Specialty EHR & IT

Biologics prior authorization in rheumatology: the lost days

The rheumatologist decided on the drug in eleven minutes. Getting the patient onto it takes three weeks, most of which is spent assembling information the practice already had, in a format the payer will accept.

9 min read
September 6, 2026
Updated September 6, 2026
Biologics prior authorization in rheumatology: the lost days
Quick answer
Biologics prior authorization

Biologics prior authorization in rheumatology is slow because the clinical justification lives in narrative notes while the payer wants discrete criteria. Practices that template the packet, track submissions in one place and read the actual policy recover most of the lost time before any federal rule takes effect.

No specialty spends more administrative effort per prescription than rheumatology.

Biologics and targeted synthetic agents are expensive, they are almost universally subject to review, and the criteria attached to them are detailed in a way that ordinary formulary rules are not. Step therapy history, disease activity scores, tuberculosis screening, prior agents tried and failed with dates and reasons. All of it exists in the chart. Almost none of it exists in a form that can be lifted out in one action.

So a staff member reads three years of notes and retypes what they find. That is the actual bottleneck, and it is not a payer problem. It is a data structure problem that the practice owns.

Healthcare IT consulting perspective
The RealityThe packet is the bottleneck
⚠️
The Problem
The justification is buried in prose.
Prior agents, dates, reasons for discontinuation and disease activity all sit inside narrative notes. Every submission starts with someone reading and retyping.
🔧
The Solution
Capture the criteria as you go.
Record therapy history and activity scores as structured fields during the visit, then assemble the packet from the record instead of reconstructing it afterwards.
✅
The Resolution
Submitted the same week, tracked to a decision.
The packet is built in minutes, every submission has an owner and a status, and nothing sits waiting because nobody realized it was waiting.

Documentation requirements: assembling the packet once

Start with the observation that the same twelve or so data points are requested for most agents, with variations. Therapy history with dates. Reason each prior agent was stopped. A disease activity measure, ideally repeated. Screening results. Relevant comorbidities. Weight where dosing depends on it.

The retyping problem, stated plainly

If those twelve points are captured as structured fields during the visit, the documentation requirements for a submission are met by pulling a report. If they are captured in prose, every submission is a research exercise. The clinical content is identical either way. Only the retrievability differs, and retrievability is a configuration decision that was made once, probably at go-live, probably by default.

This is the single highest-return change available to a rheumatology practice, and it is unglamorous. a template that assembles the packet from fields the clinician already completes turns a thirty-minute reconstruction into a two-minute review. It also improves the note, because structured therapy history is easier to read than a paragraph.

Key takeaway
  • The payer is not asking for information you do not have. It is asking for information you cannot easily extract. Fix the extraction and most of the delay disappears without anyone negotiating with anyone.

Payer policy: the criteria you are actually being judged against

Most practices submit against what they believe the criteria are rather than against the published policy. The published policy is usually available, usually specific, and usually different in some small way from what everyone assumes.

Pull the current policy for the three or four agents you prescribe most, for the plans that cover most of your patients. Read what is actually required. Then compare it to what your submissions contain. In our engagements this exercise almost always finds at least one item that is being supplied unnecessarily and at least one that is routinely missing and causes avoidable back-and-forth.

Payer policy changes, so this is a periodic task rather than a one-off. Twice a year, on a calendar, assigned to a named person. It is an hour of work that prevents a category of denial that feels arbitrary and is not.

Rheumatology practice team tracking biologics prior authorization submissions on screen
A submission without an owner and a status behaves like an interface error queue. It sits, and nobody notices until the patient calls.

Specialty pharmacy and the hand-off nobody tracks

Approval is not the end. The prescription then moves to a specialty pharmacy, which may run its own benefits investigation, may need enrolment forms, and may require a nursing assessment before first dose. Each of those is another queue outside the practice’s systems.

The failure is rarely dramatic. A form goes out, nobody follows it, and the patient who was approved in week three starts therapy in week seven. Practices that track only to approval genuinely believe their turnaround is faster than the patient’s experience of it.

Track to first dose, not to approval. That single change in what you measure usually surfaces more delay than any other intervention, and it costs nothing but a column. Some of the follow-up it generates is well handled by a virtual check-in rather than a clinic slot the patient does not need.

Denial reason requirements and what changes in 2026

Federal rules are moving, and it is worth knowing precisely what they do and do not cover. the final rule itself applies to Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid and CHIP managed care entities, and qualified health plan issuers on the federally facilitated exchanges. Commercial employer coverage is not in scope, which matters a great deal if most of your biologics patients are commercially insured.

For the payers that are in scope, the CMS fact sheet sets the new timeframes: expedited decisions within 72 hours and standard decisions within seven calendar days, with exchange issuers excluded from the timeframe provisions. Impacted payers must also give a specific denial reason regardless of how the request was submitted, and must publicly report prior authorization metrics annually, with the first metrics due by 31 March 2026.

The denial reason requirement is the one to plan around. A specific reason is actionable in a way that a generic determination is not, and practices that capture the stated reason in a structured field will be able to see their own denial patterns for the first time.

Qventive Healthcare

Not sure where your authorization time is going?

We measure your actual turnaround from decision to first dose, find where submissions stall, and hand you written findings.

Electronic prior authorization and the API rules

The same rule requires impacted payers to stand up a set of programming interfaces, including one for prior authorization, with those API requirements taking effect on 1 January 2027. Electronic prior authorization built on those interfaces is meant to let a practice discover what is required, submit, and receive a decision without leaving the chart.

Two caveats are worth holding onto. The obligation falls on payers, not on practices, so what arrives in your EHR depends on what your vendor builds against it. And the underlying standards work sits inside the national interoperability program, which means adoption will be uneven for a while even among payers who are in scope.

Plan for it, do not wait for it. A practice whose data is already structured will be ready to use an electronic pathway the week it appears. A practice whose justification still lives in prose will be retyping into a nicer interface. If the templates are being rebuilt anyway, it is worth rebuilding the workflow around it at the same time.

What the denial data actually shows

It is worth being precise about the scale of inappropriate denial, because the number gets repeated loosely. In a 2022 review, an OIG review of Medicare Advantage denials found that 13 percent of denied prior authorization requests met Medicare coverage rules, and 18 percent of denied payment requests met both coverage and billing rules. Two causes were identified: plans applying clinical criteria beyond Medicare’s own coverage rules, and requests denied for insufficient documentation where adequate records existed.

That second cause is the one a practice can act on directly. It is also the reason appealing is worth the effort more often than practices assume, and the reason a tracked, owned submission queue pays for itself.

Qventive provides biologics prior authorization rheumatology services across New Jersey as part of our rheumatology EHR and IT support and a broader rheumatology practice management engagement. Because authorization packets move detailed clinical information to third parties, the design belongs in your HIPAA risk analysis as well as your operations plan.

Biologics authorization: common questions

Is dedicated authorization software worth it?
Sometimes, and later than most vendors suggest. The capability these products add is real: payer-specific requirement libraries, submission tracking, and status polling that saves staff from sitting on hold. What they cannot do is create structured clinical data that your EHR never captured, which is the actual constraint in most rheumatology practices. A product layered on top of narrative notes will still require somebody to read three years of chart and type the therapy history into a form, only now into a different form. The sensible sequence is to structure the clinical capture first, build the packet from the record, run that for a quarter with a simple tracking sheet, and then evaluate software against the residual work rather than against the current mess. Some practices genuinely outgrow a spreadsheet. Far fewer than the number who buy before they have measured anything.
Should we appeal denials or resubmit?
It depends on why the request was denied, which is exactly why capturing the stated reason in a structured field matters so much. A denial for missing information is a resubmission: supply what was missing and the clock starts again, usually faster than an appeal. A denial on clinical criteria where you believe the criteria were met is an appeal, and the evidence base for appealing is stronger than many practices assume given how often reviewed denials are overturned. What does not work is treating every denial the same way, because the two paths have different timelines and different documentation. Build the distinction into the workflow rather than leaving it to whoever picks up the fax. A practice that can report its denials by stated reason will see within a quarter which categories are worth contesting and which are worth preventing.
What are the HIPAA implications of authorization workflows?
Authorization moves detailed clinical information outside the practice, frequently through channels that were never formally assessed. The questions are the ordinary ones. Where are packets assembled, and does a copy persist on a shared drive or in an email outbox after submission. Is the submission channel encrypted, and if a fax is still involved, is the number verified before each send rather than stored from a call three years ago. Does any third party handling submissions on your behalf have a business associate agreement in place. Who inside the practice can open a completed packet, and is that access reviewed. Does the authorization system, whether it is software or a spreadsheet, appear in your inventory and your risk analysis at all. In our engagements the authorization workspace is very often the least governed copy of clinical data in the building, because it was created by staff to solve a real problem and never routed through anyone who thinks about access.
Do the new federal rules apply to our commercial patients?
Generally not, and this is the single most misread part of the rule. The requirements fall on Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid and CHIP managed care entities, and qualified health plan issuers on the federally facilitated exchanges. Employer-sponsored commercial coverage sits outside that list. For a rheumatology practice whose biologics population skews commercial, that means the decision timeframes and the denial reason requirement will not change most of your submissions. Some payers may extend similar practices across their book voluntarily, and some states have their own rules, but neither is something to plan around until you have confirmed it for your specific plans. The practical implication is that the internal work, structured capture and tracked submissions, is what you actually control, and it delivers regardless of which rule applies to which patient.
How should we measure turnaround?
Measure from the clinical decision to the first dose administered, not from submission to approval. The second measurement is the one every practice already has and the one that flatters the operation, because it excludes the two segments where most delay accumulates: the gap between the visit and the submission going out, and the gap between approval and the specialty pharmacy actually dispensing. Practices that switch to the longer measure are usually surprised, and the surprise is the point. Track it as a simple median with a count of outliers rather than an average, because a handful of very long cases will distort a mean and those cases are the ones worth reviewing individually. Then look at what the outliers have in common. In our experience they cluster around a small number of payers, agents and staff handoffs rather than being randomly distributed.
Ready when you are

Let’s meet

Qventive works with rheumatology practices across New Jersey on structured capture, authorization workflow and reporting. Thirty years healthcare-exclusive, from our office in Hackensack.

Sources
  1. CMS Interoperability and Prior Authorization Final Rule, CMS-0057-F, compliance dates and API requirements. cms.gov
  2. 72-hour expedited and seven-calendar-day standard decision timeframes, specific denial reasons, and public metrics reporting by 31 March 2026. cms.gov
  3. OIG found 13 percent of denied prior authorization requests met Medicare coverage rules. oig.hhs.gov
  4. National interoperability standards underpinning the required APIs. healthit.gov
Qventive Healthcare
Healthcare IT consulting and managed services, healthcare-exclusive since 1994. 200 Passaic Street, Hackensack, New Jersey. We serve as a business associate to the practices we support.
AI Assistant Online

Schedule a Consultation

Fill out the form below and we'll get back to you within 24 hours.

Request Sent!

We've received your request and will be in touch within 24 hours.

Something went wrong