Prior authorization

Prior authorization (PA) is the PBM or health plan process that requires the prescriber to obtain pre-dispensing approval for certain drugs before the pharmacy can dispense and be reimbursed. PA criteria vary by plan and drug class, with common categories including step therapy, quantity limits, age restrictions, diagnosis-based eligibility, and clinical-evidence requirements. Electronic prior authorization (ePA) platforms like CoverMyMeds and Surescripts route requests electronically; the audit trail those platforms generate is central to PA audit defense.

How prior authorization works

The prescriber initiates the PA request through ePA, fax, or phone to the PBM or health plan. The plan reviews the clinical criteria, approves or denies, and (where approved) issues an authorization number and effective dates. The pharmacy receives the authorization and dispenses within the approval window. PBM audits commonly review the authorization record on dispensed claims: was a PA in place at dispensing, was the dispensed drug within the PA scope, was the dispensed quantity within the PA limits, and was the dispense within the PA effective dates.

The CoverMyMeds platform (McKesson-owned) is the dominant ePA platform and has been the focus of significant 2024 to 2026 PBM enforcement, most prominently in the Express Scripts CoverMyMeds account-level FWA crackdown documented in HLA's CoverMyMeds Defense practice page.

When prior authorization applies

PA applies to drug classes the PBM or plan has designated. Common PA categories include specialty drugs, oncology, biologics, GLP-1 receptor agonists, opioids, mental health medications, and certain branded drugs where a generic exists. The PA framework runs alongside DAW codes and step therapy rules. ePA records are kept by the platform and the prescriber and pharmacy, with retention periods typically running 6 to 10 years.

The pharmacy's exposure under PA audit findings

Where the audit identifies a dispensed claim without a valid PA, the recoupment is typically the full claim reimbursement. Where the audit identifies PA scope violations (wrong drug, wrong quantity, wrong dates), the recoupment can also be substantial. Cross-PBM exposure runs through the CoverMyMeds platform: a pattern flagged on one PBM contract can support concurrent audits across multiple PBMs that share the platform. The defense framework focuses on the ePA audit trail reconstruction, the platform-level account compliance posture, and the methodology challenge where extrapolation scales the dollar exposure.

Related terms

• PBM audit The audit framework that incorporates PA verification.
• DAW The brand-versus-generic code framework that often runs alongside PA approvals.
• REMS The FDA safety program framework that often requires PA-equivalent dispensing protocols.
• Recoupment The dollar demand that follows when PA findings become final.

See also

• Practice area
  CoverMyMeds Defense

  Defense framework for CoverMyMeds-platform ePA account audits and the Express Scripts FWA crackdown.

• Practice area
  PBM Audit Defense

  PBM audit defense framework including PA verification findings response.