State Prior Authorization Laws: A Multi-State Playbook for Behavioral Health Groups
Operate prior authorization across states with different laws: the federal floor under CMS-0057-F, the 2026 state reform wave, ERISA's limits, and a jurisdiction register that turns statutes into payer clocks.
On this page: Direct answer
Direct answer
State prior authorization laws: what operators need to know
Operate prior authorization across states with different laws: the federal floor under CMS-0057-F, the 2026 state reform wave, ERISA's limits, and a jurisdiction register that turns statutes into payer clocks. Three layers govern every case: federal rules for impacted payers, state law for state-regulated products, and voluntary pledges with no enforcement.
Prior authorization is now regulated on three layers. The federal floor, CMS-0057-F, requires impacted payers — Medicare Advantage, Medicaid and CHIP managed care, and Exchange plans — to decide expedited requests within 72 hours and standard requests within seven calendar days beginning in 2026, to give specific denial reasons, and to report program metrics, with FHIR-based APIs following in 2027. On top of that, states keep passing their own prior-authorization laws: shorter decision clocks, minimum authorization durations, gold-card mandates, and reporting requirements. Underneath both, the voluntary payer pledge adds plan-reported commitments that are not enforceable at all.
For a behavioral health group operating in several states — or serving members whose plans are regulated in several states — the practical question is which clock, duration, and remedy applies to each case. The answer depends on the plan's regulatory home, not your office address, and it excludes a large population entirely: self-funded employer plans under ERISA generally sit outside state insurance law. This guide is operational context, not legal advice; confirm current statutes with counsel.
Key takeaways
The short version
- Three layers govern every case: federal rules for impacted payers, state law for state-regulated products, and voluntary pledges with no enforcement.
- State law follows the plan's regulatory situs — a member's plan state, not your clinic's location, usually decides which statute applies.
- Self-funded ERISA plans are generally outside state prior-authorization laws; capture funding type at benefits verification.
- Decision clocks typically start when the payer receives a complete request — your submission-completeness discipline is part of the clock.
- Minimum authorization-duration laws reduce renewal volume; encode them so cases are not re-requested earlier than required.
1. The three regulatory layers, and what each is worth
Behavioral health carries a disproportionate share of authorization burden, so state reforms matter operationally even when they are not behavioral-health-specific. But no layer applies universally: each case inherits exactly the protections of its plan's regulatory home.
| Layer | Examples | Enforceability |
|---|---|---|
| Federal rule (CMS-0057-F) | 72-hour expedited and 7-day standard decisions, specific denial reasons, metrics; 2027 APIs | Regulatory, for impacted payers — citable in escalations |
| State statutes | Decision deadlines, gold-card mandates, minimum authorization durations, AI-review limits, reporting | Enforceable for state-regulated products via the insurance regulator |
| Voluntary pledge | Reduced code lists, transition honoring, real-time decision targets | Plan-reported commitments; useful in payer meetings, not enforceable |
2. What the 2026 state wave looks like
Trade-press surveys of 2026 legislation show a consistent pattern across states even though the details differ. Reported examples include Minnesota amendments adding expedited processing for certain medication categories on top of its long-standing utilization-review chapter; Alaska deadlines of 72 hours for routine and 24 hours for expedited determinations; Virginia minimum authorization durations of six months for initial and twelve months for continued services; California instructions for plans to begin reporting prior-authorization data during 2026; and Texas's earlier statutory gold-card program continuing to exempt providers with high approval rates.
Treat every example above as a pointer, not a rule you can rely on: bills are amended, effective dates slip, and scope lines — which products, which services, which markets — are where the details live. The operational asset is your own verified register, built from statutes and regulator guidance, with a recheck date per state.
3. Build the jurisdiction register
- 01
List your regulatory homes
From your payer mix, list each state whose insurance law governs a meaningful share of members, plus the federal programs. This is usually shorter than your service footprint and longer than your office list.
- 02
Record the operative facts per state
For each: standard and expedited decision clocks, when the clock starts, minimum authorization durations, gold-card provisions, reviewer-qualification rules, appeal deadlines, and the regulator's complaint channel — each with statute citation and a recheck date.
- 03
Attach the register to intake
Benefits verification should capture plan funding type and regulatory state alongside eligibility. Those two fields decide which register row a case inherits.
- 04
Assign ownership
One named owner per state watches legislative sessions and regulator bulletins, and updates the register with dated sources. Quarterly is the floor; session season needs more.
4. Encode the register into case clocks
- Set each case's expected-decision date from its register row, not from a single global SLA — a 72-hour state clock and a 7-day federal clock are different promises
- Start the clock on documented complete submission: capture what was sent, when, and through which channel, because completeness disputes are where deadline arguments die
- Alarm before the statutory deadline, not after: the escalation call happens when the clock has run, with the citation ready
- Encode minimum-duration rules so renewals generate on the statutory schedule instead of the payer's historical habit
- Tag deadline violations as case outcomes by payer and state — the aggregate is what a regulator complaint or contracting conversation needs
- Keep the pledge layer visible but separate: voluntary commitments inform escalation tone, statutes inform escalation rights
5. Escalate on the correct layer
- 01
Payer first, with the citation
Most deadline failures resolve at the payer once the specific statutory or regulatory clock is quoted with the submission evidence. Route through the payer's documented escalation path.
- 02
Regulator second, with the pattern
State insurance departments accept provider complaints for state-regulated products. File with the case facts, the citation, and — where you have it — the payer-level pattern from your tagged outcomes.
- 03
Federal channels for federal programs
Medicare Advantage and Medicaid managed-care issues route through CMS and state Medicaid agencies respectively, with CMS-0057-F obligations as the reference point for impacted payers.
- 04
Contracts last, with the ledger
Persistent violations priced into your operations belong in contract negotiations: turnaround guarantees, escalation contacts, and consequences, supported by your outcome data.
Common questions
Answers before you build.
Which state's prior authorization law applies to a case?+
Generally the law of the state that regulates the member's plan — the plan's situs — not the state where your clinic sits. A group with offices in one state routinely holds cases governed by several states' laws, plus federal rules for Medicare Advantage and Medicaid managed care. Confirm applicability with counsel.
Do state prior authorization laws apply to self-funded employer plans?+
Generally no. Self-funded ERISA plans follow federal law rather than state insurance codes, even when administered by a familiar insurance brand. Capture funding type during benefits verification so each case inherits the correct rights.
When does a prior authorization decision clock start?+
Typically when the payer receives a complete request — statutes and CMS-0057-F both frame deadlines from receipt of required information. Document exactly what was submitted and when; an incomplete submission restarts or tolls the clock and voids the deadline argument.
What is a gold-card law?+
A statute requiring payers to exempt providers from prior authorization for services where the provider has a demonstrated approval record — Texas's program is the longest-standing example, and other states have adopted variants. Thresholds, lookback windows, and covered services differ by state and are separate from payers' voluntary gold-card programs.
Practical closeout
Use this operator checklist.
- Three layers govern every case: federal rules for impacted payers, state law for state-regulated products, and voluntary pledges with no enforcement.
- State law follows the plan's regulatory situs — a member's plan state, not your clinic's location, usually decides which statute applies.
- Self-funded ERISA plans are generally outside state prior-authorization laws; capture funding type at benefits verification.
- Decision clocks typically start when the payer receives a complete request — your submission-completeness discipline is part of the clock.
- Minimum authorization-duration laws reduce renewal volume; encode them so cases are not re-requested earlier than required.
Continue through the cluster
Verified customer case studies are added only with customer permission and supporting evidence; none is implied by these operational examples.
Sources & methodology
Trace the operational claims.
Marsa Health Editorial reviewed the primary and research sources below on July 28, 2026. We translate them into workflow controls, distinguish proposals from final rules, and flag where plan, program, state, contract, or clinical requirements vary.
- 01CMS Interoperability and Prior Authorization Final Rule CMS-0057-F Centers for Medicare & Medicaid ServicesCurrent implementation dates, decision timeframes, denial-reason requirements, metrics, and API provisions for impacted payers.Accessed or rechecked July 28, 2026
- 02Minnesota Statutes, Chapter 62M: Utilization Review Office of the Revisor of Statutes, MinnesotaExample of a state utilization-review statute governing prior-authorization procedures, timelines, and reviewer requirements. State law changes; verify the current session text.Accessed or rechecked July 28, 2026
- 035 states reforming prior authorization in 2026 Becker's Payer IssuesTrade-press survey of 2026 state prior-authorization laws, used for clearly labeled population-level context rather than legal advice.Accessed or rechecked July 28, 2026
- 04Health Plans Take Action to Simplify Prior Authorization AHIPJune 2025 industry pledge describing six voluntary prior-authorization commitments, including demonstrated reductions by January 1, 2026 and standardized electronic submission by January 1, 2027. Commitments are plan-reported, not regulations.Accessed or rechecked July 28, 2026
- 052024 AMA prior authorization physician survey American Medical AssociationPhysician-reported administrative workload, delays, treatment abandonment, and burnout associated with prior authorization.Accessed or rechecked July 28, 2026
- 06Electronic Prior Authorization Centers for Medicare & Medicaid ServicesCurrent CMS provider-readiness guidance for 2027 electronic prior authorization, EHR questions, FHIR testing, and workflow preparation.Accessed or rechecked July 28, 2026
- 07Minimum Necessary Requirement U.S. Department of Health and Human ServicesHIPAA guidance on limiting uses, disclosures, and requests for protected health information when the standard applies.Accessed or rechecked July 28, 2026
Organizational author. Editorial review covers source accuracy, search intent, workflow boundaries, and human-oversight requirements. This material is educational and does not provide clinical, legal, coding, or coverage advice.
No named clinical or legal expert reviewer is attributed to this version. Marsa Health does not invent reviewer credentials.
Read our editorial methodRevision history
What changed and when
July 28, 2026
Initial publication, source review, and operational editing.