Service authorization

What service authorization means

Service authorization is the payer's written or electronic confirmation that a particular service, episode, or level of care is approved. It ties together diagnosis, service type, provider, date span, and an allowed number of units or days.

In behavioral health, service authorization usually references clinical criteria such as ASAM, LOCUS, or state Medicaid guidelines. It often arrives as an approval letter or portal entry that lists an authorization number, a start and end date, approved units or days, and any requirements for concurrent or continued-stay review.

Service authorization is different from general eligibility. A member can be eligible for behavioral health benefits and still need a specific service authorization before the payer will pay for residential, PHP, IOP, or intensive outpatient therapy.

Why service authorization matters operationally

Operationally, service authorization sets the ceiling for what you can bill and expect to collect. Claims that exceed the authorized date span, units, or level of care commonly deny, even if every code and modifier is perfect.

For revenue cycle teams, service authorization touches several points:

• Intake and benefits verification workflows
• Scheduling and bed management, especially for residential and withdrawal management
• Daily or weekly concurrent review submissions
• Claim-scrubbing rules that stop un-authorized units from going out the door

Missed or mismatched service authorization shows up months later as CO-197 or CO-50 denials, write-offs, and long AR cycles. For longer per-diem episodes, even one missed continued-stay approval can zero out payment for multiple days.

How to read and use a service authorization

A usable service authorization has a few key fields you should always confirm and record in your system:

• Member info: name and ID that match your registration
• Provider info: facility or group NPI, and sometimes rendering provider, that must match the billing provider setup
• Authorization number: required on many claims or appeal submissions
• Service scope: level of care, CPT or HCPCS codes, and sometimes revenue codes or place of service
• Quantity limits: units, days, or visits, and the date span they apply to
• Conditions: requirements for concurrent review, documentation, or step-down care

RCM and utilization review should agree on how authorized units map to billing. For example, does the authorization for "14 days residential" mean 14 calendar days from admit, or 14 billable midnights that must fall inside the exact date span on the letter. Clean workflows translate the payer's authorization language into concrete rules in your EHR, scheduling, and claim-scrubbing tools.

• Letting residential or PHP care continue past the end date on the authorization without securing a continued-stay review, then sending claims for those extra days that all deny with CO-197.
• Assuming an authorization for a level of care (for example, ASAM 3.5 residential) automatically covers a lower or higher level (such as PHP or IOP), then billing those step-down days without a new or modified authorization.
• Not recording units on the authorization record, so the system allows unlimited IOP or outpatient sessions and the payer later denies everything after visit 20 as "exceeds authorization."
• Using the correct authorization number but billing under the wrong billing provider or NPI, especially when a separate NPI exists for your residential program vs your outpatient clinic.
• Relying on a verbal authorization from a payer rep without getting written confirmation or a portal entry, which leaves you with no documentation when the claim denies and you try to appeal.

Behavioral health payers often carve out mental health and substance use benefits to specialized vendors. That means service authorization may live in a completely different portal from medical, even for the same member and plan. If your intake team checks only the medical portal, you can easily miss that residential or IOP requires a separate authorization from the behavioral health administrator.

State Medicaid and Medicaid managed care plans usually require service authorization for high-acuity levels of care, such as withdrawal management, ASAM 3.3 to 3.7 residential, and PHP or IOP. Many of these authorizations start with a short initial approval and require concurrent or continued-stay reviews every few days. If UR misses a review deadline, days after that gap often deny, even if clinical need is clear.

Behavioral health episodes are long and per-diem based, which magnifies service authorization errors. A mismatch of just 3 days on a residential authorization can remove thousands of dollars from a single claim. For group and family therapies, payers may also cap the number of sessions per week or per year in the authorization, so failure to track those limits leads to CO-197 and CO-50 denials that are hard to overturn.

Level-of-care criteria such as ASAM and LOCUS are often written directly into the approval. That links service authorization to medical necessity. If your documentation and diagnostic coding do not support the approved level, a payer may shorten the authorized span or downgrade the level of care mid-episode during concurrent review.

AI can help with service authorization by reading approval letters and portal screenshots, extracting key fields like dates, units, level of care, and requirements, and pushing that data into your practice management or EHR system. An authorization-focused agent can also compare scheduled services against current authorizations in near real time, flag visits that will exceed units, and alert UR when a continued-stay or concurrent review is due.

Supabill runs agents that sit between intake, utilization review, and billing. A benefits-verification and authorization agent can store payer-specific rules about when authorization is required, check eligibility feeds for clues about carve-out vendors, and match approvals to upcoming services so un-authorized days do not hit the 837. A denials agent can read every 835, spot CO-197 or N130 patterns linked to expired or missing authorizations, and feed that detail back to your team. Humans still own clinical judgment, peer-to-peer calls, negotiating exceptions, and deciding when to take on the risk of treating ahead of authorization.

Is service authorization the same as prior authorization?

Service authorization is a broader term. It can include prior authorization obtained before treatment, plus concurrent or continued-stay approvals during an ongoing episode. Many payers use the words interchangeably, but behavioral health programs often see an initial prior auth followed by multiple service authorization updates over the stay.

Does a service authorization guarantee payment?

No. Service authorization confirms the service is approved within a certain scope, but claims can still deny for issues like eligibility lapses, coding errors, missing documentation, or billing outside the authorized dates or units. Treat an authorization as a necessary condition for payment, not a guarantee.

Where should the authorization number appear on a claim?

For professional claims, the authorization or referral number typically goes in the appropriate field tied to the payer's requirements, such as Box 23 on the CMS-1500, and on the corresponding loop and segment in the 837. Facility claims on the UB-04 also have specific locator fields for authorization numbers. Check each payer's billing guide.

What happens if services exceed the authorized units or dates?

Most payers deny units or days beyond the authorization as not authorized, often with CO-197 or a related remark code. Sometimes you can secure a retroactive authorization or extension, but that is not guaranteed and often requires detailed clinical documentation and medical director review.

How often should behavioral health programs review active service authorizations?

For higher levels of care like residential, PHP, and IOP, daily or at least every few days is common, tied to the payer's concurrent review schedule. For lower acuity outpatient care, a weekly or monthly review of expiring or near-exhausted authorizations is usually enough if scheduling and billing systems are checking remaining units automatically.

• CMS: Internet-Only Manuals (IOMs)