Big three insurers have little overlap in prior auth rules

Clinical Takeaway: The administrative burden of prior authorization comes partly from genuine fragmentation, not just complexity. Clinicians cannot assume that a service requiring prior auth from one major insurer will require it from another, or that the criteria will look anything alike.

Prior authorization is widely cited as a top driver of clinician burnout and care delays, but most prior research has focused on Medicare Advantage. This study mapped the rules of three of the largest commercial insurers to test how much consistency exists across them, and whether the rules could be assembled into a single searchable resource for clinicians and patients.

Across 4,645 procedure and service codes requiring prior authorization from at least one of the three insurers, only 14% required it from all three. Another 20% required it from two, and 66% from just one. UnitedHealthcare required prior authorization for 2,247 medical and surgical services, compared with 573 for Aetna, a roughly four-fold difference with no clear explanation.

The criteria insurers use to decide when prior authorization applies also diverged sharply. For medical and surgical services, Aetna relied on a single criterion (the combination of services provided), while UnitedHealthcare used five, including state, age, diagnosis, equipment cost, and site of care. The documentation required to obtain approval differed similarly. Aetna required a site-of-service review for more than 200 services; Humana and UnitedHealthcare required it for 11 and 33, respectively. Across the full set of codes, no two insurers used the same combination of criteria or requirements.

Researchers analyzed publicly available provider manuals from the three insurers, using ChatGPT-3.5 Turbo to extract rules for each Healthcare Common Procedure Coding System code, with manual checks for validation. They built the results into a searchable Python database. The analysis covered only three insurers and only the rules described in published provider manuals, so external utilization management vendors and unpublished rules may add further fragmentation.

The authors argue that consolidating prior authorization rules into a single living database, modeled on the ICD-10 system, is technically feasible and would improve transparency for clinicians and patients. But the more substantive finding is that the variation itself lacks any clear clinical rationale and warrants direct scrutiny. Recent insurer pledges to simplify and digitize prior authorization do not include cross-insurer standardization, meaning the underlying fragmentation is likely to persist even as individual processes move online.

"These large differences are unexplained and need to be scrutinized," the authors wrote, noting that "there is no planned standardization across insurers to eliminate the fragmentation in the processes to obtain a PA."

Source: Zaari Jabri A. Ann Intern Med. 2026 May 19. Variation in commercial insurer prior authorization rules