APPLIES TO: All plans

When a physician orders a test, a scan, or a surgery, we’re making a judgment that took years of training to learn. We look at the patient in front of us, their history, the evidence, and the guidelines, and we decide what they need. Then, for a growing share of care, someone at the insurance company makes a second decision about whether that care is “medically necessary” enough to pay for, and that second decision often determines whether the patient actually gets it or pays for it.

The people making those second decisions are often physicians and nurses too, and insurers say their prior authorization programs are run under the supervision of medical professionals. [1] In Medicare Advantage, a licensed physician has to review any denial based on medical necessity. [2] My question is which rules they use, and whether anyone outside the insurer can see them.

Personally, I have seen this in the genetic testing space with testing that is medically necessary to diagnose a tumor or manage a pediatric patient with genetic abnormalities but not always paid for by the payer. Five years ago, many broad-based genetic testing panels were new, and we were just figuring out how to interpret the results so they actually impacted care. Today, these tests are the cornerstone of treatment. Without the testing, you can’t figure out first-line therapy. If these tests are ordered outpatient, they often require prior authorization. Payer policies differ around coverage.

Every year the American Medical Association surveys 1,000 practicing physicians about prior authorization, and the 2025 results are hard to read. Physicians reported completing an average of 40 prior authorizations a week, which takes about 13 hours of physician and staff time, and 95% said prior authorization delays access to necessary care. But it also costs the payers time and money. More than one in four, 26%, said it had led to a serious adverse event for a patient in their care, including hospitalization, permanent impairment, or death. [3] In the AMA’s previous survey, about 31% said the criteria insurers use are rarely or never based on evidence. [4]

The workload hasn’t eased much over time. In the AMA’s 2019 survey, physicians reported 33 prior authorizations a week, and in the most recent survey it was 40. [5] [3]

These are physicians’ own reports, and the AMA advocates for physicians, so I read them as one side of the story. But when a quarter of the doctors surveyed say a coverage process has led to serious harm, I think we owe it to patients to look closely at how the rules behind that process are written.

Insurers write some of their own coverage criteria, and many also license criteria from outside companies. The two best known are InterQual, owned by Optum, and MCG. They’re large, detailed sets of guidelines that help reviewers decide whether care meets a standard, and they’re proprietary products that companies pay to use.

Hospitals have told CMS that payer coverage criteria are often unavailable or simply point to a product like InterQual, which makes it hard for providers to know what information they need to send. [6] In Massachusetts, regulators have noted that proprietary criteria must be shared on request with members and providers, but they don’t have to be published for the public. [7] So a patient can be denied care under a rule they’ve never read, and the physician appealing that denial may not be able to read it either until they ask.

Several large insurers’ public policies for shoulder replacement require that the patient has had formal physical therapy within the past 12 months, and one requires that at least half of 12 weeks of non-surgical treatment be in-person physical therapy within the past year. [8] [9] That means a patient who has lived with worsening arthritis for years, and has already been through several rounds of physical therapy, injections, and medications, can be denied surgery because the most recent round of therapy was more than a year ago. The policies do allow an exception when the medical record clearly explains why more conservative treatment isn’t reasonable. But the patient and physician team don’t see that rule until the denial arrives, and the physician has to know to document around it before the request ever goes in.

In 2023, CMS finalized rules requiring Medicare Advantage plans to follow traditional Medicare’s coverage rules. When those plans use their own internal criteria, they have to make the criteria publicly accessible, along with a summary of the evidence behind them. [10] CMS also said those plans can’t use InterQual, MCG, or similar products to change coverage criteria Medicare has already set, [11] and that “publicly accessible” means the criteria can’t sit behind a paywall or a subscription. [12]

Commercial and employer plans don’t have a federal rule like this.

As a pathologist, I’ve seen this most in lab testing. Genetic and molecular testing has grown faster than coverage rules could keep up, which makes it hard for any plan, doctor, or patient to know what’s covered and why.

Companies and states have tried two different fixes.

The first is to ask insurers to adopt evidence-based rules. Some health plans hire outside companies to write their genetic testing policies from published guidelines. One large insurer that does this says its criteria come from evidence-based guidelines published by national medical societies, and it posts the policies publicly with their references. [13] I’d like every plan to post its criteria that way or, better yet, a 3rd party does this for them. But it’s voluntary, so it only covers the plans that choose it, and the companies writing these policies are hired by the health plans themselves. [13]

The second is to require it. Since 2021, a growing number of states have passed biomarker testing laws, which require state-regulated insurers to cover testing when it’s supported by FDA labeling, Medicare coverage, or nationally recognized clinical guidelines. [14] [15] In March 2026, Mississippi became the 23rd state to pass one. [16] In Louisiana and Oklahoma, insurers can’t stack extra requirements on top of the evidence, and their medical policies have to say plainly that the law overrides them. [14] A public, evidence-based minimum decides coverage, instead of each insurer’s own policy. That is very close to what I believe every plan should have.

These state laws don’t reach self-funded employer plans, which are governed by federal law instead of state insurance rules. [14] So even in a state with a strong biomarker law, many workers with job-based coverage aren’t protected by it.

The companies that build clinical criteria have a real argument. When Massachusetts considered requiring public access, the makers of InterQual testified that their criteria took nearly 40 years, thousands of hours, and millions of dollars to develop, and that publishing all of it would take away the value of that work. [17] Insurers have also lobbied against state biomarker bills, [18] arguing that coverage mandates drive up premiums and that not every kind of evidence a bill accepts is good enough to decide medical necessity. [19] [20] In 2025, more than 60 insurers pledged to streamline and reduce prior authorization. [21]

I don’t think the payers are all bad, and they are also trying to figure out how to balance clinical care, emerging tests and treatments, and premiums. My answer is that if a rule decides whether a patient gets care, the patient and their doctor should be able to read it before the decision - even better if it’s a standard policy that a group of 3rd party physicians created and approved as minimum coverage.

Lab testing already shows that a public, evidence-based standard can work, and I think every plan should have to meet one for every specialty.

Physicians and healthcare leaders: when you receive a medical necessity denial, ask in writing for the specific criteria that were used. If your state has a biomarker law and the patient has a state-regulated plan, check whether the denial follows it.

Employers: ask your plan which clinical criteria it uses for medical necessity decisions. If you’re self-funded, you can choose to follow your state’s biomarker standard even though you aren’t required to.

“Which clinical criteria does my plan use to decide medical necessity, and can I read them?”

Next week I’ll open up the first prior authorization reports that insurers had to post this year. For the first time, we can see how often some insurers deny prior authorization, and how often those denials get reversed when someone pushes back. You’ll also see the same gap show up again: the plans that cover most working families don’t have to report at all.

If you’re a physician who has tried to get the criteria behind a denial, reply and tell me what happened.

Gavari does not take money from health insurers or health plans. If an issue has a sponsor, it is labeled at the top.

This is general education about how health coverage works. It is not insurance, legal, or medical advice. I do not sell insurance or recommend plans.

Have a question about how coverage rules work? Reply to this email. I read every reply. Please leave out personal medical details.