Referral vs prior authorization

What a referral is vs what prior authorization is

A referral is a request from a referring provider, often a primary-care physician, that directs a patient to a specialist, program, or facility. It satisfies a network and care-coordination rule for certain plans, especially HMO products. The referring provider sends the referral to the payer, then the patient or specialist uses that referral when scheduling and billing.

Prior authorization is different. It is payer approval for a specific service, CPT or HCPCS range, level of care, or number of units or days before treatment. The payer issues an authorization number and often a date span and unit limit. You can have a referral without prior auth, prior auth without a referral, both, or neither, depending on the product.

In behavioral health, referrals often come from PCPs, hospitals, courts, schools, or EAPs, but payers only care about referrals when the plan design requires one. Prior authorization is far more common in BH and usually controls residential, PHP, IOP, MAT, and many SUD services.

Why the difference matters operationally

When you miss a referral, you can have a clean claim from a coding perspective that still pays zero because the member did not follow the plan's gatekeeper rules. These denials often are not appealable if the plan language is strict. That turns into pure write-off or patient balance risk.

When you miss prior authorization, or you treat beyond the authorized span or units, you get CO-197 type denials for all services past the approved limits. For per-diem programs like residential or PHP, a few days of missed concurrent auth can equal tens of thousands of dollars that are very hard to recover.

Operationally, your front desk or intake team must know for every payer and product:

• Is a referral required, and from what provider type.
• Is prior auth required, and at what trigger (first day, after 3 days, after assessment only, etc.).
• Whether both are required for certain services, such as psychiatry with an HMO.

If you do not separate referral vs prior auth rules in your workflow and EHR, you will see preventable CO-197 and CO-16 denials, high write-offs, and unhappy clinicians whose work does not get paid.

How referral and prior authorization are used and tracked

Referrals usually live in the practice management system as a number tied to a specific referring provider and date range. For some payers, the referral number must go in a specific field on the claim, and the referring NPI and taxonomy must match what the payer has on file. Referrals are most common on commercial HMO, marketplace HMO, and some Medicaid managed care plans.

Prior authorizations are tracked as authorization records with:

• Authorization number.
• Start and end dates.
• Approved services, codes, or level of care.
• Approved units or days.

Your utilization review or authorization team needs to monitor census and schedules against those auth limits, especially for long BH episodes. Billing then must link the correct auth to each claim and confirm that dates of service fall fully within the span and do not exceed approved units.

In reports and denials worklists, separate:

• Missing or invalid referral denials.
• Missing or exhausted prior auth denials.

They have different root causes, different appeal strategies, and different training fixes. A benefits-verification workflow that treats them as one bucket creates noise, not insight.

• Assuming a prior authorization removes the need for a referral on HMO plans, so you secure an auth for IOP but never obtain the PCP referral and the entire IOP episode denies for no gatekeeper referral.
• Only checking for prior auth on high-dollar residential and ignoring that psychiatry visits under the same HMO plan require a PCP referral, which leads to a pattern of CO-197 or CO-16 denials on every med management follow up.
• Not tracking referral requirements separately in benefits verification, so intake documents that 'auth not required' for outpatient therapy and misses that the plan still requires a PCP referral to see any behavioral-health specialist.
• Letting concurrent-review dates extend past the original prior auth span without updating the authorization record in the EHR, so claims for days 15 to 21 of residential bill under the old auth and deny as if no prior auth exists.
• Failing to train staff on payer-specific rules for who can refer to behavioral health, for example, assuming a school counselor's referral satisfies an HMO requirement that specifically calls for a physician or NP referrer.

Behavioral health payers often split responsibilities between the medical plan and a separate behavioral-health or SUD carve-out. The medical plan may own the referral requirement, while the BH vendor manages prior auth and concurrent review. If your team only talks to one side, it is easy to obtain an auth from the BH vendor and still miss the PCP referral rule on the medical HMO product.

State Medicaid and Medicaid managed care add another layer. Many Medicaid BH benefits are open access for certain levels of care, so referrals are not required. At the same time, those same plans can have strict prior authorization and concurrent review rules for residential, PHP, IOP, withdrawal management, and some MAT services. The risk is assuming that "no referral" equals "no auth" and then discovering after 60 days of treatment that you only had an assessment-level auth.

Long per-diem episodes, such as residential or PHP, are controlled almost entirely through prior authorization and continued-stay or concurrent review, not referrals. A missed referral might block access or payment for the first visit with psychiatry, but a missed or lapsed prior auth can hit every single per-diem claim for weeks. For state-funded SUD programs, referrals from courts or social services do not always meet the payer's definition of a referral, so you must still confirm medical-plan rules.

For MAT and outpatient therapy, some commercial HMO and marketplace plans will allow self-referral to licensed therapists but still require a referral for psychiatry. That nuance has to be captured directly in your benefits-verification script or Supanote intake templates, or it will not show up on the claim.

AI can help by separating referral and prior auth rules in your front-end workflow instead of burying them in notes. A benefits-verification agent can read 270/271 eligibility responses, portal screenshots, and payer PDFs, then tag each plan with whether a referral is required, whether prior auth is required, and which services trigger which requirement. For existing denials, an AI denials agent can read every 835, classify CO-197, CO-16, and N130 denials into "missing referral" vs "missing or exhausted prior auth," and feed back payer- and product-specific patterns.

Supabill uses agents to hold payer rules and session history across eligibility checks, auth submissions, and denials. A claims-scrubbing agent can check each encounter against the stored referral and auth data and flag cases where a referral number or auth span is missing before submission. Humans still need to handle peer-to-peers, detailed appeal arguments, and negotiations with BH carve-out vendors, but AI can clear the noise, reduce preventable denials, and keep the team focused on the edge cases that truly need judgment.

Can a referral replace prior authorization for behavioral-health services?

No. A referral only satisfies the plan's rule about how the patient enters specialty care. Prior authorization is the payer's approval for specific services or days. You may need one, both, or neither, depending on the plan and service.

Who is responsible for getting the referral and who gets the prior authorization?

Typically, the primary-care or referring provider is responsible for initiating the referral, and the specialist or behavioral-health facility is responsible for obtaining prior authorization. In practice, your intake team should verify that both are in place before the first billable service.

Do Medicaid patients usually need referrals for behavioral-health care?

Many Medicaid programs allow self-referral for certain behavioral-health services, especially community mental health and SUD treatment, but rules vary by state and managed care plan. Always confirm referral and prior auth requirements during benefits verification, since some plans still require a PCP referral for psychiatry or higher levels of care.

Where should referral and prior authorization numbers go on the claim?

The referral information usually includes the referring provider NPI and may include a referral number, depending on payer instructions. The prior authorization number typically goes in the prior authorization field on the claim form, such as Box 23 on the CMS-1500, and in the corresponding EDI loop or segment. Check payer-specific billing guides to avoid placement errors.

Can I appeal a denial if I did not get the required referral?

Sometimes, but not always. Payers often treat missing referrals as a member responsibility tied to plan design, not a provider error, so appeals have limited success. You will have more use if you can show that the referring provider attempted to obtain the referral and the payer has a record problem.

• CMS: Internet-Only Manuals (IOMs)