Variation and Standardization in Prior Authorization Requirements

Prior authorization (PA) rules are neither regulated nor standardized. To quantify the variation in PA rules of four US health insurers and examine the potential for standardization. Services and medications were identified using their Healthcare Common Procedure Coding System (HCPCS) codes. We manually examined PA rules to identify a simple set of categories applicable across insurers. We categorized HCPCS codes and their PA rules with large language models and verified the results manually. We identified the HCPCS codes for which all insurers require PA, use the same criteria to determine if PA is necessary, and have the same requirements to obtain PA. Commercial insurance prior authorization rules from the provider manuals of Humana, United Healthcare, Anthem California, and Aetna. In-network providers and internally managed contracts. Out-of-network providers and external PA management vendors were excluded. Across insurers, HCPCS codes were categorized as: medical and surgical; behavioral health; or special programs. To determine if PA is necessary, Anthem California provides a medical criteria document for each HCPCS code and the other insurers use 6 criteria. Anthem California has 18 requirements for prior authorization and the other insurers have 5 requirements. The number of HCPCS codes for which PA is necessary is 3,048 for Humana, 2,660 for United Healthcare, 2,188 for Anthem California, and 1,162 for Aetna. Of the 5,475 HCPCS codes for which PA was necessary with any insurer, 3% (157) were common to all insurers and 56.4% (3,088) were unique to one insurer. There were no HCPCS codes for which all insurers used the same criteria to determine if PA was necessary nor the same requirements to receive PA. Across 4 US commercial insurers, there is significant variation in the HCPCS codes for which PA is necessary. A simple framework for categorizing HCPCS codes may facilitate the evaluation and standardization of PA rules. Do prior authorization rules, purportedly derived from evidence-based coverage policies, differ across the commercial plans of four US insurers? A simple framework was identified to reproduce the prior authorization rules of four commercial insurers. All four insurers required prior authorization for 3% (157 of 5,475) of HCPCS codes while for 56.4% (3,088 of 5,475) of HCPCS only one insurer required prior authorization. Prior authorization rules differed significantly across insurers. Using a common framework to define prior authorization rules may allow insurers to increase the concordance of evidence-based rules.