ABA Prior Authorization Timeline for 2027: Deadlines and the Code Change

Since January 1, 2026 (for Medicaid managed care, from the first rating period starting on or after that date), Medicaid and CHIP programs, their managed care plans and Medicare Advantage plans must decide standard prior authorization requests within 7 calendar days and expedited ones within 72 hours (CMS-0057-F fact sheet). Employer plans have 15 days (29 CFR 2560.503-1). As of October 29, 2026, we found no payer notice on how ABA authorizations will cross the January 2027 code change.

This page covers the rules around the request: how long each kind of plan may take, what a denial must say, and how to plan authorizations that run past December 31, 2026. For what goes into the request itself, see the BCBA initial authorization checklist; for the code-by-code mapping, see ABA CPT code changes for 2027. More billing pages are in CPT Codes & Billing.

How long can a payer take to decide an ABA prior authorization?

It depends on the type of plan, not on ABA. The federal limits below are outer limits; a plan may decide faster, and a state may set a shorter limit for the plans it regulates.

The CMS rule requires “impacted payers (excluding QHP issuers on the FFEs) to send prior authorization decisions within 72 hours for expedited (i.e., urgent) requests and seven calendar days for standard (i.e., non-urgent) requests,” with the operational provisions “generally beginning January 1, 2026” (fact sheet, January 17, 2024). Its impacted payers are Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities and qualified health plan issuers on the federally facilitated exchanges. Employer plans and other commercial plans are not on that list, so the rule does not set their deadlines (our reading: the fact sheet lists who is covered, not who is excluded).

For Medicaid managed care, the regulation is more precise than the fact sheet. For rating periods that start on or after January 1, 2026, standard decisions are due “within state established time frames that may not exceed 7 calendar days after receiving the request for service,” with up to 14 more calendar days if the enrollee or provider asks or the plan justifies a need for more information; expedited decisions are due “no later than 72 hours,” extendable by up to 14 days if the enrollee asks or the plan justifies a need for more information (a provider request does not extend an expedited decision) (42 CFR 438.210(d)). Before 2026 the standard limit was 14 days, and a plan whose rating period starts mid-year moved to 7 days at its first rating period on or after January 1, 2026 (our reading of the “rating periods that start” wording).

For employer plans covered by ERISA, an ABA prior authorization is a “pre-service claim” (our reading: the regulation defines it as a benefit that requires approval in advance). The plan must decide “not later than 15 days after receipt of the claim,” with one extension of up to 15 days for matters beyond its control, notified before the first 15 days run out; urgent care claims are due “not later than 72 hours” (29 CFR 2560.503-1(f)(2)). If the extension is for missing information, the notice must say what is missing and you get at least 45 days to send it.

Fully insured commercial plans are also regulated by their state, and state insurance laws can set their own deadlines. We did not verify state laws for this page; check your state insurance department for state-regulated plans.

An ABA request is usually standard, not expedited. Expedited review is for cases where waiting “could seriously jeopardize the enrollee’s life or health or ability to attain, maintain, or regain maximum function” (42 CFR 438.210(d)(2)); severe self-injury may meet that bar (our reading), and the request should say why.

What must a payer’s denial include?

From 2026, impacted payers “must provide a specific reason for denied prior authorization decisions, regardless of the method used to send the prior authorization request” (CMS-0057-F fact sheet). The same payers must post prior authorization metrics on their websites every year, the first set by March 31, 2026, covering the previous calendar year across all services, so you can compare payers’ approval rates and decision times in general, not for ABA alone. Employer plans covered by ERISA must also give “The specific reason or reasons for the adverse determination” (29 CFR 2560.503-1(g)(1)(i)).

A specific reason tells you what to fix. “Not medically necessary” alone is not specific; “standardized assessment older than 12 months” is. Log the reason word for word, then decide whether to resubmit with the missing piece or appeal; the ABA insurance appeal checklist covers the appeal packet.

What changes for prior authorization on January 1, 2027?

On January 1, 2027, impacted payers must start running a Prior Authorization API, and CPT replaces the 2019 ABA code set for dates of service from that day.

Electronic prior authorization. CMS-0057-F requires impacted payers to run a Prior Authorization API “populated with its list of covered items and services,” that “can identify documentation requirements for prior authorization approval,” and that “supports a prior authorization request and response,” beginning January 1, 2027 (fact sheet). In practice, your practice-management or EHR vendor has to connect to it before you see a difference; ask your vendor and your Medicaid and Medicare Advantage payers what they will support (our reading).

The ABA codes. For dates of service from January 1, 2027, CPT adds 97173 (BCBA or other QHP 1:1 treatment with analysis), 97180 (non-face-to-face QHP work), 97148, +97149, 97159 and +97160 (harmful behavior), narrows 97155 to direction of a technician, and deletes 0362T and 0373T. Authorizations in 2026 still use “the 2019 CPT code set” (ABA Coding Coalition supplemental guidance, p. 30). Each code’s change is in ABA CPT codes: every code in one table.

What happens to an ABA authorization that runs past December 31, 2026?

Nobody has said yet. The Coalition’s supplemental guidance says commercial payers must “issue new authorizations and / or guidance if they will honor current authorizations that include deleted codes,” that not every payer is required to implement the new codes on January 1 (although HIPAA requires payers that accept electronic claims to use valid Category I codes, p. 28), and that providers should get each payer’s timeline in writing before then (p. 29). Its list of questions for payers includes “Whether authorizations issued under the current codes will be converted automatically” and how claims spanning the transition will be handled (Preparing for implementation, p. 2).

The 97155 units are the problem. A 2026 authorization lumps BCBA direction of a technician and BCBA 1:1 treatment into one 97155 number; in 2027 they are two codes. In the Coalition’s sample 26-week authorization, 312 units of 97155 become 208 units of 97155 and 104 units of 97173, and 52 units of 97180 are added for non-face-to-face work (supplemental guidance, p. 30; the full table is in the crosswalk). A payer cannot do that split for you unless it knows how the hours were used, so keep that breakdown for every authorization that runs into 2027.

0362T and 0373T are harder: the Coalition says “there is no grace period,” so they are invalid for dates of service from January 1, 2027 (supplemental guidance, p. 28). An authorization that lists them needs the payer’s answer before the first 2027 session.

What have payers published about authorizations and the 2027 codes?

As of October 29, 2026, we found no payer notice on how ABA authorizations will be handled across the 2027 change. This table lists what is on the record, with dates; it will be updated in place as payers publish.

Two earlier code changes show what payers have done before. Neither is a promise about 2027.

• Florida, 2022 (Sunshine Health, CMS Health Plan Title 21 members). When Florida moved ABA from HCPCS to CPT codes on August 1, 2022, Sunshine Health told providers it “will crosswalk the HCPCS codes to CPT codes under the existing authorization” and that with an authorization ending after August 1, “no new authorization is required until the current authorization expires” (Sunshine Health notice, July 26, 2022).
• Virginia Medicaid, 2025. When Virginia began requiring units for each ABA treatment code on authorizations starting on or after October 15, 2025, fee-for-service “Existing service authorizations will continue through the authorization end date,” and managed care providers were “not required to update existing service authorizations that span past October 15, 2025” (DMAS bulletin, August 13, 2025).

Both payers carried existing authorizations through to their end date, but those changes renamed or itemized codes; 2027 splits one code into two and deletes two others, so a payer may decide differently (our reading).

When should you submit an ABA reauthorization before January?

Submit at least 30 days before the authorization ends for a Medicaid managed care plan, and at least 45 days before for an employer plan, so that the longest allowed decision time and about a week to answer one records request still fit before the end date. The sums (our reading, not a payer rule):

• Medicaid managed care: 7 days plus a 14-day extension is 21 days; add a week for records, and round up to 30 days.
• Employer plans (ERISA): 15 days plus a 15-day extension is 30 days; add the time you need to send missing records, and round up to 45 days.

If your payer publishes its own submission window, use whichever date is earlier. For an authorization that ends in December or January, also ask, in the same request, whether the new authorization will be issued in 2019 or 2027 codes. The packet itself is covered in the BCBA reauthorization checklist and the progress report guide.

What should an ABA authorization tracking log record?

One row per request, with fields that match the rules above, so you can see a missed deadline or a vague denial on the day it happens. The example is fictional.

Client A’s authorization runs into 2027, which is why the 97155 breakdown is recorded now. The units mirror the Coalition’s sample (supplemental guidance, p. 30); under it, a full 26 weeks in 2027 codes would be 97155 208, 97173 104 and 97180 52; for Client A, only the units for dates of service from January 1 would need converting (our reading). Billing 97155 for 1:1 time after January 1 because the authorization still says 97155 would report a service the note does not describe and risks billing misrepresentation.

What should you do before January 1, 2027?

• List every authorization that ends after December 31, 2026, with its 97155 units split into direction and BCBA 1:1, and any 0362T or 0373T units.
• Send each payer the Coalition’s questions in writing and file the dated answers (Preparing for implementation, p. 2).
• Submit December and January reauthorizations early using the deadlines above, and ask which code set the new authorization will use.
• Add a tracking log with decision-due dates and the exact denial reason.
• Check the prior authorization metrics each Medicaid and Medicare Advantage payer has published on its website, to see its average decision times and approval rates for the previous year (all services, not ABA-specific).

For Aetna’s own forms and criteria, see the Aetna ABA prior auth checklist.

Sources

• Centers for Medicare & Medicaid Services. CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) fact sheet, January 17, 2024.
• 42 CFR 438.210(d), Timeframe for decisions (Medicaid managed care), eCFR, checked October 29, 2026.
• 29 CFR 2560.503-1(f)(2), Claims procedure (ERISA group health plans), eCFR, checked October 29, 2026.
• ABA Coding Coalition. Supplemental Guidance on Interpreting and Applying the Revised 2027 CPT Codes for Adaptive Behavior Services (cover dated January 2027; published October 2026) and Preparing for Implementation of the 2027 CPT Codes (October 2026).
• Aetna. ABA Treatment Request: Required Information for Precertification, GR-69017-4 (7-26).
• Sunshine Health. Guidance for CMS Title 21: Prior Authorization Required for New ABA CPT Codes, July 26, 2022.
• Virginia Department of Medical Assistance Services. Service authorization update: Applied Behavior Analysis, effective October 15, 2025, August 13, 2025.

This page is billing and regulatory information, not legal advice. Check each payer’s policy and your plan contracts. CPT is a registered trademark of the American Medical Association.

Changelog

• October 29, 2026: first published. Payer table checked against the ABA Coding Coalition guidance, Aetna’s ABA request form, the Sunshine Health notice and the Virginia DMAS bulletin; no payer notice on 2027 authorizations found.

Reviewed by the Praxis Notes team on October 29, 2026.