All posts
All posts
Policy
Prior Authorization
Provider
October 5, 2026
Prior authorization requirements are no longer set by a single federal standard. A patchwork of state laws now governs how fast a health plan must respond to a request, whether providers can earn an exemption from routine review, and how much insurers have to disclose about the criteria behind a denial. For health systems, infusion clinics, and specialty pharmacies operating across state lines, that patchwork determines day-to-day operational reality as much as any federal rule does.
This guide breaks down what's changed at the state level over the past five years, organized so your team can find your state's requirements quickly and understand how they compare to the states driving the national conversation on reform.
Two layers of regulation apply to most authorization requests: a federal floor and a state ceiling.
At the federal level, CMS-0057-F requires impacted payers (Medicare Advantage, Medicaid, and CHIP) to meet baseline decision timeframes – 7 calendar days standard, 72 hours expedited – and to publish prior authorization data, with FHIR-based API requirements phasing in through January 1, 2027. Qualified Health Plan issuers on the federal exchange are subject to other parts of the rule but are excluded from these decision timeframes. It does not cover commercial group plans or self-funded ERISA plans, and it does not touch prescription drugs.
States fill the rest of the picture, and it varies state-by-state just how they tackle it, if at all. A state law can shorten decision timeframes further, require electronic prior authorization, mandate clinical-criteria transparency, restrict how insurers use AI in utilization review, or create a "gold card" exemption for high-performing providers. Critically, state insurance law generally reaches only state-regulated fully insured commercial plans plus state-administered Medicaid and state-employee plans, since self-funded ERISA plans fall outside state insurance authority.
That's why "what does my state require" is rarely a one-line answer. It depends on the specific plan type in question, and it changes as legislative sessions close each year.
Most state activity over the last five years falls into four categories.
Gold carding laws exempt providers from routine prior authorization once they've demonstrated a high approval rate (typically 90% or more) on a given service over a defined evaluation period. Texas established the model with HB 3459 in 2021, and a handful of states (Arkansas, Colorado, Kentucky, Louisiana, Michigan, West Virginia, Wyoming) have since passed variants. These laws tend to apply narrowly: they usually exclude Medicaid, often exclude prescription drugs, and require a minimum volume of requests before a provider can qualify.
Decision-timeframe mandates set statutory deadlines for how quickly an insurer must respond to standard and urgent requests, sometimes with an auto-approval penalty if the insurer misses the deadline. These are the most common form of state prior authorization reform on the books today.
AI-restriction laws are the newest wave, emerging mostly from 2024 through 2026. States including Alabama, Arizona, California, Colorado, Georgia, Iowa, Nebraska, Texas, and Washington have passed laws requiring that a licensed clinician – not an algorithm alone – make or review adverse determinations, and in some cases requiring insurers to disclose when AI was used in a review.
Transparency and reporting requirements compel insurers to publish which services require prior authorization, disclose clinical criteria, and report aggregate approval/denial statistics to state regulators or the public.
Most state laws combine more than one of these categories rather than tackling just one.
Ten states account for the reforms with the broadest operational impact — either because they set the model other states are following, because they combine multiple reform types into a single sweeping law, or because their size means the change touches an outsized share of the national patient population. Each has a dedicated breakdown:
Alabama's baseline decision standard, a 2-business-day turnaround under Ala. Code § 27-3A-5, has simply carried over from before this window began. For a health system operating across state lines, that stability cuts both ways. It's predictable, but it also means Alabama hasn't gained many of the newer protections, like gold carding, that patients and providers elsewhere are starting to take for granted. The exception is SB 63, signed April 17, 2026 and effective October 1, 2026, which bars insurers from making coverage determinations based solely on AI and requires disclosure when AI is used in review. (AMA prior authorization State Law Chart; LegiScan SB 63)
Alaska's 2025 law is a quieter piece of reform than some of its neighbors', but the details matter for anyone managing chronic-condition patients. Requiring at least 12 months of validity for chronic-care approvals means a patient on a stable, ongoing treatment plan isn't dragged back through the authorization process every few months simply because a calendar date passed. The law also requires carriers to base adverse determinations on peer-reviewed, evidence-based clinical criteria, closing off the option of denying care based on internal, undisclosed standards.
Arizona's 2025 reform lands squarely in the newer category of AI-oversight laws, requiring that medical-necessity denials get individual review by a medical director rather than a blanket algorithmic determination. That's a meaningful distinction from simply disclosing that AI was involved. It means a denial in Arizona has to be traceable to an actual clinician's judgment, which matters as much for appeals strategy as it does for the initial decision, since a denial built on an identifiable human review is a very different thing to contest than one generated by a model. (Georgetown CHIR; AuthDenied)
Arkansas has built one of the more durable gold carding programs in the country. Act 575 (HB 1271), which amended the Prior Authorization Transparency Act, took effect January 1, 2024, and began including prescription drugs in the exemption in 2025, which puts Arkansas in rare company; most Gold card states carve drugs out entirely. HB 1301, passed the same year, closed a loophole that let insurers strip a provider's gold card status simply because their volume of gold card-eligible procedures grew, and extended the exemption to group practices rather than individual physicians alone. That combination, drug inclusion plus group-practice eligibility, makes Arkansas a state where a specialty pharmacy or infusion provider can realistically expect to qualify. (Aimed Alliance Gold Card Analysis; MultiState)
California has moved on two fronts that, taken together, say something about where prior authorization regulation is headed nationally. SB 1120, the Physicians Make Decisions Act, took effect January 1, 2025, and bars insurers from letting AI alone issue a prior authorization denial, requiring a licensed clinician to make the final call. SB 306, signed October 6, 2025, is the more structurally interesting of the two: rather than certifying individual providers the way Texas does, it requires plans to report to the state (who then publishes) which services they approve 90% of the time or more and then stop requiring prior authorization for those services altogether, starting January 1, 2028. This structure flips gold carding to the plan level, rather than the provider level, and provides an interesting mirror to Texas' reform. Governor Newsom's veto of AB 512, which would have shortened standard response times, is a reminder that California's reform appetite has limits; the baseline Knox-Keene timelines (5 business days standard, 72 hours urgent) remain unchanged for now. (Fierce Healthcare; LegiScan SB 306)
Colorado pairs an active gold carding program with a transparency requirement that many Gold card states have skipped. HB 24-1149 requires health plans to publicly post their prior authorization approval, denial, and exemption data, with the implementing insurance regulation taking effect January 1, 2026, which means Colorado's gold card program will actually be publicly auditable. The state has also removed additional prior authorization requirements for dose or frequency adjustments to chronic maintenance drugs a patient is already approved for, a small-sounding change that eliminates a genuinely common source of unnecessary re-review and delayed care when a physician makes a minor dosing tweak. Lastly, the state has passed AI-transparency legislation (HB26-1139) to place guardrails around AI medical-necessity denials, outright banning AI-driven denials without a clinician's opinion and requiring AI to use an individual patient's clinical history rather than group data in decisions – effective January 1st, 2027. (Colorado DOI; Colorado SB25-301; Colorado HB26-1139)
Connecticut has the standard building blocks – step-therapy and baseline decision timeframe mandates – already on the books, but nothing that would count as a marquee reform has passed in the last five years, though Public Act 25-94 (2025) expanded step-therapy restrictions for multiple sclerosis, rheumatoid arthritis, and certain mental-health drugs. (AuthDenied; Connecticut OLR)
Delaware joined the broader multi-year wave of state prior authorization reform in 2025, passing a law (SB 12, effective for policies issued or renewed after December 31, 2026) that establishes urgent and non-urgent decision timelines. It's a solid entry by the standards of 2025's legislative sessions, which is itself a sign of how far the baseline has shifted; timelines and continuity-of-care protections that would have been considered ambitious five years ago are now table stakes. In September 2026, SB 22 eliminated prior authorization for the diagnosis and treatment of serious mental illnesses and substance use disorders in commercial plans, effective for policies issued or renewed after December 31, 2027. (Georgetown CHIR; Delaware Governor's Office; OPEN MINDS)
Florida has a standard prior authorization form requirement catalogued in existing law, but for a state of its size, the absence of a comprehensive prior authorization overhaul in the last five years stands out. Given how much regulatory attention Florida draws on other health-policy fronts, it's a state worth watching for a bigger bill in an upcoming session. (AMA prior authorization State Law Chart)
Georgia was an early mover and has stayed active. SB 80, effective January 1, 2022, phased decision timelines down to 7 calendar days, required insurers to honor a prior plan's authorization for at least 30 days after a patient switches coverage, and limited retroactive denials of care that was already approved, well ahead of most of the country. SB 444, effective January 1, 2027, picks up the newer question of AI: insurers may use it in prior authorization review, but it cannot issue an adverse determination without a qualified human clinical peer signing off, which puts Georgia in step with the AI-oversight wave states like California and Maryland are also riding. (O.C.G.A. § 33-46-26; LegiScan SB 444)
Hawaii has taken a data-first approach. Act 151 (HB 250), signed in June 2025, requires utilization review entities to report prior authorization data to the State Health Planning and Development Agency, which publishes annual findings by insurer, care setting, and line of business, and creates a standing working group to identify evidence-based clinical criteria for the services that most often trigger prior authorization. Proposed decision timelines were stripped from the final bill. (Hawaii State Legislature; Hawaii Medical Association)
Idaho has decision-timeframe (2 business days) and rescission-limit provisions on the books, but no comprehensive reform was verified in the last five years. Given the pace of activity in neighboring Western states like Montana and Utah, Idaho's relative quiet here is notable. (AMA prior authorization State Law Chart)
Illinois passed two laws in this window that, together, represent one of the more consequential state prior authorization stories of the last five years. The Prior Authorization Reform Act (Public Act 102-0409) set timelines, transparency requirements, and enforcement mechanisms, standard fare for the era. The Healthcare Protection Act (HB 5395/Public Act 103-0650), with key provisions effective January 1, 2026, is the one that changes the conversation: it bans prior authorization entirely for inpatient adult and children's mental-health treatment at participating hospitals and bans step therapy across state-regulated plans and Medicaid managed care. HB 3019 (Public Act 104-0028) extended the mental-health ban to outpatient and partial-hospitalization services, also effective January 1, 2026. For behavioral-health providers in Illinois, this removes an entire category of authorization work, which is a wholly different kind of relief than the timeline tightening most states are pursuing. (Illinois Gov; ISMS 2024 Legislative Report; Illinois Senate Democrats)
Indiana's SB 480, passed in 2025, sets a 24-hour review window for urgent requests and 48 hours for non-urgent ones, requires new health plans to honor a patient's existing prior authorization for at least their first 90 days of new coverage, and exempts the first 12 physical-therapy or chiropractic visits in a new episode of care from prior authorization altogether. (Indiana GA; MultiState)
Iowa's HF 303, enacted in 2025, requires urgent decisions within 48 hours and non-urgent decisions within 10 calendar days (extended to 15 for complex and high volume circumstances), and requires utilization-review organizations to file annual approval and denial data with the state Insurance Commissioner. HF 2635, signed May 13, 2026, bans prior authorization for cancer screenings and emergency care. It also prohibits using AI as the sole basis to deny, delay, or downgrade a prior authorization. A gold card pilot that was originally part of HF 303 got cut before passage, which fits a pattern seen in several other states this session: gold carding is popular to propose and much harder to actually enact. (MultiState)
Kansas has appeals and external-review provisions catalogued in existing law, but no comprehensive reform has passed in the last five years, another entry in the sizable group of states that have left their prior authorization framework largely untouched during this period. (AuthDenied)
Kentucky's foundational reform, SB 54 (2019), was ahead of its time: establishing electronic prior authorization for drugs and 12-month approval periods for maintenance medications years before most states got around to either. In 2026, HB 176 (signed April 13) requires insurers to offer a gold card exemption to providers who exceed a 93% approval rate on a given service; it doesn't automatically extend to prescription drugs, and most provisions take effect July 15, 2026. (Kentucky General Assembly; AuthDenied)
Louisiana's Act 432, effective 2022, requires insurers to run a program that selectively reduces prior authorization for high-performing providers, with participation criteria left to each insurer, though the exemption excludes prescription drugs, the more common approach among Gold card states and one that makes Arkansas's drug-inclusive program the exception rather than the rule. Louisiana also requires decisions within 2 business days for electronic urgent requests and 5 business days for non-urgent ones. (Louisiana State Legislature; AMA)
Maine passed prior authorization legislation in 2024, including expanded prior authorization data reporting, one of ten states the AMA counted as enacting prior authorization reform that year. (AMA; NCSL)
Maryland also passed prior authorization legislation in 2024, then followed with HB 820 in 2025, which takes a sharper angle on AI than most states have attempted: it bars insurers from relying on group or population-level datasets when using AI in utilization review, requiring patient-specific information instead, and requires reporting to the Insurance Commissioner whenever AI plays a role in an adverse determination. Where many AI-oversight laws focus on who makes the final call, Maryland's law reaches back further into the process to regulate what data the algorithm is even allowed to draw on. (MultiState; AMA AI issue brief)
Massachusetts Division of Insurance regulations effective June 5, 2026 bar prior authorization for emergency and urgent care, primary and preventative care, maternity care, physical and occupational therapy, outpatient substance abuse therapy, post-diagnosis cancer imaging, and medications for serious mental illness and certain chronic conditions. This is an expansive ban, taking on several whole categories of care and lifting burden from patients and physicians. They also require 24-hour decisions on urgent requests, full-course approvals for stable chronic-condition patients, and 90-day honoring of prior approvals when patients switch plans. While this gives many states a run for their money, it excludes self-insured employer plans (as well as Medicare Advantage and Medicaid), cutting it to only about half the state's commercial plan members. (Mass.gov; Becker's)
Michigan's SB 247 (Public Act 60 of 2022) is one of the better examples of a reform with real enforcement teeth. It required insurers to stand up a standardized electronic prior authorization process by June 1, 2023, use peer-reviewed clinical criteria, and meet shortened timelines of 7 days for standard requests and 72 hours for urgent ones. What sets it apart is the penalty for missing those deadlines: an urgent request is automatically deemed granted if the insurer fails to respond within 72 hours, and a non-urgent request is deemed granted after 7 days. That auto-approval mechanism, rather than just a timeline on paper, is what actually gives a decision deadline weight. (MSHO; Michigan Legislature)
Minnesota, already building on strong 2019 reforms, passed 2024 legislation with three main workflow revisions. First, the bill bans prior authorization for the non-medication aspects of cancer treatment and outpatient mental-health care. Secondly, the bill makes prior authorization for chronic conditions non-expiring as long as there are no changes to the treatment plan. Lastly, it requires every insurer and utilization-review organization to annually report prior authorization data including overall utilization and approval/denial rates, with the changes taking effect in January 2026. For oncology and infusion providers specifically, the cancer-care carve-out is one of the more direct pieces of legislation anywhere in the country, and sets a precedent for other states to potentially follow Minnesota's lead on disease-specific carve-outs rather than the more common approach of across-the-board timeline changes. (AMA; AMA prior authorization State Law Chart)
Mississippi's Prior Authorization Reform Act (SB 2140), effective July 1, 2024, requires payers to publicly post a comprehensive list of services requiring prior authorization and the clinical criteria used to evaluate requests, prevents payers from denying a claim for failure to obtain prior authorization if the requirements were not effective on date of service, and mandates an electronic prior authorization process by January 1, 2025. The retroactive-requirement segment of the bill addresses a highly frustrating pattern of patients and providers being penalized for not following a rule that didn't exist yet when the care was delivered. (MS Legislature; AMA)
Missouri has decision-timeframe, clinical-criteria, and appeals provisions written into existing law, and a Gold card bill was brought forth and debated in the 2026 session, however, it was not included in the health omnibus (HB 2372) signed in July 2026, which instead added prior authorization transparency requirements and real-time electronic prior authorization for many drugs starting in 2027. Missouri is a state where the demand for a gold carding law clearly exists, and though a gold card hasn't quite passed, the state is one to watch for future provisions. (AuthDenied; KFF Health News; Missouri Hospital Association)
Montana's HB 398, passed in 2025, requires health plans to honor patients' previous prior authorizations for at least 90 days after a coverage change, requires denials and nonaffirmations to come from a physician, and sets a 12-month authorization validity for chronic conditions. Montana also bans prior authorization for long- and short- acting insulin, and sets parameters around how many times a patient can be required to repeat step-therapy – two provisions that relieve specific pain points on top of the system reform. (MultiState; Georgetown CHIR)
Nebraska's Ensuring Transparency in Prior Authorization Act (LB 77), signed by Governor Pillen, requires readily and easily accessible payer policy criteria, explicit review timelines, a standardized two-page prior authorization form across all health plans, and prohibits adverse outcomes (specifically denials) based solely on AI programs. The standardized-form requirement creates a huge time savings for prior authorization teams: anyone who has dealt with the wide variation in payer prior authorization forms understands the impact of a consistent format across the board. The Nebraska Department of Insurance released those standardized forms for use starting January 1, 2026. (Nebraska DOI; Nebraska Medical Association)
Nevada has no comprehensive reform verified for this five-year window. (AMA prior authorization State Law Chart)
New Hampshire has decision-timeframe and appeals provisions catalogued in existing law, and since 2025 has barred revoking an approved prior authorization for 60 business days, with insurer prior authorization data reporting required starting March 31, 2026. New Hampshire hasn't yet taken up the kind of sweeping reform Rhode Island and Massachusetts have adopted in recent sessions. (AuthDenied; AMA prior authorization State Law Chart; NAIC)
New Jersey's Ensuring Transparency in Prior Authorization Act (A1255/P.L. 2023, c. 296), signed into law in January 2024, is one of the most intense prior authorization reform acts in the country. For urgent medication requests, the act requires a 24-hour turnaround, an aggressive time restriction requiring real operational reform from payers, requires that denials be addressed by a physician in the same specialty, and obliges payers to make their data and reporting public. Specialty pharmacies and infusion providers operating in New Jersey now work under one of the fastest urgent-drug-authorization standards anywhere, which makes the state a useful benchmark for what's operationally possible when a legislature decides to push hard. (NJ Legislature; STAT)
New Mexico passed HB 39 in 2025, which removes prior authorization and step-therapy requirements completely for patients diagnosed with qualifying "rare diseases", including off-label specialty prescriptions used to treat said conditions. While the scope of the bill is narrow, the effect is meaningful on the affected population, since rare-disease patients are disproportionately likely to need off-label and out-of-the-box treatment methods. (MultiState)
New York requires complete requests to be decided within 3 business days and urgent requests within 72 hours. The FY27 state budget, enacted in May 2026, adds longer validity for prior authorizations for designated chronic conditions, standardized formulary posting, and expanded reporting on prior authorization use and denials. (AMA prior authorization State Law Chart; NY Governor's Office)
North Carolina has had decision-timeframe and appeals provisions catalogued in existing law since before 2021, with comprehensive prior authorization reform bills pending in recent legislative sessions but not yet enacted. As with Missouri, the presence of pending legislation without passage is worth tracking; it signals where the next wave of reform is likely to land. (AuthDenied; AMA)
North Dakota's SB 2280, signed by Governor Armstrong in April 2025 and effective January 1, 2026, is an impressively thorough piece of legislation for a state its size. It sets a 7-day standard timeline and a 72-hour urgent timeline, prohibits prior authorization entirely for emergent services and specifically, opioid-use-disorder treatment (medication-assisted treatments), requires continuity of care across coverage changes and a 12-month prior authorization validity for chronic conditions, necessitates that denials get review by a licensed physician or pharmacist with relevant expertise, prohibits a large portion of retroactive denials, and mandates annual prior authorization data reporting. Few states have even attempted to combine this many distinct reforms into a single bill, which makes North Dakota a pioneer in reform and sets the standard for what an ambitious, comprehensive approach looks like compared to the gradual reforms common in other regions. (ND Legislature; Georgetown CHIR)
Ohio has decision-timeframe provisions written in existing law, and a Gold card bill has been on the table, but nothing has been enacted for this five-year window. Given Ohio's size and the amount of legislative attention gold carding has received elsewhere, its absence from the list of enacted reforms is conspicuous. (AuthDenied; AAOS)
Oklahoma's Ensuring Transparency in Prior Authorization Act (HB 3190), effective January 1, 2025, sets 72-hour urgent and 7-day non-urgent timelines. Notably, services without a payer decision within this timeline are automatically authorized, resulting in real implications for payers who do not meet the requirements. The bill additionally requires that adverse decisions may only come from licensed medical professionals and prohibits prior authorization for emergency care. (OK House; KFOR)
Oregon's HB 2517 (2021) requires non-emergency decisions within 2 business days and makes approvals for maintenance drugs binding for a year. HB 3134, passed in 2025, expands public prior authorization data reporting, limits new prior authorization requirements for related conditions found during an approved surgery, and requires a prior authorization API by January 1, 2027. (AMA prior authorization State Law Chart; Oregon Legislature)
Pennsylvania's Act 146, enacted in 2022, reformed prior authorization in one bill, increased transparency requirements, and set decision deadlines. It's a solid early-window reform. (AMA prior authorization State Law Chart)
Rhode Island updated its prior authorization legislation in 2023 and then, in 2025, launched something truly out-of-the-box: a three-year pilot beginning October 1, 2025 that eliminates prior authorization in fully insured plans for routine services (excluding prescription drugs) ordered by a patient's primary care physician. Pilots like this are worth watching closely, since a state willing to run a multi-year experiment removing prior authorization from a whole category of care is signaling real confidence in the idea, and a successful pilot could become a template other states borrow from. (Georgetown CHIR; AMA; Mercer)
South Carolina has no new reform verified for this five-year window, another state that has left its core prior authorization framework largely unchanged amidst serious reform in other regions. (AMA prior authorization State Law Chart)
South Dakota's HB 1199, signed in March 2026 and effective July 1, 2026, requires plans to eliminate prior authorization for services approved so routinely that the requirement doesn't improve quality or reduce spending, and requires insurers' annual reports to identify services with approval rates of 80% or higher. (LegiScan HB 1199; Mercer)
Tennessee enacted comprehensive prior authorization reform in 2023, taking effect in 2025, that requires payers to use nationally recognized criteria sets, prohibits retroactive denials that were previously pre-approved, requires decisions within 7 calendar days for non-urgent requests and 72 hours for urgent ones, and payers must honor a patient's existing authorization for at least the first 90 days after switching plans. The provision requiring payers to use nationally recognized standards stands out the most; this provision addresses one of the most frustrating aspects of a prior authorization. (AMA; Tennessee General Assembly)
Texas remains the reference point for the entire gold carding movement – the bill both sets the bar for other states and has limitations to pay attention to. HB 3459, effective September 1, 2021 and applying to requests made from January 1, 2022 onward, created the pioneer gold card mandate: a 90% approval rate on a given service over six months earns a continuous exemption. Per the Texas Medical Association, the law applies to TDI-regulated HMO, PPO, and EPO commercial plans covering roughly 20% of Texans, and it does not apply to Medicaid or CHIP, a scope limitation that gets lost in a lot of the national coverage of the law. More recently, HB 3812, passed in 2025 and effective September 1, 2025, extends the evaluation period to a full year of requests after stakeholders found the original six-month window too short for many independent and small-practice providers to actually reach the threshold for a given service, which is itself an instructive lesson in how gold carding thresholds can differently affect each provider. Even further, a separate law – SB 815 – prohibits insurers from letting AI issue adverse prior authorization determinations, adding Texas to the AI-oversight column as well as the gold carding one. (Texas Medical Association; MultiState; TDI)
Utah's SB 319, signed by Governor Cox in March 2026, reads like a checklist of the reforms that have proven popular elsewhere: it shortens timelines to 72 hours for urgent requests and 7 calendar days for standard ones, makes a single prior authorization valid for 12 months for chronic conditions including cancer, prohibits retroactive denials of previously approved services, requires transparent disclosure when AI is used in review or decisions, and mandates prior authorization-statistics reporting to the state Insurance Department. Utah essentially waited, watched what worked in earlier-moving states, and then passed a single bill combining the pieces, which could very well be the same move some of the other slower-moving states are making. (Utah Legislature; ASCO)
Vermont studied gold carding practicality through Act 140 of 2020 before fully committing to it, requiring larger insurers to run gold card pilots, a far more cautious approach than Texas'. A 2024 law requires plans to honor approvals for ongoing chronic medications for five years (particularly notable in a sea of 6-12 month validity provisions) and requires 24-hour response timelines for urgent requests. (AMA; Vermont Legislature; Vermont Medical Society)
Virginia built out an electronic prior authorization framework through 2023's SB 1261/HB 1471, requiring payers to build a working online ePA process by July 1, 2025. HB 736, signed by Governor Spanberger in April 2026 and going into effect on January 1, 2027, is the more targeted follow-up, setting a minimum validity period for prescription drugs – at least six months for an initial approval and 12 months for continued treatment. This opens a direct and practical window to target specific pain points and groups forced to repeat authorization cycles frequently, and Virginia joins the list of states treating pharmacy as an individual issue with individual pain points rather than grouping it in a blanket medical-benefit bill. (Georgetown CHIR; VA Governor)
Washington has set some of the fastest electronic prior authorization timelines in the country – an aggressive but interesting move. E2SHB 1357, codified at RCW 48.43.830 and effective for plans issued or renewed on or after January 1, 2024, sets a timeline of 3 calendar days for standard electronic requests and just 1 day for urgent and expedited ones, with non-electronic requests decided within 5 calendar days standard and 2 calendar days expedited. Compared to the standard 7-day timelines elsewhere in the country, timely decisions are clearly Washington's biggest priority and main administrative concern. Their approach is one that only works because the law also requires the electronic infrastructure and clinical-peer reviewers to support it. ESSB 5395, signed March 23, 2026, adds that AI cannot be the sole means of denying, delaying, or modifying care. Earlier 2021 laws already barred prior authorization for initial substance-use-disorder withdrawal-management visits. (WA OIC; wa-law.org; RCW 48.43.830; Becker's)
West Virginia's SB 267, passed in 2023, requires electronic prior authorization submissions through a state-run portal, defines "episode of care" for the first time in statute, and shortens prior authorization decision timelines, building on an existing gold carding program. SB 833, passed in 2025, clarified that prescription drugs are excluded from the gold card program, a narrowing move that runs in the opposite direction from what Arkansas did with its own program in the same year. That divergence is a useful reminder that gold carding as a concept isn't a one-size-fits-all; some states are expanding it, others are pulling it back. (WV Insurance Bulletin 24-03; WV Insurance Bulletin 25-03; MultiState)
Wisconsin has decision-timeframe provisions written into existing law, but no comprehensive reform has been enacted in the last five years, leaving it, like several Midwestern neighbors, largely untouched by the recent legislative wave. (AMA prior authorization State Law Chart)
Wyoming's HB 14, signed by Governor Gordon in 2024, created a gold card program excluding prescription drugs (effective January 1, 2026). For one of the smallest states by population to pass a gold card program says something about how far gold carding has spread beyond the large states that first drew national attention to it. (AMA; ASCO)
Bill numbers, effective dates, and provisions above reflect available public reporting as of this writing. Prior authorization law changes each legislative session – confirm current requirements against your state's official legislature or insurance department site before making operational decisions.
What is a prior authorization gold-carding law, and how do providers qualify?
A gold-carding law exempts a provider from routine prior authorization for a specific service once they've demonstrated a high approval rate on that service. Texas passed the first such law in 2021; Arkansas, Colorado, Kentucky, Louisiana, Michigan, West Virginia, and Wyoming have since passed variants, and California passed a plan-level version in 2025. Qualification typically depends on:
Does federal law set time limits for prior authorization decisions? Yes, but only for specific plan types. CMS-0057-F requires Medicare Advantage, Medicaid, and CHIP to affirm or deny standard requests within seven calendar days and expedited requests within 72 hours, effective January 1, 2026; federal-exchange Qualified Health Plans are excluded from these timeframes. It doesn't apply to commercial group plans, self-funded ERISA plans, or prescription drugs, which is where state law fills the gap.
Which states have the strictest prior authorization decision deadlines?
The fastest state laws require decisions within 24 hours for urgent requests and as little as 48 hours for non-urgent requests:
The most common reform sets 7 calendar days for standard requests and 72 hours for urgent requests, matching the federal standard under CMS-0057-F.
How is artificial intelligence regulated in prior authorization decisions? A growing number of states – including California, Georgia, Nebraska, Texas, and Utah – have passed laws requiring that a licensed physician or clinician either must make or must review any adverse determination, rather than allowing an algorithm to deny a request without human review. Some of these laws also require insurers to disclose when AI was used in the review process.
Does a gold card exempt a provider from all prior authorization requirements? No. Gold carding exemptions are typically narrow: they apply to a single specific service or procedure code, often exclude Medicaid and Medicaid managed care, frequently exclude prescription drugs, and can be revoked if a provider's approval rate drops below the threshold on subsequent review.
For a deeper look at how federal interoperability rules like CMS-0057-F intersect with state requirements, see our Regulation & Compliance guide.
Why Prior Authorization Technology is Harder Than It Looks
Prior Authorization
Technology
Provider
Cost Savings with Intelligent Prior Authorization Analytics
Provider
Prior Authorization
Technology
CMS-0057 Checklist: What Health Systems Should Do Now to Prepare for the 2027 API Deadline
Prior Authorization
Policy
Provider
