What is prior authorization?
Prior authorization is the approval the health plan payer grants before a procedure, an admission or the use of certain supplies and drugs. The approval generates an authorization code, which the hospital enters on the TISS form and the payer checks when reviewing the claim.
For the hospital, authorization is the first defense against denials. A procedure performed without a code, with an expired code or beyond what was authorized (more days, another supply, another quantity) will rarely be paid without an appeal. That's why authorization is part of the hospital revenue cycle, not just a front-desk routine.
What's the difference between eligibility and authorization?
Eligibility is confirming that the patient is entitled to care: active plan, waiting period met, coverage for the type of care and correct data. Authorization is the approval of a specific procedure or item for that patient.
| Eligibility | Prior authorization | |
|---|---|---|
| Question it answers | Can this patient be seen under this plan? | Will this procedure or supply be covered? |
| When | At scheduling and when the patient arrives | Before the elective procedure, the admission or use of the item |
| Result | Confirmation of an active, covered plan | Code with validity period and authorized items |
| Denial if it fails | Administrative: inactive member, waiting period, mismatched data | Administrative: item without authorization, expired code, quantity above what was authorized |
The front-desk checklist is in the Eligibility verification guide.
What the payer contract must cover
What requires authorization isn't the same for every payer: it's defined in each contract. RN 503/2022 requires the payer–provider contract to identify the acts, events and procedures that need administrative authorization and to set [4]:
- the operating routine for authorization;
- each party's responsibility in that routine;
- the response deadline for granting authorization or issuing a justified denial, under the TISS standard.
In practice, this means the authorization center needs, for each payer, the list of what requires a code, the request channel, the documents required and the deadlines, and must keep that list updated with every contract change.
What are ANS's authorization deadlines?
There are two types of deadline that are often confused: the deadline for the payer to respond to a request and the deadline for the payer to guarantee care. Both apply at the same time, and the shorter prevails. The count also differs: RN 566 counts from the day of the request; RN 623, from the next business day [2].
Response deadline: RN 623/2024. In force since July 1, 2025, it replaced RN 395/2016 and governs how payers receive and respond to member requests, including coverage requests [2]. The payer must log the request with a protocol number and, when it can't respond immediately, must give a conclusive response within [2]:
| Request type | Maximum response time |
|---|---|
| General rule | 5 business days |
| High-complexity procedures (PAC) and elective admission | 10 business days |
| Urgent and emergency care | Immediate |
Care guarantee deadline: RN 566/2022. Sets how quickly the payer must ensure the member receives care, and the response to the request can't push past that deadline [2][3]:
| Care | Maximum timeframe |
|---|---|
| Basic consultation (pediatrics, internal medicine, general surgery, gynecology and obstetrics) | 7 business days |
| Consultation in other medical specialties | 14 business days |
| Consultation or session with a speech therapist, nutritionist, psychologist, occupational therapist or physiotherapist | 10 business days |
| Outpatient clinical laboratory tests | 3 business days |
| Other outpatient diagnostic and therapy services | 10 business days |
| Day-hospital care | 10 business days |
| High-complexity procedures (PAC) | 21 business days |
| Elective admission | 21 business days |
| Urgent and emergency care | Immediate |
The table shows the deadlines most used in the hospital. Art. 3 of RN 566/2022 has 17 items, with deadlines also for obstetric nurses, dentists, antineoplastic drugs, radiotherapy and hemotherapy, plus the contraception rule added by RN 595/2023. The full list is in the ANS maximum care timeframes guide.
And in the hospital–payer relationship? RNs 623 and 566 protect the member. The ANS FAQ on RN 623 (09/17/2025, item 8) clarifies that the rule does not govern requests made by the provider [2]. In the contractual relationship, the routine and response deadline come from the contract, as RN 503/2022 requires [4]. It's worth checking that the contract deadline is compatible with ANS deadlines: an authorization that takes longer than the care guarantee deadline exposes the payer before ANS and delays the hospital's schedule.
Urgent and emergency care
Law 9,656/1998 makes coverage mandatory for emergency care, when there's an immediate risk to life or of irreparable injury, and for urgent care resulting from a personal accident or a pregnancy complication [1]. The maximum waiting period for these cases is 24 hours [1].
In practice, urgent care starts before authorization. The hospital must notify the payer according to the contract routine and regularize authorization for the items and any admission as soon as possible, so the claim isn't later denied for a missing code or extension.
What to do when the payer denies authorization?
The denial must be in writing and justified. Under RN 623/2024, the payer must send the denial in writing to the member, even without a request, in a format that can be printed or downloaded. It must clearly state the reason and cite the contract clause or legal provision that justifies the refusal (art. 14) [2]. The payer must also inform the member that they can ask the ombudsman for a review, answered within 7 business days (art. 16) [2]. In the relationship with the hospital, RN 503/2022 requires the denial to be justified under the TISS standard [4].
When facing a denial, the authorization center should:
- Log the protocol number and the reason given, with the date and channel.
- Check whether the reason is valid: registration errors, missing documents or incorrect codes are fixed and the request is resubmitted.
- Involve the attending physician when the denial is technical, to supplement the clinical justification or report.
- Check the deadline under RN 566/2022: if care can't wait, the payer is still required to guarantee it within the timeframe [3].
- Inform the patient about the denial and the available channels, such as the payer's ombudsman and ANS.
The details of each path are in the Authorization denial guide. What happens after a complaint is in the NIP and ANS complaints guide.
OPME: why it needs special attention
Orthoses, prostheses and special materials (OPME) usually require specific authorization and are high-value items per claim. Two rules guide the process:
- The physician specifies, with no exclusive brand. Resolution No. 2,318/2022 of the Federal Council of Medicine (CFM) establishes that the attending physician defines the material's characteristics (art. 2) and bars requiring an exclusive supplier or brand (art. 4). If the payer refuses the material indicated, the physician indicates at least three brands from different manufacturers, registered with the National Health Surveillance Agency (Anvisa) (art. 8) [6].
- Disagreements go to a medical board. When the attending physician and the payer disagree on the indication for the procedure or material, RN 424/2017 governs the medical or dental board that resolves the disagreement, respecting the RN 566/2022 care timeframes [5]. See the Medical board and technical disagreement guide.
For the hospital, the risk lies in the gap between what was authorized and what was used: another model, another quantity or an extra material used during surgery. Checking what was authorized before the procedure and recording the traceability of each item used prevents high-value denials.
Some Rol procedures are only mandatory when the patient meets the criteria of the Utilization Guidelines (DUT) in Annex II of the Rol. The request must show that the criterion was met. See the Utilization Guidelines (DUT) guide.
The ANS Rol and the Supreme Court decision
ANS's Procedures and Health Events List (Rol) is the list of mandatory plan coverage. Law 14,454/2022 defined the Rol as a basic reference and provided for coverage of treatments outside it in certain cases [1].
In September 2025, ruling on ADI 7265, the Supreme Court (STF) upheld the law but set five cumulative criteria for a payer to be required to cover a treatment outside the Rol [7]:
- prescription by a licensed physician or dentist;
- no express ANS denial and no pending review of a Rol update proposal (PAR) for the treatment;
- no adequate therapeutic alternative in the Rol;
- proof of efficacy and safety based on high-grade evidence-based medicine or a health technology assessment (HTA);
- registration of the treatment with Anvisa.
For the authorization center, this means a request for a procedure outside the Rol must include this information from the start. See the ANS Procedures List (Rol) guide.
Authorization errors that become denials
| Error | How it shows up on the claim | How to prevent |
|---|---|---|
| Procedure without authorization | Item that requires a code billed without one | Updated list, by payer, of what requires authorization |
| Expired code | Procedure performed after the code's validity | Validity tracking with an alert before expiry |
| Extension not requested | Days beyond those authorized for the admission (TUSS table 38 messages 1917 and 3188 [8]) | Request the extension before the authorized days run out |
| Item different from what was authorized | OPME of another model or in another quantity | Check what was authorized with the operating room before the procedure |
| Added procedure | Procedure done during surgery and not authorized | Supplementary authorization routine right after the procedure |
| Mismatched data | Code issued for another member or another code | Check the code against registration and the form |
Authorization denials are administrative and depend almost entirely on internal processes. See how to appeal them in the Hospital claim denials guide. Denials of daily rates and extensions in long stays are in the ICU and long-stay denials guide.
How to organize the authorization center
An efficient authorization center works as a revenue cycle step, with targets and KPIs, not as a service counter. The Authorization center guide details team, workflow and KPIs. Five practices make the difference:
- Rules map by payer: what requires authorization, channel, documents, response deadlines and code validity, per contract.
- Authorization before scheduling for elective procedures, whenever possible.
- Daily tracking of admissions, requesting an extension before the authorized days run out.
- Interface with the operating room to check authorized OPME before surgery and request supplements right after.
- Feeding information back: every authorization denial goes back to the center, with the reason and amount.
Authorization KPIs
| Indicator | How to calculate | What it shows |
|---|---|---|
| Encounters with complete authorization | Encounters with a valid code for every item ÷ total encounters | Process coverage |
| Average response time by payer | Average business days between request and response | Payers that delay the schedule and billing |
| Denial rate | Requests denied ÷ requests made, by payer and reason | Where requests need better support |
| Denials for authorization reasons | Amount denied for missing code, expired code or unauthorized item ÷ amount submitted | Losses the center can prevent |
| Late extension requests | Extensions requested after the authorized days ended ÷ total extensions | Risk of daily-rate denials |
See the formulas for all KPIs in the Revenue cycle KPIs guide.
What we see in operations
At Accrua, we treat prior authorization as the step where a denial is cheapest to prevent. Accrua OS has each health plan's authorization rules and denial history already loaded, and before submission it checks whether what was done matches what was authorized: procedure, quantity, OPME, daily rates and authorization validity.
Tracking the request, the response deadline and open items is handled by agents, which flag when an authorization is about to expire or when a stay has gone past the approved days. Requesting an extension, adding clinical justification or appealing a denial are decisions made by people, who receive the case with the health plan rule and the relevant part of the medical record in view.
What we learn from an authorization denial goes into the next claim for the same health plan. The fix happens in the authorization workflow, not only in an appeal months later.
Where to start
- Build the rules map by payer from the contracts: what requires authorization, channel, documents, deadlines and code validity.
- Measure authorization denials for the last 12 months, by payer.
- Create daily admission tracking with an extension alert before the authorized days run out.
- Integrate the center with the operating room to check OPME and request supplementary authorizations.
- Review the contracts to confirm they set the routine, responsibilities and response deadline, as RN 503/2022 requires.