CO-39: Authorization request resulted in service denial

The payer is telling you that when you or the referring provider asked for prior authorization, the request was reviewed and not approved for the billed service or level of care. They are not saying authorization was missing, they are saying they made a pre-service decision to deny coverage for what you provided. Mechanically, the claim hits an edit that looks at the authorization record and finds a prior auth request that was explicitly denied for that code, diagnosis, date span, or level of care. The payer assigns CO-39 and treats the charge as nonpayable under the contract, so the balance is not billable to the patient unless a successful appeal changes the decision.

In behavioral health, CO-39 often follows a denied pre-service review for higher levels of care like PHP, IOP, residential, or detox. For example, your clinician requested PHP, the payer said treatment could be done in traditional outpatient, you admitted to PHP anyway, and the PHP per diem comes back with CO-39. You also see this when utilization management denies a continued stay request for residential or detox, but the facility keeps the client several more days at the same level. Those denied days will often deny under CO-39 because the concurrent review decision on file is a denial, not a simple gap in authorization. Telehealth and SUD programs run into this when they request auth for in-person IOP, get denied, shift the plan to telehealth IOP without a new approval, then bill the original IOP codes with a 95 modifier. The payer points back to the original denial decision and applies CO-39 to the telehealth days if the prior denial clearly stated that level or frequency was not authorized.

• Confirm in the payer portal or UM notes that there was a prior auth request for the same service and that the decision on record is a denial, not a missing auth.
• Compare the denied service lines to the authorization decision: level of care, dates, CPT/HCPCS codes, units, and diagnosis to see if the claim matches the denied request or if there is a mismatch you can correct.
• If the service actually matched an approved but different authorization (for another level of care, telehealth vs in person, or a different date span), correct the claim to the approved details and submit a corrected claim that references the valid auth number.
• If the payer denied the auth based on medical necessity but your documentation supports the level of care, prepare a medical necessity appeal with clinical notes, ASAM or LOCUS scoring, and any state criteria that support coverage for those dates.
• If the payer denied higher level of care and only approved a lower level (for example PHP denied but IOP approved), consider rebilling appropriate days under the covered level of care if clinically and contractually allowed, with corrected codes and modifiers.
• If review confirms the auth denial was valid and cannot be overturned, adjust off the CO-39 balance as a contractual write off and record the denial reason for internal reporting.

• During intake and concurrent review, document the exact level of care, frequency, and setting that the payer approved, and share it clearly with clinical and scheduling staff.
• Use an RCM or spreadsheet tracker that links each authorization number to specific CPT/HCPCS codes, modifiers, revenue codes, and date ranges, and have billing staff check this before submitting UB-04 or CMS-1500 claims.
• Set up internal UM workflows so that when a payer issues a denial on a pre-cert or continued-stay request, admissions and billing are immediately notified and can stop or change the level of care before new noncovered days accumulate.
• Configure claim scrubber edits to flag charges that do not match the approved authorization profile for that payer, including level of care, telehealth vs in person, and allowed units per week.