A prior-authorization denial is a paperwork decision, not a medical one — and the paperwork is reversible. Insurers internally overturn a meaningful share of denials they review, and external reviewers overturn a meaningful share of what survives the internal round. But most denials are never appealed at all. The federal framework that lets you appeal is the same one that lets the plan stall, and the timelines run on both sides simultaneously. This guide is the 2026 playbook for the 30-day window that opens the moment the denial letter arrives.

The rules below come from the Affordable Care Act's claims and appeals regulation (45 CFR § 147.136), the Department of Labor's parallel ERISA rule (29 CFR § 2560.503-1), the DOL's combined claims-and-appeals overview, the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) whose operational provisions took effect January 1, 2026, and HealthCare.gov's external-review guidance. Primary sources are linked inline so you can verify any timeline against your specific plan.

The four-tier framework, in the order it actually moves

Federal law gives you a defined sequence after a prior-authorization denial. Each tier has its own timeline, decision-maker, and required documentation. Skipping a tier closes the door to the next one, so the order matters even when one tier feels like a formality.

  1. Peer-to-peer review (optional, fast). Your surgeon's office calls the insurer's medical director and argues the case physician-to-physician. This is not a formal appeal — it's a renegotiation. Most plans allow it before the formal appeal window opens, and a successful peer-to-peer reverses the denial without paper. If it fails, your formal appeal rights are untouched.
  2. Internal appeal, Level 1 (formal). You file a written request asking the plan to overturn its own decision. The plan's pre-service decision deadline is 30 days under 29 CFR § 2560.503-1(i); post-service appeals (the surgery already happened, you're fighting the bill) get a 60-day plan deadline. Your filing deadline is generally 180 days from the denial notice.
  3. Internal appeal, Level 2 (formal, if your plan offers it). Some plans require a second internal appeal before external review. The plan must tell you in the Level-1 denial letter whether Level 2 is required or optional in your specific plan.
  4. External review by an Independent Review Organization. After exhausting internal appeals, you have four months to request external review. The IRO must decide within 45 days for standard cases. Their decision is binding on the plan — if they overturn, the plan must authorize the surgery and cover it.

The two clocks running against you are different: the plan's 30-day decision clock starts when you file, and the your 180-day filing clock starts when the denial letter is dated. Don't conflate them. The plan's clock is on them; the filing clock is on you.

What changed in 2026: CMS-0057-F's new operational rules

The CMS Interoperability and Prior Authorization Final Rule's operational provisions took effect January 1, 2026. They apply to Medicare Advantage, Medicaid managed care, CHIP managed care, and Qualified Health Plans sold on the Federally Facilitated Exchange. They do not apply to employer-sponsored group health plans regulated by ERISA, which is where most U.S. workers get coverage. For covered plans, the new minimums are:

  • Standard prior-authorization decisions in 7 calendar days, down from 14 days for Medicare Advantage. Plans that miss the deadline must approve the request by default in some categories.
  • Expedited (urgent) prior-authorization decisions in 72 hours.
  • Every denial must state a specific reason — not "not medically necessary" with no further detail. The new rule requires the denial letter to give the clinical or coverage basis that produced it. That language becomes the spine of your appeal.
  • Previously approved inpatient admissions generally cannot be retroactively denied. An authorization once granted is not subject to clawback simply because the plan changes its mind during the stay.
  • Public reporting of prior-auth metrics begins March 31, 2026, covering calendar-year 2025 data. Approval rates, denial rates, appeal-overturn rates, and average decision times become a matter of public record per plan.

The API-based prior-authorization automation (Patient Access, Provider Access, Payer-to-Payer, and Prior Authorization APIs) is the larger piece of CMS-0057-F, but its compliance date is January 1, 2027. For 2026, the rule's bite is the decision-timeline reduction plus the specific-reason requirement.

If your coverage is an employer-sponsored ERISA plan, none of the CMS-0057-F deadlines apply to you. Your timelines are the ACA defaults from 29 CFR § 2560.503-1 — 15 days for pre-service decisions, 72 hours for urgent care, 30 days for post-service. The plan is allowed one 15-day extension if it gives notice and explains why. Read your Summary Plan Description to confirm which framework you sit under; the SPD's "claims and appeals" section will state the exact timelines.

What an effective Level-1 appeal letter contains

The Level-1 appeal is the most important filing you will make in this process. About half of the cases that ultimately get reversed are reversed at Level 1, before any external reviewer ever sees them. A weak Level-1 letter loses cases that a strong one would have won. The components are:

  • The plan member's identifying information — name, member ID, group number, date of birth — at the top of the letter.
  • A clear statement that this is a formal Level-1 appeal of the denial dated [exact date], referencing the claim or authorization number printed on the denial letter.
  • A direct rebuttal of the plan's specific stated reason for denial. Quote the reason verbatim and respond to it. If the plan said the procedure is "not medically necessary," respond with the clinical facts that establish medical necessity. If the plan said it's "experimental or investigational," respond with the FDA approval status, the relevant CPT code's coverage history, and any published clinical guidelines.
  • A letter of medical necessity from the surgeon, on the practice's letterhead, dated within 30 days of the appeal. The letter should state the diagnosis with ICD-10 codes, the planned procedure with CPT codes, the clinical findings that support the diagnosis, the conservative treatments already tried and their outcomes, and a specific statement that delaying or denying this procedure will cause [specific clinical consequence].
  • Supporting clinical documentation — relevant imaging reports, lab results, specialist consult notes, physical-therapy records showing conservative treatment failure, and any prior plan correspondence that supports your case.
  • A reference to the specific plan-document language showing the procedure is a covered benefit. The Summary Plan Description and Evidence of Coverage list covered services; cite the page and section. Don't ask the reader to find it.
  • A reference to applicable clinical guidelines from the relevant specialty society (American Academy of Orthopaedic Surgeons, American College of Cardiology, American College of Surgeons, etc.) that support the procedure for your diagnosis.
  • A clear request at the close: "I am requesting that this denial be overturned and the requested prior authorization be approved within the 30-day decision window required under 29 CFR § 2560.503-1(i)."

Send the appeal via certified mail with return receipt, and email it to the address on the denial letter the same day. Keep a complete copy and the certified-mail receipt. The plan's 30-day decision clock starts when they receive it, and proof of receipt closes off the most common stalling tactic.

Expedited (72-hour) urgent appeals — when to invoke them

The standard appeal timeline is too slow for surgery that can't wait. An expedited appeal must be decided within 72 hours rather than 30 days, and the legal trigger is straightforward: the standard timeframe would seriously jeopardize life, health, or the ability to regain maximum function, or — for ongoing treatment — the patient is in severe pain that cannot be adequately managed without the requested care.

Your surgeon must certify the urgency in writing. If the surgeon's letter states the case is urgent, the plan is legally required to treat the appeal as expedited. Common scenarios where the surgeon's certification is straightforward:

  • An active cancer where delay would allow the disease to progress.
  • A neurological condition where delay risks permanent nerve damage — including some scoliosis and spine cases with cord compression, or carpal tunnel surgery with signs of motor loss.
  • A cardiac condition where delay risks acute decompensation.
  • Severe pain that prescribed conservative measures cannot control.
  • An ongoing inpatient stay where coverage was just denied and continuing treatment depends on reversal.

The 72-hour expedited appeal can be requested verbally — the plan must accept a phone call. Confirm it in writing the same day, but don't wait for the paper to start the clock. Expedited internal appeals also unlock expedited external review, which must be decided in 72 hours rather than 45 days. You can request expedited external review simultaneously with the expedited internal appeal when the case is genuinely urgent, rather than waiting for internal exhaustion.

External review: the federal backstop after internal denial

Once internal appeals are exhausted, you have 4 months to request external review. The reviewer is an Independent Review Organization that has no relationship to your plan, and its decision binds the plan. There are two paths depending on your state and your plan type:

  • State-administered external review applies in most states for individual and fully insured group plans. The state's department of insurance — or a contracted IRO — runs the process. State programs that meet or exceed the NAIC Uniform Health Carrier External Review Model Act standards are recognized by HHS as compliant; the Model Act is the procedural template most states follow.
  • Federal external review applies if your plan is self-funded ERISA, or if your state's program does not meet NAIC standards. The plan can either use the HHS-administered federal external review process or contract directly with an accredited IRO. Either way, the decision is binding on the plan.

Your final Level-1 (or Level-2, if applicable) denial letter is required to tell you which path your plan uses and how to request external review. If the letter omits that information, the plan has violated the disclosure requirements of 29 CFR § 2560.503-1 — note that violation in your external review request; it shifts the procedural posture in your favor.

External review filing costs are capped: state programs charge $25 or less to the consumer, and most states charge nothing. The IRO's full fee is paid by the insurer, not by you. If you cannot afford even the nominal fee, the plan must waive it on financial-hardship grounds.

The ERISA self-funded plan caveat

If your insurance comes through a large employer's self-funded plan — which describes the majority of U.S. workers with employer coverage — your plan is regulated by ERISA, not state insurance law. Three consequences follow:

  • State insurance commissioners cannot help you with a self-funded plan denial. Their authority does not reach ERISA plans. The DOL's Employee Benefits Security Administration is the federal regulator; complaints go there, not to a state agency.
  • State external-review programs may not apply. Some states have voluntary opt-in arrangements; many do not. Default to federal external review unless your Summary Plan Description says otherwise.
  • The plan's deadlines are the ACA defaults, not the new CMS-0057-F deadlines. Pre-service decisions get up to 15 days; the plan is allowed one 15-day extension. Post-service appeals get 60 days.

If you don't know whether your plan is self-funded, ask HR or check the Summary Plan Description — it will state the plan type explicitly. The card in your wallet doesn't tell you; many self-funded plans are administered by Aetna, Cigna, BCBS, or UnitedHealthcare under a "third-party administrator" arrangement, so the logo on your card belongs to the administrator, not to a fully insured plan.

What to do in the first 72 hours after the denial

The procedural decisions you make in the first three days after the denial letter arrives shape the rest of the appeal. The checklist:

  • Read the denial letter twice and underline the specific stated reason. The 2026 CMS-0057-F rule requires that reason to be specific; if your plan is covered and the letter says only "not medically necessary" with no clinical or coverage basis, the denial is non-compliant. Note that in your appeal.
  • Call your surgeon's office that same day. Ask for a peer-to-peer review with the insurer's medical director. Most surgical practices have a clinical staff member who handles this routinely. Peer-to-peer adds days, not weeks — and many denials reverse here without ever becoming formal appeals.
  • Request the full case file. Federal law entitles you to copies of all documents the plan considered, the specific guidelines or criteria applied, and the credentials of the reviewer who made the denial decision. Ask for these in writing. You'll need them for the Level-1 letter, and the request itself sometimes prompts a reconsideration.
  • Determine whether the case is urgent. If yes, request the expedited 72-hour appeal at the same time as the peer-to-peer, not after. Your surgeon's office should write the urgency certification the same day.
  • Identify your filing deadline. Mark 180 days from the denial date on a calendar. Most insured appeals are filed within the first 30 days; waiting past 90 days is a procedural gamble even though the law gives you 180.
  • For surgery the plan has already paid for — but is now refusing to authorize follow-up or related care — the same appeal framework applies. Our No Surprises Act guide covers the related question of which providers a plan can balance-bill at an in-network hospital; appeals and balance-billing protections run on separate tracks.
  • Track the cost at stake. A denied hysterectomy typically runs $10,000 to $20,000 billed at in-network rates and $25,000 to $50,000 at out-of-network rates; a scoliosis correction runs $50,000 to $200,000+; an outpatient carpal tunnel release runs $2,000 to $10,000. Knowing the dollar figure helps calibrate how much time and effort the appeal warrants — and frames the negotiation if you choose to pay cash and dispute later via our surgery bill negotiation playbook.

The single sentence that decides whether the appeal happens

Most prior-authorization denials are never appealed. The reasons are predictable: the patient assumes the denial is final, the surgeon's office doesn't have bandwidth to push back on every case, and the 30-day clock feels too long to bother with when the surgery is already on the calendar. The structural fact is that the people who file actually win a meaningful portion of the time, and the people who don't file always lose.

If the denial letter arrived this week, the action is one sentence to the surgeon's office, today: "I want to appeal this denial — can your office request a peer-to-peer review now, and start a Level-1 written appeal in parallel?" Both can happen the same week. The cost of asking is a phone call. The cost of not asking is the full out-of-pocket price of a surgery that federal law gave you a defined process to make the insurer cover.