract deadline ÷ total requests | Center log | Basis to hold the health plan accountable |
| Denial rate | Requests denied ÷ requests made, by reason | Center log | Where requests need better support |
| Late extensions | Extensions requested after authorized days ended ÷ total extensions | Center log and daily census | Risk of denied room-and-board days |
| Surgeries rescheduled for lack of a code | Surgeries rescheduled due to pending authorization ÷ scheduled surgeries | Surgical schedule | The center's effect on throughput |
The first KPI links the center to financial results. It requires agreement with billing on which table 38 codes count. Formulas for the other revenue cycle KPIs are in Revenue cycle KPIs, and industry figures are in Industry data.
Can an authorized procedure be denied later?
Yes, which is why the center must record exactly what was authorized. Items beyond the authorization, such as a larger quantity, a different supply or days without an extension, have their own denial codes in table 38 [6].
For a procedure authorized and performed as authorized, the issue is under debate. Anahp's 2025 contracting manual recommends that contracts rule out denying what was authorized “except in exceptional and well-founded cases” [8]. ANS Public Consultation 170/2026 proposed banning denials of authorized and performed procedures, except for technical disagreement [9]. As of October 17, 2026, the final rule had not been published [9].
What we see in operations
At Accrua, we treat the authorization team as the stage where a denial is cheapest to prevent, because a denial avoided there needs no appeal. Accrua OS holds, for each health plan, the authorization rule, the contract and the denial history: the rules map described in this guide, updated with every appeal and every contract change.
In the hospital's history, we separate denials with authorization-related codes, such as expired authorization, authorization outside the agreed window, quantity above the approved amount and unauthorized OPME (implants and devices), and match them to the stage where the failure happened. We also measure each health plan's response time against the contract deadline.
Agents track the deadline and status of each request and flag when an authorization is about to expire or when the scheduled procedure does not match the approved one. The day-before-surgery check stays with a person on the team, who gets everything gathered and sourced.
Where to start
- Build the rule map for each health plan from the contract and current manual, with an owner and a review date.
- Measure authorization-related denials over the last 12 months, by health plan and by table 38 code.
- Split the queue by type of request, with daily priority for inpatients and extensions.
- Set up the day-before check between what was authorized, the surgical schedule and the OPME set aside.
- Close the loop with billing: every authorization-related denial returns to the center with code and amount.