EDI 278 — Prior Authorization Request & Response
The 278 transaction (Health Care Services Review — Request for Review and Response) enables providers to electronically submit prior authorization requests to payers and receive approval, denial, or pend decisions.
When Prior Authorization is Required
Payers typically require prior auth for:
- Elective and non-emergency surgeries
- Advanced diagnostic imaging (MRI, CT, PET scans)
- Specialty medications and biologics
- Inpatient hospital admissions
- Behavioral health services (residential treatment, intensive outpatient)
- Home health and skilled nursing facility admissions
- Durable medical equipment (DME) above cost thresholds
- Genetic testing and advanced diagnostics
278 Request (Provider → Payer)
The provider submits:
- Patient demographics and insurance details
- Requesting provider NPI and contact information
- Servicing/rendering provider information
- Diagnosis codes (ICD-10) supporting medical necessity
- Procedure codes (CPT/HCPCS) for requested services
- Quantity and duration of services requested
- Facility information (if applicable)
- Supporting clinical documentation may be requested separately
278 Response (Payer → Provider)
The payer responds with:
- Certified (Approved) — Authorization granted with approval number, valid dates, and authorized units
- Not Certified (Denied) — Authorization denied with denial reason
- Pended — Additional information required before decision
- Modified — Approved for a different quantity, duration, or service than requested
Transition to FHIR
The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) mandates that payers transition prior authorization to FHIR-based APIs using the Da Vinci PAS (Prior Authorization Support) implementation guide:
| Current Process | Future State |
|---|---|
| EDI 278 batch/real-time | FHIR $submit operation (real-time) |
| Phone/fax submissions | FHIR CRD + DTR (automated) |
| Days-to-weeks response times | 72 hours (urgent) / 7 days (standard) |
| Limited reason codes | Specific, actionable denial reasons |
The CMS mandate requires compliance by January 1, 2026 for certain provisions and January 1, 2027 for full implementation.
