The US Government Accountability Office (GAO) recently released a report on the Centers for Medicare and Medicaid Services (CMS)’s oversight of prior authorization criteria for behavioral health services (BHS) by Medicare Advantage (MA) organizations (MAOs).
The report merely recommends that CMS target BHS in its program audit prior authorization denial reviews but does not otherwise attempt to reach conclusions about MAOs’ compliance with MA restrictions on the use of prior authorization.
Nevertheless, the May 2025 report still offers insight into the state of prior authorization for BHS within the MA program. Of course, it is worth noting that the sample size reviewed by GAO included only eight MAOs.
Prior authorization determinations
As background, the traditional fee-for-service Medicare program rarely imposes prior authorization requirements. Prior authorization and other utilization management (eg, concurrent review) are much more common within the MA program as within any managed care arrangement.
An MAO’s use of prior authorization is subject to specific MA rules that apply to any coverage determination made by an MAO. At a high level, among other rules, an MAO’s coverage determination must comply with:
- CMS’s national coverage determinations (NCDs)
- General coverage and benefit conditions included in traditional Medicare laws, unless superseded by laws applicable to MA plans
- Written coverage decisions of local Medicare contractors with jurisdiction for claims in the geographic area in which services are covered under the MA plan (referred to as “LCDs”), subject to certain flexibilities, and
- Publicly accessible internal coverage criteria that meet specific requirements.
It is the last category that the GAO specifically encourages CMS to audit. An MAO may only apply its own internal coverage criteria when coverage criteria are not fully established in applicable Medicare statutes, regulations, NCDs, or LCDs. Prior authorizations are also required to be based on current evidence from widely used treatment guidelines or clinical literature.
GAO’s observations
For its review of prior authorization for BHS, GAO observed that the sampled MAOs most often imposed prior authorization on BSH, including intensive behavioral interventions, for higher levels of care and specialized treatment, such as inpatient levels of care and sometimes (but not as often) for partial hospitalization.
Likewise, most of these MAOs required prior authorization for certain specialized services, such as transcranial magnetic stimulation. None required prior authorization for in-network lower intensity services, such as outpatient counseling or psychotherapy visits.
GAO focused particularly on five types of BHS (ie, acute inpatient mental health, inpatient alcohol detoxification, opioid treatment programs, outpatient mental health visits, and transcranial magnetic stimulation) due to the availability of criteria and variation in service types and levels of care.
Based on the limited sample of MAOs, the report made several observations that both MAOs and BHS providers can find useful as they navigate prior authorization requests for BHS:
- Not all sampled MAOs had easily located or publicly accessible internal coverage criteria. GAO could not find any of the policies for a few of the sampled MAOs. The criteria for others were found to be posted in a wide range of locations, such as on an MAO website, a third-party website, or even websites that provided broader information on mental health and well-being.
- Prior CMS audits found that some MAOs reported that criteria were not publicly available due to reasons related to third-party developers, such as contractual restrictions.
- Those CMS audits also found that some MAOs reported that they did not post certain criteria because either they did not realize that the criteria were considered “internal” when developed by third parties, or the criteria had been in use for many years and were assumed to be Medicare coverage rules.
- Not all sampled MAOs’ criteria clearly identified their applicability to certain products/markets, such as MA, Medicaid managed care, or other plan types.
- Not all sampled MAOs’ criteria contained all required components, such as a summary of evidence considered in developing the criteria, sources of evidence, and an explanation of the rationale supporting adoption of the criteria.
- All the sampled MAOs’ criteria (to the extent available for GAO review) contained some deficiency under the MA requirements.
- Many of the MAOs sourced their internal coverage criteria from third parties, including criteria vendors, professional societies, and government agencies.
- Coverage determinations vary greatly due to the broad variation (and gaps) in baseline Medicare coverage rules, particularly when jurisdictions lack LCDs or when multiple jurisdictions have LCDs with material differences. For example, GAO only identified seven states with an LCD for opioid treatment programs.
Key takeaways
To the extent these findings can be extrapolated to the larger MA market, they provide potential warnings signs for MAOs. The MA rules expressly allow and support the use of internal coverage criteria but impose strict guiderails and conditions that must be followed. Deficiencies in the content, availability, and application of the criteria could leave an MAO’s coverage determinations subject to challenge. These observations may also apply to Medicaid managed care organizations (MCOs) that use similar prior authorization frameworks.
Given that CMS has been auditing, issuing guidance, and noting its intent to engage in future rulemaking on internal coverage criteria, compliance is critical. Proper implementation requires not only clinical input but also a careful and thorough legal assessment.
On the provider side, the GAO report emphasizes that the process for identifying the applicable internal coverage criteria of an MAO can still be a challenge. Particularly for new entrants into the behavioral health market who do not have long-standing, working relationships with their MAOs, providers are encouraged to not take for granted that their services will receive prior authorization or otherwise be covered (even if covered by traditional Medicare).
As observed by GAO, the flexibility permitted by the MA coverage rules allows MAOs to supplement or fill gaps in Medicare coverage criteria. For example, what works to get covered in one jurisdiction with a helpful LCD might not work in a nearby jurisdiction that lacks an LCD. Likewise, relying on an MAO’s posted criteria for a particular BHS may also result in denials if those criteria were incorrectly believed to apply to the MA products. This is a particular challenge for providers who serve patients across multiple payer types.
When developing services and a reimbursement strategy, BHS providers are encouraged to be thorough in their efforts to locate, process, and operate under the correct MA coverage criteria. There may also be opportunities for appeal of denials based on prior authorization criteria that deviates from MA requirements.
Conclusion
The GAO report shows that prior authorization in MA presents difficulties for both MAOs and providers and will likely continue to do so as this area evolves through CMS oversight and new rulemaking. Carefully navigating the complex regulatory framework for prior authorization can help mitigate legal and business risk.
[View source.]
