CO-197 Denial Code (Prior Auth): Causes, Recovery Routes and 2026 Payer Rules

The CO-197 denial code is a claim adjustment reason code (CARC 197) that tells a provider the payer found no required precertification, authorization, notification or pre-treatment approval for the billed service. Group code CO makes the provider responsible, so the practice must correct, obtain retro approval for, appeal or write off the claim.

Review note: payer rules in this guide were checked against CMS, AMA and KFF publications available in October 2026. Prior authorization lists change often, sometimes quarterly, so confirm each payer’s current list before you rely on it.

The MRI was medically necessary, the notes were clean, and the claim still came back CO-197. That is the frustrating part of a prior authorization denial: the care was right, but the paperwork trail was broken somewhere between scheduling and billing. This guide shows how to tell CO-197 apart from the three codes it is confused with, how Medicare, Medicare Advantage, Medicaid and commercial rules differ in 2026, which recovery route fits each situation, and which metrics expose the leak. A 10-question readiness checklist near the end scores your current process.

CO-197 at a Glance: The Prior Auth Numbers That Matter

Ten figures frame almost every CO-197 conversation: six published rules, two survey findings and two practical targets. Table 1 lists them with their source type.

Prior authorization numbers billing teams should know

Metric	Practical target / range	Review frequency	Source type
Standard PA decision time (MA, Medicaid, CHIP)	7 calendar days, from January 1, 2026	Yearly	Published standard (a)
Expedited PA decision time (same payers)	72 hours, from January 1, 2026	Yearly	Published standard (a)
Medicare OPD prior auth decision	7 calendar days standard; 2 business days expedited	Yearly	Published standard (a)
Medicare OPD provisional affirmation validity	120 days from the decision date	Per case	Published standard (a)
MA transition period for new enrollees in active treatment	At least 90 days without new PA for that treatment	Yearly	Published standard (a)
Medicare redetermination filing window	120 days from receipt of the initial determination	Per case	Published standard (a)
Prior authorizations per physician per week	39, taking about 13 staff and physician hours	Context only	Survey (d): AMA, 2024 survey
MA prior auth denials appealed vs overturned	11.7% of denials appealed; 81.7% of those appeals overturned in part or full (2023)	Context only	Study (d): KFF, 2025
Authorization match rate	98% or higher of auth-required services matched before the date of service	Weekly	Practical target (c)
CO-197/198 denial rate by service line	Trending toward zero; investigate any month-over-month rise	Monthly	Practical target (c)

Source labels: (a) federal rule or CMS program guidance; (b) named benchmarking data provider (none used in this table); (c) practical target commonly used across industry sources, not a mandated standard; (d) named survey or study. Decision-time rules exclude prescription drug authorizations and do not bind most commercial plans.

What Triggers a CO-197 Denial?

A CO-197 denial is triggered when the payer’s system cannot link the billed service to an approved, unexpired authorization on file. That can mean no request was made, or it can mean a valid approval exists but does not match the claim.

The distinction matters because the fix is different. In billing audits, a common pattern is that many CO-197s involve an authorization the practice actually obtained, then lost through a wrong rendering provider, a changed CPT code or a missing number on the claim. Table 2 maps the usual causes.

Common CO-197 root causes and where to stop them

Root cause	What you usually find	Fix after the denial	Stop it at
No request submitted	Service not flagged as auth-required	Retro authorization or appeal	Scheduling
Authorization expired	Service date falls outside the approved window	Retro extension request or appeal	Day-before check
Code, site or provider mismatch	Approved CPT, location or NPI differs from the claim	Corrected claim, or auth update then appeal	Charge review
Auth number missing on claim	Approval on file, field left blank	Corrected claim with the number	Claim scrubber
Wrong payer approved it	Patient changed plans or coverage order	New request with the correct payer	Eligibility check

Source: common billing practice; root-cause shares vary by practice and payer mix.

Before you request anything, look at high-value procedures first. Imaging, infusions, surgeries and specialty drugs carry the largest dollars per denial, which is why the importance of pre-authorization in high-value procedures is greater than the claim count alone suggests.

Is It CO-197, CO-198, CO-15 or CO-39?

CO-197 means the authorization is absent, while CO-198 means it was exceeded, CO-15 means the authorization number is missing or invalid, and CO-39 means the payer denied the authorization when it was requested. Reading the exact CARC 197 text, plus any remark code, keeps the team from reworking the wrong problem.

Authorization-related CARCs compared

Code	X12 description (short form)	Typical scenario	First move
CARC 197	Precertification/authorization/notification/pre-treatment absent	No approval on file for this service	Search for an existing auth, then retro request
CARC 198	Precertification/authorization/notification/pre-treatment exceeded	Visits, units or dates beyond the approval	Request an extension or added units
CARC 15	Authorization number missing, invalid or not for these services or provider	Approval exists, claim data does not match	Correct the claim
CARC 39	Services denied at the time authorization/pre-certification was requested	Payer refused the request before service	Clinical appeal or peer-to-peer

Descriptions paraphrase the X12 CARC list; check the current list on your remittance software, since X12 updates codes several times a year.

CARC 39 overlaps with medical necessity disputes. When the payer says the service was not justified rather than not requested, the appeal argument looks more like a CO-50 medical necessity denial than a paperwork fix.

When the group code is PR instead of CO?

Some plans report the same reason under group code PR (patient responsibility), most often when a member’s plan makes the patient responsible for obtaining approval, such as out-of-network care. Bill the patient only when the remittance shows PR and the patient signed an appropriate financial agreement beforehand. A CO-197 balance stays with the practice.

How Do Prior Authorization Rules Differ by Payer in 2026?

Prior authorization rules now split into three tiers: Original Medicare requires approval for a short list of services, Medicare Advantage and Medicaid plans follow new federal decision deadlines, and commercial plans follow their own contracts. Table 4 summarizes the differences.

Prior authorization rules by payer type (2026)

Payer type	When PA applies	Decision timeframes	Source
Original Medicare (Part B, OPD)	Listed hospital outpatient services such as blepharoplasty, botulinum toxin, rhinoplasty, vein ablation, cervical fusion, spinal neurostimulators and facet joint interventions	7 calendar days standard; 2 business days expedited	CMS OPD program
Original Medicare, WISeR model states	Selected services in AZ, NJ, OH, OK, TX and WA, 2026–2031	Set by the model	CMS via Congressional Research Service, 2026
Medicare Advantage	Plan-defined lists; criteria must follow NCDs and LCDs	7 calendar days standard; 72 hours expedited	CMS-0057-F; CMS-4201-F
Medicaid and CHIP (FFS and managed care)	State and plan lists	7 calendar days standard; 72 hours expedited	CMS-0057-F
Commercial and employer plans	Contract and plan lists	Set by contract and state law	Payer manuals

Decision timeframes in this table exclude drug authorizations. Check the CMS program page and each plan’s current list before scheduling.

Original Medicare: a short list with hard consequences

Under the CMS prior authorization program for hospital outpatient department services, a hospital OPD claim for a listed service without a provisional affirmation is denied. CMS’s OPD FAQ adds that related professional and anesthesia claims are denied too, so a missed hospital request can deny the surgeon’s claim as well. The hospital must place the unique tracking number (UTN) on its claim. Those denials are initial determinations, so the normal Medicare appeal process applies.

Medicare Advantage and Medicaid: new federal clocks

The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) requires Medicare Advantage, Medicaid and CHIP plans to decide standard requests within 7 calendar days and expedited requests within 72 hours from January 1, 2026. Payers covered by the rule must also give a specific reason when they deny a request. A Prior Authorization API follows on January 1, 2027.

For Medicare Advantage, the 2024 MA final rule (CMS-4201-F) adds that an approved authorization for a course of treatment stays valid as long as medically necessary, and that a new enrollee already in treatment gets at least a 90-day transition period. Cite both rules in appeals when a plan denies continuing care.

Commercial plans and emergencies

Commercial plans set their own lists, and those lists change often. A payer-specific authorization list, like the ones in our Aetna billing playbook, should be checked at scheduling rather than at billing. One federal floor helps: under the No Surprises Act, group and individual health plans must cover emergency services without imposing prior authorization. Document the emergency clearly when a payer applies CO-197 to emergency care.

What Should You Do in the First 48 Hours After a CO-197?

Work a new CO-197 within two business days by confirming whether an authorization exists, then choosing between a corrected claim, a retro authorization request or an appeal. Speed matters because many retro authorization windows are short and differ by payer.

A six-step triage for every CO-197

• Read the remittance line: group code, CARC, remark codes and the service, units and dates the payer used.
• Search the practice’s authorization log and the payer portal for any approval tied to this patient and date.
• Compare the approval with the claim: CPT/HCPCS code, units, site of service, rendering NPI and date range.
• If the approval matches, submit a corrected claim with the authorization number (frequency code 7 on electronic claims).
• If no approval exists, check the payer manual for retro authorization rules and request it with clinical notes.
• If retro authorization is refused or unavailable, appeal inside the payer’s window and log the root cause.

Route 1: Corrected claim with the authorization number

Use a corrected claim when a valid approval covers the service and only the claim data was wrong. This is the fastest recovery route and usually needs no clinical review.

Route 2: Retro authorization

Request retro authorization when the service was urgent, the patient’s coverage was unknown at the time, or the plan’s manual allows late requests. Windows vary widely, from a few business days to longer, so check the plan’s provider manual before assuming the door is open.

Route 3: Appeal

Appeal when retro approval is refused but the service met the plan’s criteria, or when the denial ignored an exception such as an emergency. A focused claims appeal letter states the service date, the authorization attempt or exception, and the clinical criteria met.

What a strong prior auth appeal packet contains?

• The remittance and denial letter, with the CARC and remark codes highlighted.
• Proof of any authorization attempt: portal screenshots, fax confirmations, call reference numbers.
• Clinical notes showing the plan’s published criteria were met.
• The rule you rely on, such as the MA continuity-of-care requirement or the emergency services exemption.

Persistence pays in this category. KFF’s analysis of 2023 Medicare Advantage data found that only 11.7% of denied prior authorization requests were appealed, yet 81.7% of those appeals were overturned in part or in full. Those figures cover pre-service requests, not claim denials, but they show how often a documented challenge succeeds.

How Can Practices Stop CO-197 Denials Before the Claim Goes Out?

Practices stop CO-197 denials by treating the authorization as part of the claim from the moment a service is ordered, with six checkpoints between order and billing. Each checkpoint has an owner and a deadline.

• Order: capture the planned CPT/HCPCS code, site and rendering provider at the time of order.
• Check: confirm whether this payer requires approval for that exact code and site, using the current list.
• Submit: send the request at scheduling, at least 7 to 14 calendar days before an elective service when possible.
• Track: follow pending requests daily and escalate any request near the payer’s decision deadline.
• Match: the day before service, compare the approval with the scheduled code, units, site, provider and dates.
• Bill: place the authorization number on the claim and let the claim scrubber stop any auth-required line without one.

The submit lead time is a practical target, not a rule: with a 7-calendar-day standard decision clock, requests sent three days ahead leave no margin. Our team often sees the match step skipped when a surgeon changes the planned procedure in the operating room. Build a same-day authorization update into the charge review for every surgical case where the billed code differs from the scheduled one.

Front-desk timing is the other lever. Tie the authorization check to eligibility verification and patient-pay steps, and place both inside your front-end RCM workflow from check-in to claim submission when one person handles scheduling and registration. When the request volume outgrows the team, a dedicated prior authorization service can take over requests and tracking.

Which Prior Authorization Metrics Show Where Revenue Is Leaking?

Three metrics show where authorization revenue leaks: the authorization match rate, the CO-197/198 denial rate by service line and the recovery yield on denied dollars. Each needs only the authorization log and the remittance file.

Authorization match rate

Formula: Authorization match rate = Auth-required services with a matching, unexpired approval before the service ÷ All auth-required services × 100.

Illustrative scenario (not an actual client record): a practice performs 1,240 auth-required services in a quarter, and 1,180 have a matching approval on file before the service date. Match rate = 1,180 ÷ 1,240 × 100 = 95.2%, below a practical target of 98% or higher. The 60 unmatched services are the CO-197 pipeline for next month.

Denial rate by service line

Formula: CO-197/198 denial rate = Claims denied with CARC 197 or 198 ÷ Auth-required claims submitted × 100, calculated per service line.

Illustrative authorization denials by service line (one quarter)

Service line	Auth-required claims	CO-197/198 denials	Denial rate	Denied dollars
Advanced imaging	420	5	1.2%	$1,550
Physical and occupational therapy	640	44	6.9%	$4,180
Injections and specialty drugs	180	3	1.7%	$4,350
Total / blended	1,240	52	4.2%	$10,080

Illustrative: figures are invented to show the method. Actual rates vary by specialty, payer mix and plan rules.

The blended rate is 52 ÷ 1,240 = 4.2%, which may not trigger alarm. The therapy line runs at 6.9%, mostly CARC 198 visit overruns, while imaging sits near 1%. A practice-wide fix such as more front-desk training would miss the real problem: therapy visit counts are not being tracked against approved visits.

Recovery yield on denied dollars

Formula: Recovery yield = Dollars recovered through corrected claims, retro authorization or appeal ÷ Dollars denied × 100.

In the same illustrative quarter, the practice recovers $1,240 of imaging denials, $950 of therapy denials and $2,900 of drug denials. Recovery yield = $5,090 ÷ $10,080 × 100 = 50.5%. Therapy has the most denials but the lowest yield, while three drug denials hold 43% of denied dollars, so the work queue should be sorted by dollars as well as counts.

Tracking these numbers monthly is easier with a simple denial dashboard; our guide to how data analytics can reduce claim denials covers the reporting setup.

Reading Prior Auth Metrics Without Misleading Yourself

Compare each prior authorization metric with the same service line, payer and period, because a single blended rate can look healthy while one segment fails.

• Separate CARC 197, 198 and 15; they come from different process steps.
• Compare Medicare Advantage plans with each other, not with Original Medicare, which requires far fewer approvals.
• Treat a one-month spike as a signal to check for a payer list change before blaming staff.

How Quickly Can a Practice Cut Authorization Denials?

Most practices see fewer new CO-197 denials within one to two billing cycles once the match step is in place, though full results take longer. These are planning ranges, not guarantees:

• 2 to 4 weeks: build payer authorization lists for your top codes and add a scrubber edit for missing authorization numbers.
• 30 to 60 days: match rate rises as day-before checks become routine; CARC 15 denials fall first.
• 60 to 120 days: CO-197 and CO-198 rates settle by service line as visit tracking and retro processes mature.

Timing depends on payer mix, specialty and how many plans change their lists during the period.

Five Errors That Turn Approvals Into CO-197 Denials

• Checking the list once a year. Recheck payer authorization lists at least quarterly, and whenever a payer bulletin announces changes.
• Authorizing the order, not the procedure. Update the authorization the same day when the performed code differs from the approved one.
• Ignoring visit counts. Track used versus approved visits for therapy and recurring services, and request extensions before the last approved visit.
• Leaving the number off the claim. Add a scrubber edit that holds any auth-required line without an authorization number.
• Billing the patient. Keep CO-197 balances off patient statements; pursue PR only when the remittance shows PR.

Key Takeaways

• CO-197 means no valid authorization was on file; CO-198 means it was exceeded; CO-15 means the number or match failed.
• From January 1, 2026, MA, Medicaid and CHIP plans must decide standard requests within 7 calendar days and expedited ones within 72 hours.
• Original Medicare requires approval for listed OPD services and WISeR model services in six states.
• Practical targets: authorization match rate of 98% or higher, and CO-197/198 rates trending toward zero by service line.
• Recover with a corrected claim, retro authorization or an appeal, in that order, inside each payer’s window.

Prior Authorization Readiness Checklist

Answer yes or no for your practice.

1. Do you hold a current authorization list for your top 20 codes, by payer?
2. Is that list reviewed at least quarterly?
3. Are elective requests sent at least 7 calendar days before service?
4. Is your authorization match rate 98% or higher?
5. Does someone compare the approval with the scheduled service the day before?
6. Are therapy and recurring visits tracked against approved counts?
7. Does your claim scrubber hold auth-required lines without an authorization number?
8. Are new CO-197 denials worked within two business days?
9. Do you track CO-197/198 rates by service line, not only practice-wide?
10. Do you appeal denials that meet plan criteria instead of writing them off?

Scoring: 9 to 10 yes answers means a well-controlled process; keep the quarterly list review. 6 to 8 means moderate risk; fix the match and visit-tracking gaps first. 5 or fewer means high risk, and a full authorization workflow review is warranted. For a broader view, pair this list with our denial prevention checklist for billing teams.

Signs Your Practice Needs Prior Authorization Support

Outside support makes sense when authorization work has outgrown the people assigned to it. AMA’s 2024 physician survey found practices complete an average of 39 prior authorizations per physician each week, taking about 13 hours. Watch for these signals:

• Pending requests regularly pass the payer’s decision deadline without follow-up.
• Your match rate stays below 98% for two months running.
• Retro authorization windows close before anyone works the denial.
• Clinical staff spend scheduled patient time on payer calls.

Look for support that maintains payer-specific lists, tracks every pending request to a decision, checks the approval against the service before the visit, and reports denials by CARC and service line.

Aspect Billing Solutions is one example. The team provides end-to-end billing and coding, credentialing, eligibility verification and prior authorization, denial management and appeals, A/R follow-up and compliance support, with a dedicated agent assigned to each provider. The authorization process runs from request through day-before matching to claim submission. Results vary by practice, specialty and payer mix. You can review how the Aspect Billing Solutions revenue cycle management service is organized.

Final Thoughts: Treat the Authorization as Part of the Claim

The CO-197 denial code (prior auth) is rarely about whether care was needed. It is about whether the approval, the service and the claim describe the same thing. The 7-day and 72-hour decision clocks, the OPD program rules, the 120-day provisional affirmation and the MA continuity rules are firm published standards. The AMA and KFF figures are survey and study results, and the match-rate and service-line targets are practical conventions; Table 5 and the worked examples are illustrative.

The natural next question is how many of next month’s scheduled services already have a matching approval. If you want a team to answer that every week, explore the revenue cycle management service from Aspect Billing Solutions.

CO-197 Prior Authorization FAQs

What does denial code CO-197 mean?

CO-197 means the payer adjusted the claim because the required precertification, authorization, notification or pre-treatment approval was absent. Group code CO assigns the balance to the provider, so the patient should not be billed. The practice can correct the claim, request retro authorization, appeal or, if none applies, write it off.

What is the difference between CO-197 and CO-198?

CO-197 means no authorization was found for the service. CO-198 means an authorization existed, but the claim went beyond it, such as more visits, units or days than approved. CO-197 usually needs a retro request or appeal, while CO-198 usually needs an extension or added units.

Can you get a retro authorization after a CO-197 denial?

Sometimes. Many payers allow retro authorization for urgent services, unknown coverage or specific situations listed in the provider manual, and windows range from a few business days to longer. Check the plan’s manual first, then submit clinical notes showing the service met the plan’s criteria.

How long do Medicare Advantage plans have to decide a prior authorization request?

Under CMS-0057-F, starting January 1, 2026, Medicare Advantage, Medicaid and CHIP plans must decide standard requests within 7 calendar days and expedited requests within 72 hours. They must also give a specific reason for any denial. The rule does not apply to prescription drug authorizations.

What is a good authorization match rate?

A practical target used across industry sources is 98% or higher of auth-required services matched to a valid, unexpired approval before the service date. No national body sets this figure. Measure it weekly by payer and service line, because a strong overall rate can hide one weak department.

What is a good CO-197 denial rate?

A good CO-197 denial rate trends toward zero, because almost every missing authorization is preventable. No published benchmark exists. Calculate it monthly by service line as CARC 197 and 198 denials divided by auth-required claims, and investigate any line that rises two months in a row.

Sources and Methodology

(a) Published standards and definitions: CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) fact sheet; CMS 2024 Medicare Advantage and Part D Final Rule (CMS-4201-F) fact sheet; CMS Prior Authorization for Certain Hospital Outpatient Department Services program page and OPD FAQ; Congressional Research Service overview of the WISeR model (May 2026); No Surprises Act emergency services provisions; X12 CARC descriptions for codes 15, 39, 197 and 198; 42 CFR 405.942 (Medicare redetermination timeframe).

(b) Named benchmarking data providers: none used. No national benchmark exists for CO-197 denial or match rates.

(c) Practical or illustrative targets: the 98% match rate, the 7 to 14 day lead time, the two-business-day work window and the near-zero denial rate are commonly reported across industry sources; CMS, AMA, AAPC, MGMA and HFMA do not mandate them. Illustrative scenarios and Table 5 were invented for teaching.

(d) Survey and study data: AMA prior authorization physician survey of 1,000 physicians, conducted late 2024 and reported April 2025; KFF analysis of 2023 Medicare Advantage prior authorization data, reported January 2025.

Results vary by practice, specialty, payer mix and state. Figures reflect information available at the time of research in October 2026; payer authorization lists, CPT and HCPCS codes, and CMS program rules change annually or more often.