Notes on payer behavior
CO-197 authorization denials: the three-way triage
CO-197 — precertification or authorization absent — reads as terminal. It is actually three different problems with three different plays, and the worst mistake is treating them all as appeals. Triage first.
Case one: the authorization exists
A large share of auth denials are clerical: the authorization was obtained but the claim didn't carry it, or carried it wrong. This is not an appeal — it is a corrected claim with the authorization number in the right field. Before resubmitting, verify the auth actually covers what was billed: the procedure code, the date-of-service range, the rendering provider, and the place of service. A mismatch on any one of the four fires the denial — and a wrong-or-missing auth number specifically is its own code (CARC 15), with the same data-fix play. Reserve the appeal letter for the case where the auth was valid, correctly submitted, and the payer misapplied it — then cite the payer's own confirmation number and date.
Case two: urgent or emergent care
Payers maintain retro-authorization exceptions for urgent and emergent services. The windows are payer- and plan-specific — some run around 30 days, some longer, and the documentation requirements differ — so this is a verify-per-plan step, not a number to assume. The play is a retro-auth request under the exception with the clinical justification attached, then resubmission. Speed matters more here than anywhere else in the denial queue.
Case three: the elective miss
Elective service, no authorization, no exception — the hardest branch. On commercial plans this is close to unwinnable, and the honest answer is usually process repair, not appeal cycles. The picture differs sharply by line of business: federal reviews have repeatedly found that a large majority of appealed Medicare Advantage denials are overturned (HHS OIG and KFF analyses put it around three-quarters or more). Same code, opposite odds — which is why the triage precedes the drafting.
The timeline lever
Authorization is one of the few denial types where the payer's own conduct is often attackable. Florida law (§627.42392) governs prior-authorization handling for Florida-regulated plans, and federal rule CMS-0057-F imposes decision deadlines — 72 hours expedited, 7 days standard — on Medicare Advantage, Medicaid, and marketplace plans as of 2026. Where the payer blew its own decision timeline, that fact belongs in the appeal.
The workers' comp exception is stronger than all of it. In Florida WC, the carrier must respond to an authorization request by the third business day — silence is authorization by operation of law, and it forfeits the carrier's medical-necessity contest (§440.13(3)). If your specialty treats work injuries, an unanswered auth request is a lever, not a limbo — details in the Florida WC note.
The sibling code: authorization exceeded
CARC 198 — the auth exists but the billed units or scope exceed it — gets its own order of operations: compare billed units, codes, and dates against the auth's approved scope; request an auth amendment first where the payer permits it; appeal already-rendered excess with the documentation of why it was necessary (intra-operative findings, staged care). A clerical mismatch between the billed and authorized code for the same procedure is a data fix, not a fight.
Who lives in this queue
Every auth-heavy specialty: pain management (injections, ablations), gastroenterology (advanced endoscopy), spine and orthopedic surgery, plastic surgery, dermatology (biologics), ENT and urology procedures. The mix of the three cases differs by specialty; the triage doesn't. And the clock always runs — appeal windows at Florida's payers range from about 120 days to a year, mapped in the working deadlines table.
Prevention: where this denial actually gets solved
Recovery work salvages cases one and two; the elective miss is only ever solved upstream. The workflow that ends it is verification at scheduling: confirm before the case that an authorization exists and that it matches the four fields the claim will carry — codes, dates, rendering provider, site — then re-verify whenever the plan changes at reverification or the procedure changes in planning. Practices that treat the auth as a yes/no checkbox keep generating case-one denials; practices that treat it as a four-field match mostly stop seeing this code at all.