🎯 The business: specialist practices need insurers’ approval before many scans, procedures and drugs. You build those requests: pull the chart notes and imaging, match them to the insurer’s written criteria, hand the clinician a summary to review and sign, submit, and track every request until a decision comes back. If one is denied, you assemble the file the physician needs to fight it. You never make the clinical call.
At a glance
| Money to start | ≈ $1,400 to $6,050 |
| Time to the first paying practice | 1 to 3 months, if you already know medical billing |
| Hours a week | 10 to 15 with one practice; about 22 with two (worked below) |
| Skills that matter most | Medical billing or coding experience, reading chart notes, knowing insurers’ criteria, follow-through |
| What it can pay | About $5,100 a month before tax with two practices (example, worked below) |
Is this for you?
It suits someone who has worked in a medical billing office, a specialist’s front desk or as a coder, and who likes chasing a file until it is finished. The job is half detective work (what does this insurer want for a lumbar MRI?) and half persistence (calling about a request that has sat for six days).
It is a poor fit without a healthcare background; you would spend months learning what a practice expects on day one. It is not a student job: you handle patient health data under HIPAA, and mistakes delay someone’s care. And if you are drawn to deciding whether a treatment is needed, this is the wrong seat. That decision belongs to the clinician.
Who pays, and what
Independent specialist practices: orthopedics, spine and pain, imaging centers, gastroenterology, dermatology, sleep medicine and physical therapy. The practice administrator or billing manager decides.
The load is heavy. In the American Medical Association’s December 2025 survey of about 1,000 physicians, practices completed about 40 prior authorizations per physician per week, and physicians and staff spent about 13 hours a week on them (as reported in news coverage in May 2026). Four in ten physicians said their practice had staff who did nothing else.
The rules are also new. Under the federal CMS-0057-F rule, from January 1, 2026, Medicare Advantage plans and Medicaid and CHIP programs and managed-care plans must decide urgent requests within 72 hours and standard ones within 7 calendar days, and must give a specific reason when they deny. Drug requests are outside this rule. Separately, Medicare’s WISeR pilot added prior authorization for certain services in traditional Medicare in six states from January 2026: Arizona, New Jersey, Ohio, Oklahoma, Texas and Washington. Faster clocks mean an incomplete request gets an answer sooner too, often a denial or a request for more records. A complete packet on day one is worth more than it was.
What they pay: there is no published price survey for outsourced packet preparation, so the prices on this page are examples. Practices compare you with the cost of their own staff, so your case rests on faster, cleaner requests and fewer denials for missing records, not on being cheap.
What it takes to start
| LLC and city or county license | $150 to $500 |
| HIPAA training course and written security policies (an estimate) | $50 to $300 |
| Billing or coding credential course and exam, if you have none (an estimate; check AAPC or AHIMA) | $0 to $1,500 |
| Cyber liability and errors and omissions insurance (an estimate; get quotes) | $600 to $1,500 first year |
| Encrypted laptop, password manager and security keys | $300 to $1,200 |
| Lawyer review of your business associate agreement and service contract | $200 to $800 |
| Website, domain and business email on a plan that signs a BAA | $100 to $250 |
| All-in | ≈ $1,400 to $6,050 |
You work inside the practice’s own electronic health record and insurer portals, with logins issued to you by the practice. You do not buy clinical software.
Start to finish: the steps
1. Start from experience. If you have not done billing or prior authorizations, work a year in a specialist’s billing office first. A credential such as a billing or coding certificate helps you get the meeting; experience keeps the client.
2. Pick one specialty and one region. Orthopedics in one metro area means the same handful of procedures and the same five to ten insurers. Each insurer publishes its own medical policies and criteria, and knowing them by heart is your advantage over generic software.
3. Set up as a business associate. Form the business, buy insurance, finish HIPAA training, write your security policies and risk analysis, and have a lawyer review your business associate agreement. See Choosing a legal structure and Business insurance.
4. Build a playbook per insurer and service. For each common request: which codes, which notes and imaging, which conservative treatment must be documented first, which portal, and how long it usually takes. Use AI to organize insurers’ public policy documents, which contain no patient data.
5. Run a two-week pilot. Sign the BAA, then take one slice of work, such as all MRI requests or one physician’s surgery requests. Log the date each order arrived, the date submitted and the date decided.
6. Keep the clinician in charge. You assemble; the clinician decides. Every summary of medical necessity goes to the ordering clinician to review, correct and sign before submission. If you draft with an AI tool, it must be one covered by a BAA, and you check every statement against the chart.
7. Track the clock. Keep a simple log of every open request with its deadline: 72 hours or 7 days for the insurers the CMS rule covers, and each state’s or insurer’s own clock for the rest. Call on the day a decision is due, not a week later.
8. Prepare the denial file. When a request is denied, pull the stated reason, the insurer’s criteria, and the chart notes that answer it, so the physician can go into a peer-to-peer call or sign an appeal quickly.
9. Report every month. Requests handled, average days from order to decision, and the denial reasons by insurer. Practices renew what they can measure.
10. Stay ahead of the 2027 systems. As insurers’ electronic prior-authorization connections arrive (generally due January 1, 2027), simple requests will move faster through the practice’s own software. Your value shifts to complex cases, denials and the insurers that lag. See Staying ahead of AI.
Pricing
| Standard request (imaging, common procedures) | $12 to $20 |
| Complex request (surgery, specialty drugs, long histories) | $35 to $60 |
| Denial file for a peer-to-peer call or appeal | $60 to $120 |
| Monthly retainer, one physician’s imaging and procedures | $1,500 to $2,500 |
| Backlog cleanup | $35 to $50 an hour |
These are example prices; no market survey exists. Price per request so the practice pays for volume it can see, and move steady clients to a retainer. Never price on approvals or promise an approval rate: the decision is the insurer’s, and a fee tied to approvals pushes you toward overstating the record.
The math
Take two practices sending, together, 200 standard requests a month at $15 ($3,000), 40 complex requests at $40 ($1,600) and 10 denial files at $80 ($800). Revenue is $5,400. Costs: about $125 for insurance, $50 for BAA-covered email and security tools, $40 for a share of phone and internet, $35 for credential renewal and education, and $50 for bookkeeping, $300 in all. That leaves about $5,100 a month before tax.
The hours, using my own estimates: 15 minutes per standard request (50 hours), 45 minutes per complex one (30 hours) and 90 minutes per denial file (15 hours), 95 hours a month, or about 22 hours a week. Your first months will be slower and smaller.
Set aside a quarter to a third of profit for income and self-employment tax. See Small business taxes.
Getting customers
Who to approach first. People who have watched you work: the practice you came from, billing managers you worked beside, and the specialists your old employer referred patients to. They know your accuracy, and they are trusting you with patient records and with their cash flow.
The first clients. One person can serve three or four practices, so you need a few good ones, not ten. List 50 independent specialist practices in your region in the specialty you know. Send 50 short letters or emails to the practice administrators by name, then make 15 follow-up calls. Ask your local Medical Group Management Association affiliate or AAPC chapter for a ten-minute slot on the new decision clocks, and have coffee with three medical billing companies, which often handle claims but not prior authorizations. Expect 3 to 5 real conversations, 2 pilots and 1 or 2 paying practices in the first three months.
Hi Ms. Chen, I prepare prior-authorization requests for orthopedic practices around Phoenix. I pull the notes and imaging, match them to each insurer’s criteria, and give your clinician a one-page summary to review and sign before I submit. Then I track every request against the 72-hour and 7-day decision clocks that now apply to Medicare Advantage and Medicaid plans, and build the file when one is denied. I was billing lead at a spine practice for eight years, and I work under a signed business associate agreement. Could I take your MRI requests for two weeks so you can compare the turnaround? Dana Ortiz, 602-555-0187
Channels, best to worst for this customer:
1. Former colleagues and their referrals: billing staff know which practices are behind.
2. Medical billing companies and coders: partners who can hand you the work they do not do.
3. MGMA affiliates and AAPC local chapters: administrators and billing staff in one room.
4. LinkedIn: short posts on what a specific insurer now asks for, aimed at practice administrators.
5. Regional specialty society meetings: harder to get into, but well targeted.
6. Google Business Profile: mainly so a referral can find you.
7. Upwork: many offshore listings at low rates; a weak channel for a U.S. specialist service.
8. Paid ads: last.
Turning clients into referrals. From the pilot on, record the average days from order to decision and the number of requests sent back for missing records. After three months, ask the administrator for a short quote and permission to name the practice, with no patient details. Administrators talk to each other at MGMA meetings; ask for one introduction there. More in the launch and marketing playbook.
Running it week to week
Work the queue every day: new orders first, then anything due today. Check open requests against their deadlines each morning. Update your insurer playbook when a policy changes, and note the date. Once a week, send the practice a list of anything stuck and anything needing the clinician’s signature. Once a month, send the report and review your access: every person who has left the practice should be gone from your lists too.
Rules to check
HIPAA. You are a business associate of the practice. You need a signed business associate agreement before seeing any record, you must follow the HIPAA Security Rule (risk analysis, access controls, encryption, training), and you must report a breach to the practice no later than 60 days after you find it. Every tool that touches patient data, including email, storage and AI, needs its own BAA. Consumer AI accounts do not have one. Anthropic signs a BAA for its API and for Claude Enterprise with HIPAA settings turned on, and OpenAI for its API and sales-managed ChatGPT Enterprise or Edu accounts (not ChatGPT Business). Check the current terms before use.
Clinical judgment is not yours. You may gather, organize and summarize what the chart says. You may not decide that a treatment is needed, add or change anything in the medical record, or sign for a clinician. The ordering clinician reviews and signs the medical-necessity statement. False or inflated information sent to Medicare or Medicaid can bring liability under the federal False Claims Act, for the practice and for you, so an AI draft that "improves" the record is a serious risk.
Know which clock applies. The CMS-0057-F timeframes cover Medicare Advantage, Medicaid and CHIP fee-for-service and managed care. Qualified health plans on the federal exchanges are covered by the rule’s other parts but not its decision timeframes, and drug requests are excluded. Employer plans and state-regulated plans follow other rules, and many states have their own prior-authorization laws. Use the portal accounts the practice issues to you and follow each insurer’s portal terms. Contracts and data duties are covered in Contracts, client data and AI rules.
What goes wrong
A request sits unnoticed past its deadline and a patient’s surgery slips; the daily deadline check is the job. An AI summary says the patient "failed six weeks of physical therapy" when the chart says four; every line gets checked against the source. A clinician is too busy to sign, and you get blamed for the delay; agree on a signing routine in the contract. The practice’s electronic record system adds its own automated prior-authorization tool and simple requests disappear; build your value around complex cases and denials. And one practice becomes most of your income; aim for three.
Questions people ask
What does a prior authorization specialist do?
They get insurers’ approval before a scan, procedure or drug: gather the chart notes and test results, match them to the insurer’s criteria, submit the request, track it to a decision, and prepare the file if it is denied. The ordering clinician makes the medical judgment and signs.
Can I do prior authorization work from home?
Yes. Most of the work happens in the practice’s electronic health record and insurers’ portals through a secure remote login. You need an encrypted computer, a private workspace, your own logins, and a signed business associate agreement with each practice.
How much do prior authorization services cost?
There is no published price survey. As examples, outsourced help might charge $12 to $20 for a standard request and $35 to $60 for a complex one, or a monthly retainer. Practices compare it with the staff time they spend now.
What are the new CMS prior authorization rules for 2026?
Under CMS-0057-F, from January 1, 2026, Medicare Advantage plans and Medicaid and CHIP programs must decide urgent requests within 72 hours and standard requests within 7 calendar days, give a specific reason for denials, and publish prior-authorization statistics. Electronic prior-authorization systems are generally due January 1, 2027. Drugs are excluded.
Do I need a certification to do prior authorizations?
No license is required for the paperwork side. Many employers prefer a billing or coding credential and experience in the specialty. HIPAA training is required for anyone handling patient records.
Free help
CMS publishes a fact sheet and full text for the Interoperability and Prior Authorization Final Rule (CMS-0057-F) and a page on the WISeR model. The AMA publishes prior-authorization research and advocacy resources. HHS’s Office for Civil Rights offers free HIPAA guidance for business associates, including sample agreement provisions. AAPC local chapters and MGMA state affiliates are where you meet the people who hire you. SCORE and your local Small Business Development Center help with contracts and pricing at no cost.
The CMS rule dates, the WISeR states, the AMA survey figures and AI vendors’ BAA terms were checked in November 2026. Re-check insurers’ policies monthly, and re-check the rule’s electronic-system deadlines and the WISeR service list before you quote a practice.