Does Original Medicare Require Prior Authorization? In Six States, 39 Codes Now Do

Mostly no — and then, on January 1, 2026, yes for exactly 39 billing codes in six states. We counted those 39 codes ourselves on September 2, 2026, straight out of Appendix A of the CMS operational guide, and matched them against CMS’s own May 2026 enrollment file: 6,499,285 people are in Original Medicare in Arizona, New Jersey, Ohio, Oklahoma, Texas and Washington, which is 18.9 percent of everyone in Original Medicare nationally.

If you are not in one of those six states, nothing on this page changes your care. If you are, it changes it only if your doctor schedules one of those 39 things. That is a much smaller door than the headlines suggest — and behind it is a payment rule that is genuinely worth understanding, because it decides what your appeal is actually worth.

Does Original Medicare require prior authorization?

For most of its history, barely. That was the quiet selling point of traditional Medicare: you and your doctor decided, and the bill followed. Prior authorization was the thing that happened to other people — people in Medicare Advantage plans, people with commercial insurance, people who had to call a number and wait.

A handful of exceptions always existed, mostly in durable medical equipment, non-emergency ambulance transport, and a few outpatient procedures with a cosmetic twin. But as a general rule, Original Medicare did not ask permission first.

That rule now has a footnote, and the footnote has an address. On July 1, 2025, CMS published a notice in the Federal Register — docket CMS-5056-N — announcing a six-year model that would put prior authorization into fee-for-service Medicare for a narrow set of services, in a narrow set of places, using what the agency calls “enhanced technologies, such as Artificial Intelligence (AI) and Machine Learning (ML), along with human clinical review.”

It started taking requests on January 5, 2026, for services delivered on or after January 15.

What the 39 codes actually are

Here is where the coverage of this program tends to go soft. “Prior authorization is coming to traditional Medicare” is true, and it is also the kind of sentence that lets a reader imagine their next MRI, their cardiologist, their hip replacement. None of those are on the list.

We downloaded the WISeR Provider and Supplier Operational Guide — version 7.0, dated July 24, 2026 — and counted every code in Appendix A on September 2, 2026. There are 13 categories and 39 codes.

Read that list again and notice what it is. It is wound grafts, spinal cement, nerve stimulators, epidural injections, implanted devices for incontinence and impotence, and one knee operation. These are not the front door of American medicine. They are a specific set of procedures that CMS says have “little to no clinical, evidence-based benefit” for certain patients and a history of billing abuse.

The exclusions matter as much as the inclusions. CMS writes that the model “excludes inpatient-only services, emergency services, and services that would pose a substantial risk to patients if delayed.” Nobody is going to be sitting in an emergency room waiting on an algorithm.

Who this can actually reach

To size the group, we pulled CMS’s own Medicare Monthly Enrollment file for May 2026 — the most recent published — from the agency’s public data API on September 2, 2026, and added up the six states.

There is a detail in that data that cuts against the way this story is usually told. Those six states hold 13,432,797 Medicare enrollees in total. Of them, 6,933,512 — 51.6 percent — are in Medicare Advantage. And CMS states it flatly: “WISeR does not apply to people with Medicare Advantage and will have no impact on them.”

So inside the six states chosen for the AI prior authorization pilot, a slight majority of people on Medicare are not in it. They are in the program that has been doing prior authorization at scale for years, by other means.

The sentence that started the fight

Now the part worth your attention. It is not the AI. It is how the reviewing companies get paid.

CMS does not bury this. On its own model page, in plain sight: “Model participants receive a percentage of the expenditures associated with averted wasteful, inappropriate care as a result of their reviews.”

Six companies hold the contracts, one per state: Cohere Health in Texas, Genzeon in New Jersey, Humata Health in Oklahoma, Innovaccer in Ohio, Virtix Health in Washington, and Zyter in Arizona.

In a March 27, 2026 letter to House appropriators, 35 members of Congress described that arrangement in one sentence: WISeR contractors “are compensated via a percentage of the dollar value of the services they deny. This payment mechanism clearly creates a perverse incentive to deny care.”

That is a fair reading of the model page. It is not a complete reading of the payment rule.

What the payment document actually says

The WISeR Payment Methodology is two pages, and it adds a condition that changes the incentive:

So the incentive is not “deny everything.” It is “deny only what will stick.” A denial that gets reversed earns the company nothing, and CMS claws back money already paid. Providers can resubmit an unlimited number of times, can request a peer-to-peer review on each resubmission, and the vendor eats the processing cost each time while collecting, at most, one payment per beneficiary per service.

Which puts an unusual amount of weight on one thing: whether anyone appeals. An appeal you win does not just get your care paid for. It un-pays the reviewer.

Whether that safeguard is strong enough is a real question, and reasonable people are answering it differently. But it is a different question from the one most coverage is asking, and you cannot get to it without reading the second document.

One step deeper: the best number in the case against WISeR is about a program WISeR excludes

The congressional letter makes its argument with a striking statistic: a 2018 HHS Inspector General report found that 75 percent of denied prior authorization requests were overturned on appeal. The letter also cites a KFF estimate that Medicare Advantage insurers made roughly 50 million prior authorization determinations in 2023.

Both figures describe Medicare Advantage. And Medicare Advantage is the one part of the program CMS has explicitly carved out of this model.

That does not make the argument wrong. If anything it is the strongest available evidence for the proposition that prior authorization systems deny things they should not, and it is reasonable to expect a new system to inherit the flaw. But it is borrowed evidence, and it should be labeled as borrowed. We could not verify either figure at the original source today — oig.hhs.gov returned 403 to every automated request we made on September 2, 2026 — so we are citing them as what Congress asserted in a document we did read, not as findings we confirmed ourselves.

The list has been getting shorter, not longer

Here is something we did not expect to find, and have not seen reported anywhere: the operational guide has been revised seven times since October 2025, and the revisions have mostly been subtractions.

Version 3.0 removed CPT 22585 and delayed a planned category (lumbar decompression) entirely. Version 4.0 removed a sleep-apnea diagnosis code and the C5271–C5278 skin substitute codes. Version 6.0 removed a block of wound diagnosis codes and two more skin substitute codes. Version 5.0 added codes for one category. The rest were clarifications.

Three of six substantive revisions narrowed the program. One expanded it. CMS has said it “may add additional services in future years,” so this could reverse. But the first nine months went the other direction, and that is worth knowing if the version of this story you heard was about a program metastasizing.

Congress tried to end it in July, and missed by four votes

After the Government Accountability Office determined the model was subject to the Congressional Review Act, Senate Democrats moved to overturn it. On July 16, 2026, at 1:25 p.m., the Senate took roll call vote 199 on the motion to proceed to S.J.Res. 198.

It failed, 46 to 50, with 4 not voting.

We pulled the roster from senate.gov. The 46 yes votes were 44 Democrats and 2 independents; the 50 no votes were all Republicans. Not one senator crossed.

We then checked the twelve senators who represent the six states where the model actually operates. All twelve voted. Six voted to overturn it — Kelly and Gallego of Arizona, Booker and Kim of New Jersey, Cantwell and Murray of Washington. Six voted to let it stand — Husted and Moreno of Ohio, Lankford and Armstrong of Oklahoma, Cornyn and Cruz of Texas. The split maps exactly onto party, and not at all onto whether a senator’s constituents are in the pilot.

The fight is not over. A House panel has voted to attach language to the FY2027 HHS spending bill barring funds from being used to implement the model. That bill is not law.

What a thousand pages of records say about the first three months

Everything above is what the program is supposed to be, read off federal documents. In September 2026 we finally got to see how it ran.

The Electronic Frontier Foundation sued CMS for WISeR records on March 25, 2026. It published its own reading of the response on September 8, 2026, and the documents themselves went up the next day — about a thousand pages, including six spreadsheets of operational data. STAT reported on September 15 that the records show a rushed launch, including a vendor warning CMS that its timeline was unrealistic.

We did something slightly different with the same release: we opened the two “submission status” workbooks and counted the cases. Each workbook is a list of prior authorization cases still sitting open in a Medicare contractor’s queue on a given date, with the age of each case in days. There are three dates in the files — March 5, March 13 and March 25, 2026 — and two states, New Jersey and Texas. We deduplicated by the case ID in the file, so a case that appears on both a Part A and a Part B line is counted once.

First, the benchmark, because nothing in the press coverage states it. Section 4 of the operational guide says WISeR reviewers “will plan to issue a determination to the requester within 3 calendar days of receiving the initial or resubmitted request,” and that “expedited requests will be completed within 2 calendar days.” That is the promise the records should be measured against. Here is the measurement.

Snapshot date	Cases still open	Median days waiting	Oldest case
March 5, 2026	765 (617 NJ, 148 TX)	24	60 days
March 13, 2026	350 (234 NJ, 116 TX)	16	68 days
March 25, 2026	283 (152 NJ, 131 TX)	22	80 days

Our tabulation of cms000157_0000088.xlsx and cms000157_0000089.xlsx from the EFF release, computed September 16, 2026. Cases deduplicated by case ID; 96 of the 283 open on March 25 had been waiting more than 30 days.

The reason most of those cases were stuck turns out to be mundane and, if you are the patient, maddening. On March 5, 468 of the 765 open cases were sitting at a sub-status called “UTN Creation Failure.” A UTN is the unique tracking number a prior authorization gets when it is accepted; without one, the provider is told to hold the claim rather than submit it. So the file is not mostly a record of clinicians arguing about medical necessity. It is mostly a record of paperwork that could not get a number.

One more thing the coverage has not said. The two states in these spreadsheets are New Jersey and Texas, and CMS’s participant table assigns those to Genzeon and Cohere Health — not to the two companies named in most of the reporting. The problems were not confined to one vendor’s portal.

The lane built for the cases that cannot wait

Inside WISeR there is a faster path. The operational guide says a requester may ask for expedited review “if delays could seriously jeopardize the WISeR Beneficiary’s life, health, or ability to regain maximum function,” and that a confirmed expedited request gets a decision within 2 calendar days.

We counted those separately, because that is where a delay stops being an inconvenience.

On March 5 there were 149 expedited cases still open, with a median age of 25 days. On March 13 there were 73. On March 25 there were 47, median 18 days, eleven of them past 30 days, and the oldest had been waiting 72 days. Every expedited case in all three snapshots was past its two-day window.

Put the promise and the record side by side and the gap is the whole story.

What the CMS guide says	What the records show	Where we read it
Standard request: determination “within 3 calendar days”	Median open case 22 days, oldest 80 days (March 25, 2026)	Guide Section 4; our count of the status workbooks
Expedited request: “completed within 2 calendar days”	47 still open, median 18 days, oldest 72 days	Guide Section 4; our count, same file
Accepted requests get a tracking number (UTN)	468 of 765 stuck cases had no number yet (March 5, 2026)	Sub-status field in the same workbooks
An affirmed UTN is good for 120 calendar days	Unchanged — but a 2-month wait eats a third of it	Guide Section 4

The AI program whose front door was a fax machine

The Federal Register notice sold this model on “enhanced technologies, such as Artificial Intelligence (AI) and Machine Learning (ML).” One of the workbooks in the release records how the requests actually arrived.

In the week of January 5, 2026, the contractor covering Arizona and Washington logged 632 prior authorization receipts. 498 of them came in by fax. In Washington, requests sent straight to the reviewing company were 99.3 percent fax by the week of January 19. In Arizona they were 98.9 percent mail by the week of January 25 — 535 envelopes out of 541 requests.

This matters for a reason beyond the joke. If you are told a program uses artificial intelligence to speed up decisions, and its intake is a fax tray, then the thing most likely to delay your surgery in month one is not the algorithm’s judgment. It is a sheet of paper that nobody has keyed in yet. Those are different problems with different fixes, and only one of them gets argued about in public.

What the people filing these requests told CMS, in CMS’s own survey

The release also contains CMS’s WISeR feedback survey. Five files, exported weekly — and cumulative, which is a trap: the raw rows add up to 140 responses, but after deduplicating on timestamp and named company there are 80 unique responses, dated March 9 through April 3, 2026. We report the 80.

Seventy of them answered the satisfaction question. Fifty-six were dissatisfied and 44 of those picked the most negative option on the form. Five were satisfied. The companies named were Zyter 31 times, Virtix 24, Innovaccer 22, Cohere Health twice and Humata Health once.

Three lines from the free-text answers, each quoted once and in full:

“During training, we were told the review process would take 3 days, however, the time actually took 2 or more weeks.” — a Washington respondent

“This has created such an administrative burden and is delaying care for our seniors.” — a Washington respondent

“We have patients calling our offices crying in pain because their procedures are being delayed while awaiting approvals or guidance tied to this model.” — an Ohio respondent

What the complaints are about is worth noticing, because it is not the algorithm. We read all 80 and counted themes: 17 mention delay or timeliness, 13 mention the tracking number, 8 say they could not get a human being on the phone or an answer to an email, and 6 name one form field — the provider identification number the portal kept reporting as missing when it was not.

Two mention the fax. Seventeen do dispute a denial or the reasoning behind one — so the clinical argument is real — but it shares the page with an equal number of complaints about the clock.

What the records change, and what they do not

We re-verified the boring parts today, because a document dump is exactly when people start repeating numbers that have quietly moved.

The operational guide is still version 7.0, dated July 24, 2026, and Appendix A still holds 13 tables and 39 codes — we re-counted them on September 16, 2026, and the list is identical to our September 2 count. CMS’s model page was last modified September 10, 2026; it still runs the model to December 31, 2031, still lists the same six states, and still says WISeR “does not apply to people with Medicare Advantage and will have no impact on them.” Nothing in the records expands who is in scope.

This is also where our reporting on private insurers using AI to deny claims and this page stop describing the same thing: there the argument is about the denial, here it is about the wait. What the records change is the answer to a different question: not “can this reach me,” but “if it reaches me, how long will I wait.” Until this month there was no public number for that. Now there is one, and it is not three days.

Three findings we are citing to EFF rather than to our own reading, because they sit in the narrative pages rather than in the spreadsheets we tabulated: that one request went unanswered for 83 days (EFF cites page 234 of the combined records, and it lines up with the 80-day case we found in the two states we could count), that a vendor initially planned to auto-affirm every request until it could build the real thing, and that quality-score violations reduce a vendor’s payment by only 5 to 10 percent. Those are EFF’s readings of the release, linked so you can check them against ours.

And one measure of how thin the public record still is. We pulled the ten pages Google ranks today for “is medicare using ai to determine coverage” — the way people actually type this question — and read the seven that let us fetch them. Three name WISeR. None mentions the September records, none states the three-day standard, none mentions that an expedited path exists, and one tells you how to file an appeal. That is the gap this page is trying to fill, and it is also why the next section is the part worth keeping.

WISeR before launch, and four months into prior authorization

The first was recorded before the model went live, when all anyone had was the design. The second is from four months in.

Confirm you’re in scope, then ask your doctor about WISeR codes

Does a licensed clinician still decide every denial?

Does an AI make the final call? No, according to CMS’s own documents. “All recommendations for non-payment are determined by appropriately licensed clinicians,” and the payment methodology repeats it: “Every non-affirmation must undergo a medical review by an appropriately licensed WISeR clinician or WISeR clinical reviewer.” What the technology does is triage and speed. Whether a clinician reviewing at machine pace is meaningfully reviewing is the argument.

Can this spread to your state? The model is authorized through 2031 in six states, and the Federal Register notice says CMS “may add additional services in future years.” It says nothing about adding states. Any expansion would be new rulemaking, which means a new public document you could read.

Is there a way out for good providers? Yes — a “gold card” exemption. Providers with demonstrated compliance records can be exempted from review entirely, evaluated quarterly.

Where else is AI already touching your money? We have been tracking this: whether AI data centers are raising your electric bill, and how to reach a human when a company puts a bot in front of one.

Which six states and procedures fall under the WISeR model?

Does Original Medicare require prior authorization?

Historically, almost never — and still not for the overwhelming majority of care. But since January 1, 2026, 39 billing codes require prior authorization or pre-payment review for people in Original Medicare in six states: Arizona, New Jersey, Ohio, Oklahoma, Texas and Washington. Everything else is unchanged.

Will Original Medicare require prior authorization in 2026?

It already does, for that narrow list. The WISeR Model began January 1, 2026 and is authorized through December 31, 2031. It began accepting requests January 5, 2026, applying to services delivered on or after January 15, 2026.

What is the WISeR model?

WISeR stands for Wasteful and Inappropriate Service Reduction. It is a CMS Innovation Center model that pays private technology companies to review medical necessity for a selected set of services in Original Medicare, using AI and machine learning plus human clinical review. It is the first Innovation Center model in which technology companies are the only participants.

What are the WISeR model states?

Six: Arizona, New Jersey, Ohio, Oklahoma, Texas and Washington. Each is assigned to one company — Zyter in Arizona, Genzeon in New Jersey, Innovaccer in Ohio, Humata Health in Oklahoma, Cohere Health in Texas, and Virtix Health in Washington.

What procedures are on the WISeR 2026 list?

Thirteen categories, 39 codes as of guide version 7.0 dated July 24, 2026: skin substitutes for chronic leg wounds (8 codes), vertebral augmentation (6), incontinence control devices (5), epidural steroid injections (5), treatment of impotence (3), hypoglossal nerve stimulation for sleep apnea (3), induced lesions of nerve tracts (2), phrenic nerve stimulator (2), and one code each for knee arthroscopy, vagus nerve stimulation, electrical nerve stimulators, sacral nerve stimulation and cervical fusion.

Does Medicare use AI to deny claims?

In this model, AI assists the review but does not issue the denial. CMS states that all recommendations for non-payment are determined by appropriately licensed clinicians. The reviewing companies are paid a share of averted spending, but only for determinations that are not overturned on resubmission or appeal — and CMS recoups payment when a denied claim is successfully appealed.

Does this apply to Medicare Advantage?

No. CMS says directly: “WISeR does not apply to people with Medicare Advantage and will have no impact on them.” Medicare Advantage plans run their own separate prior authorization programs, which this model does not govern.

Can I appeal a WISeR denial?

Yes. CMS states that providers, suppliers and beneficiaries “continue to have all applicable administrative appeal rights under Medicare.” Your provider can also resubmit an unlimited number of times and request a peer-to-peer clinical review. Start at medicare.gov’s appeals page, or call 1-800-MEDICARE.

How long is a WISeR prior authorization supposed to take?

Three calendar days for a standard request and two for an expedited one, according to Section 4 of the CMS WISeR operational guide, version 7.0. An approval’s tracking number is then valid for 120 calendar days. Those are targets in a CMS document, not rights you can enforce: records released in September 2026 show cases open far longer, including one that had been waiting 80 days on March 25, 2026.

What did the September 2026 WISeR records show?

About 1,000 pages of CMS records, released after a Freedom of Information Act lawsuit by the Electronic Frontier Foundation, describe a rushed first quarter. Our own count of the spreadsheets in that release: on March 25, 2026, 283 prior authorization cases were still open in the New Jersey and Texas queues, the median one had waited 22 days against a 3-day target, and 47 had been filed as expedited.

In CMS’s own feedback survey, 56 of the 70 respondents who answered were dissatisfied. The records do not change who is in scope — still 39 codes, six states, Original Medicare only.

Sources

• CMS, WISeR (Wasteful and Inappropriate Service Reduction) Model — model page, last modified September 10, 2026. Read September 2 and re-read September 16, 2026.
• CMS, WISeR Provider and Supplier Operational Guide (PDF) — version 7.0, July 24, 2026. Appendix A code count (re-counted September 16, 2026: still 13 tables, 39 codes), version history, and the Section 4 turnaround time frames.
• CMS, WISeR Model Payment Methodology (PDF) — payment conditions, safeguards, recoupment.
• Federal Register, 90 FR / document 2025-12195, docket CMS-5056-N — published July 1, 2025.
• CMS, Medicare Monthly Enrollment — May 2026 file, retrieved via the public API September 2, 2026.
• U.S. Senate, Roll Call Vote 199 — S.J.Res. 198, July 16, 2026, motion to proceed rejected 46–50.
• Letter to House Appropriations LHHS Subcommittee (PDF) — March 27, 2026, 35 signatories.
• Medicare.gov, Filing an appeal and State Health Insurance Assistance Programs. Both read September 2, 2026.
• Electronic Frontier Foundation, “New Records Reveal Problems with Medicare’s AI Prior Authorization Experiment” — September 8, 2026, and the document set at EFF v. CMS, posted September 9, 2026. The files we tabulated ourselves: cms000157_0000088.xlsx and _0000089.xlsx (submission status), _0000067.xlsx (receipt volumes), and _0000020/23/26/29/32.xlsx (feedback survey). Read and counted September 16, 2026.
• STAT, “Medicare’s AI prior authorization pilot was rushed and full of problems, new documents reveal” — September 15, 2026, by Brittany Trang. Partly paywalled; we cite only what is visible.

Reading a 128-page Medicare handbook, and keeping records private

• The Briefing — our daily read on where AI meets your wallet.
• AI Scam Watch: September 2026 — the $893 million the FBI logged, and which scams actually took it.
• Is it safe to upload medical records to ChatGPT? — why HIPAA does not follow your file.
• How to get ChatGPT to read a PDF — useful if you are trying to read a 128-page Medicare handbook.
• How to prep for a doctor visit with ChatGPT — questions worth asking before a procedure is scheduled.
• How do I talk to a real person? — the numbers that still reach a human.
• Your 2027 Social Security raise, and what Medicare takes back.
• How to tell if a phone call is AI — useful when someone calls claiming to be about your Medicare.
• How to tell if a Facebook ad is fake.
• How to tell if a picture is AI generated.
• The best AI tools for seniors in 2026.
• How to write letters and emails with ChatGPT — including appeal and complaint letters.
• How do I get rid of AI on my phone?
• Are deleted ChatGPT chats really deleted?
• How we count — our method for the numbers in this piece.
• Start here — if this is your first time on the site.
• Ask — send us a question and we will answer it in public.
• FAQ and Resources.

Written by Prof. H. Every figure here was read from a federal document or computed from a federal data file on September 2, 2026, and the documents are linked above so you can check the arithmetic. Updated September 16, 2026 with the WISeR records released in EFF v. CMS, which we tabulated ourselves that day; the September 2 figures above were re-verified against the same federal documents and are unchanged. Corrections and questions: the Ask page.