ABA prior authorization in 2026: decision deadlines, denial reasons and appeals

The CMS Interoperability and Prior Authorization final rule (CMS-0057-F) moved three things for Medicaid managed care plans, with a compliance date starting January 1, 2026³:

1. The standard decision timeframe a state may set dropped from a cap of 14 calendar days to a cap of 7 calendar days¹.
2. Payers must give a specific reason for a denial, whatever channel the request came through: portal, fax, email, mail or phone³.
3. Plans must publish prior authorization data on their website by March 31 each year¹.

These caps allow one exception: a standard or expedited decision may be extended by up to 14 calendar days if the enrollee or the provider asks, or if the plan justifies a need for more information and how the extension is in the enrollee’s interest¹.

What did not change is the urgent track. The 72-hour cap for expedited decisions carries no 2026 start date in the regulation, which means it already applied before this rule¹. If a vendor or a webinar sells you “72 hours is new in 2026”, that is wrong.

The published metrics are worth a look before you argue a case. The list includes the percentage of standard requests approved, denied, and approved after appeal¹.

Here is the nuance that trips people up. The regulation does not say “from January 1, 2026”. It says the cap applies “for rating periods that start on or after January 1, 2026”, and even then it caps a timeframe the state establishes¹. Two consequences:

• The binding number for your case is the one in your plan’s contract or provider manual, which can be shorter than 7 days, not the federal ceiling.
• The start date depends on when your plan’s rating period begins.

In Florida, AHCA posts managed medical assistance capitation rates in periods that run from October through September⁹. Reading the rule against that calendar, the period that began on October 1, 2025 started before January 1, 2026, so the 7-day cap reaches Florida’s SMMC plans with the period that began on October 1, 2026. AHCA has not published a notice confirming that reading, and it has used off-cycle periods before, so confirm the timeframe with the plan rather than assuming it.

CMS applies the same timeframes to ABA specifically in its August 2026 Medicaid and CHIP ABA toolkit⁴.

Florida’s coverage policy requires authorization from the QIO before ABA starts and at least every 180 days after that⁵. Read that section carefully: the policy states that its authorization rules apply to the fee-for-service delivery system⁵. For a child in a plan, the plan’s own rules govern the paperwork, inside the federal floor.

One more Florida detail that saves cases: when a child moves to a new plan, the plan must honor treatment that was already authorized for up to 90 days after the new enrollment⁶. If the article you need before any of this is the assessment packet itself, see the initial assessment report guide.

A notice of adverse benefit determination must explain the reasons for the decision and tell the enrollee they can get, free of charge, the documents and records behind it. The regulation spells out that this includes medical necessity criteria and the processes or evidentiary standards used to set coverage limits².

That sentence is the most underused line in the whole subpart, and an OIG audit published in June 2026 shows why. Reviewing 100 denied behavioral health requests at a Pennsylvania Medicaid managed care organization, OIG found that none met all applicable administrative and procedural requirements, and that all 100 notices failed to inform enrollees of their right to access the relevant documents free of charge¹⁰.

The ABA case in that report is the one to keep in mind. For a 2-year-old with an autism diagnosis, the plan asked for more information and denied 14 days later without documenting further attempts to reach the prescriber¹⁰. Part of the information it called missing was already in the request: the order lacked a state provider ID but was signed and carried an NPI¹⁰. The same service was approved 27 days later¹⁰. The audit is from Pennsylvania, not Florida, and it describes one organization. Treat it as a pattern in how notices fail, not as a Florida statistic.

Continuation of benefits is not “the child keeps services while we argue”. The regulation requires that the appeal involve the termination, suspension or reduction of previously authorized services, that the original authorization period has not expired, and that the enrollee file on time: within 10 calendar days of the notice being sent, or by the intended effective date of the cut, whichever is later². To keep services during the state fair hearing, the enrollee must request the hearing and continuation within 10 calendar days after the plan sends its notice of adverse resolution².

For children not enrolled in a plan, the operational deadlines come from the QIO’s provider manual. It asks for the initial request at least 5 business days before services start, and the continuation request between 10 and 30 business days before the current approval period ends⁷. If supporting documentation is missing, the provider has two business days to respond before a technical denial is issued⁷, and a technical denial issued for an administrative reason is not subject to reconsideration⁷: you file a new case instead.

Note the document’s own age: the manual posted by Acentra still carries the eQHealth Solutions name and a last review date of 8/24, so confirm the current steps with the QIO before you rely on them. In fee-for-service, the request for a state fair hearing must be allowed within a period that cannot exceed 90 days from the date the notice of action was mailed⁸.

As of October 15, 2026, the rules above are the ones in force: 42 CFR 438.210 for timeframes and metrics, 42 CFR part 438 subpart F for appeals, and Florida’s December 2024 coverage policy for the state’s own authorization criteria¹²⁵. What is not settled is the exact date the 7-day cap bound each Florida plan, because that follows the contract rating period, and AHCA had not posted 2026/2027 rates as of that date⁹.

None of this is legal advice. Call the plan when the question is the timeframe or form it uses; call a lawyer or a legal aid program when a denial pattern looks systemic, when the notice itself is defective, or when a fair hearing deadline is close.