Who Actually Reviews the Prior Authorization? A Guide to Delegated Utilization Management

Published October 19, 2026

A provider can verify a patient's insurer correctly and still send the prior authorization request to the wrong organization. The reason is delegation. Health plans can hand specific utilization management (UM) functions, including prior authorization review, to another entity: a medical group or IPA, or a specialty organization that reviews certain categories of care on the plan's behalf.

UnitedHealthcare's 2026 provider administrative guide describes delegation as a process that gives another entity the authority to perform specific functions on its behalf, and lists utilization management first among the medical management functions it may delegate, alongside credentialing and claims. NCQA, which accredits health plans, uses a similar definition: delegation occurs when a plan gives another entity the authority to perform a required activity on its behalf, while the delegating plan remains responsible for overseeing it. For authorization teams, that creates a routing problem before clinical review has even begun.

The payer name does not necessarily identify the reviewer

When staff see a member's insurance card, the natural assumption is that the insurer named on it will receive and decide the authorization. Sometimes that is true. Sometimes the health plan keeps financial responsibility while another entity performs the utilization review. A medical group or IPA may manage UM for members assigned to it, and a specialty UM organization may review selected services such as imaging, cardiology, musculoskeletal surgery, genetic testing or specialty therapies. The exact categories depend on the contract.

So "Aetna authorization" or "UnitedHealthcare authorization" can be an incomplete description of the work. The useful question is: who owns the review for this member, product, service and date of care?

Specialty delegation can split one payer into multiple workflows

A health plan can keep authorization for most services while sending a defined specialty category elsewhere, and those assignments change. EviCore's resources for OHSU Health Services show one expansion: effective May 1, 2026, members require prior authorization through EviCore for lab genetic testing, spine and joint surgeries, and pain management and specialty therapy services, for dates of service on or after that date.

Delegation can be reversed, too. EviCore's HealthSpring page says it stopped managing prior authorization for HealthSpring members' durable medical equipment services effective March 1, 2026, with new requests going directly to HealthSpring through Availity Essentials, and stopped managing cardiology services effective July 1, 2026. In both cases, authorizations issued before the change remained valid for their approved dates and services. The same page notes that post-acute care and home health had already moved to HealthSpring at the start of 2026.

That is why routing tables go stale. A rule that was right in February can be wrong in July without the member's payer or the clinical service changing at all.

Delegation does not erase payer accountability

Delegating a function does not mean the health plan has delegated away its responsibilities. UnitedHealthcare's guide states that when it delegates responsibilities, it remains responsible to external regulatory agencies and other entities for the performance of the delegated activities.

Medicare Advantage makes the point concrete. MA organizations that use utilization management, including prior authorization, must have a UM committee led by a plan medical director, and may not use UM policies that the committee has not reviewed and approved. Starting in 2026, CMS also requires every MA organization to submit information on the internal coverage criteria used by the organization or its delegated entities to process Part C prior authorizations; the first submission was due April 30, 2026, and CMS's instructions note that reported criteria can include those developed by third-party vendors. For providers, the takeaway is that the delegated organization may be the operational reviewer while the health plan remains accountable for the member's coverage.

Do not confuse delegation with a separate insurance benefit

Delegated utilization management is not a change in the patient's insurance. The member stays enrolled in the same health plan even though another entity reviews a particular request. Staff often call a specialty UM organization "the payer" because that is the portal they use, but the shorthand causes confusion later when claims, appeals, benefits or payment remain with the health plan.

A better case record separates the health plan, the UM reviewer, the benefit administrator and the claim payer wherever those roles differ.

Identify the reviewer before assembling the request

Routing should be checked before clinical documents are gathered, because different reviewers can use different forms, portals, questionnaires, criteria and data requirements. A reliable sequence is to confirm the patient's active product, check the plan's current authorization requirement for the service, identify any delegated reviewer, confirm the submission channel, and only then retrieve that reviewer's clinical criteria and documentation requirements.

Doing it in the reverse order creates rework. A team can spend half an hour assembling a packet for the health plan only to learn that the plan does not take the request, because the service is managed by another organization.

Delegation happens through provider organizations too

Specialty UM organizations are only one form of delegation. In delegated-risk arrangements, medical groups or IPAs take on utilization management decisions for assigned members. UnitedHealthcare's guide describes the referral authorization procedure for delegated medical groups and IPAs: if a member's treatment requires a referral or prior authorization, the PCP or treating provider submits the request to the delegate's utilization management committee or its designee for a decision. For delegated Medicare Advantage plans, the guide adds that the delegate's protocols must be followed, and tells providers to call the number on the member's ID card to verify them.

This is especially confusing in markets where the same insurer has both delegated and non-delegated members. Two patients with nearly identical insurance cards can have different authorization routes because one is assigned to a delegated medical group. Member-level verification matters more than payer-level memory.

The authorization number needs context

Once an approval is obtained, record which organization issued it. An authorization number without an issuing entity can be hard to reconcile later, especially when a different organization processes the claim. A structured record should include the health plan, product, delegated reviewer, requested service, servicing provider, authorization number, status, approved units and dates, the source of the decision, and any instructions that affect claim submission.

That record also protects the organization when a delegation changes. If a service was authorized before responsibility moved, as in the HealthSpring example, the team can show who issued the decision and when, and that it remains valid for its approved dates. Consistent records like these are the core of reliable prior authorization follow-up, and they prevent the handoff failures between scheduling, clinical and billing teams that delegation makes more likely.

Delegated UM is becoming more visible, not less

CMS's recent Medicare Advantage requirements push delegated arrangements into the open: plans now have to report the coverage criteria their delegated entities use, and UM committee and coverage-criteria rules apply regardless of who performs the review. At the same time, CMS-0057-F is moving prior authorization toward electronic exchange. Impacted payers other than Marketplace issuers have had to meet 72-hour expedited and seven-day standard decision timeframes since 2026, and prior authorization APIs are required generally beginning January 1, 2027.

Standardized exchange can reduce manual friction, but it does not remove the need to know who owns the clinical review. A plan's API still has to route the request to the right reviewer.

The real problem is routing accuracy

Delegated utilization management turns prior authorization into a network of responsibilities rather than a simple exchange between provider and insurer. For an individual case, the most important question may be neither whether authorization is required nor what documentation is needed, but where the request belongs in the first place.

Organizations that track payer, product, service, reviewer and submission channel separately are better placed to adapt when delegation changes. Those that encode the whole process as "call the payer" tend to discover routing errors after staff time has been spent or, worse, after care has been delivered.

FAQ

What is utilization management?

Utilization management is the set of policies and processes, including prior authorization, that a health plan uses to review whether services meet its coverage criteria before or while they are paid for. In Medicare Advantage, plans that use UM must have a UM committee led by a medical director that approves their UM policies.

What is delegated utilization management?

It is an arrangement in which a health plan gives another organization, such as a medical group, IPA or specialty review company, the authority to perform UM functions like prior authorization on its behalf. The health plan remains responsible for the delegated activities.

How do I know whether a prior authorization goes to the health plan or a delegated reviewer?

Check by member, product and service: the plan's current prior authorization requirements, the member's ID card and any delegated medical group assignment. Delegation assignments change, so confirm them for each case rather than relying on a past routing rule.

Is an authorization from a delegated reviewer still valid if the delegation ends?

In the examples above, yes for the approved dates and services. EviCore's HealthSpring notices state that authorizations issued before the transition remain valid for those dates and services. Confirm the specific transition notice for each plan.

Sources

All retrieved October 6, 2026.

Run a pilot on a real workflow.

Bring a representative batch, define the output schema, and validate ROI with your payer mix in 30 to 90 days.

Book a Demo
Superdial white logo
The communication layer for revenue cycle teams.
Workflows
Benefits Verification
Prior Authorization
Claim Status
Credentialing & Enrollment
Provider Data Management
Who We Serve
RCM Companies
Provider Groups
Health Systems
Payers
Digital Health
Pharma
Company
Case Studies
Newsroom
Security
Blog
API Docs
Book a Demo
Careers