Gold Carding Programs: Design Choices, State Mandates, and What They Do to Your Metrics

The logic of gold carding is disarmingly simple: if a provider's prior authorization requests for a service are approved nearly every time, the review step is adding cost and delay without changing outcomes — so stop requiring it for that provider and that service. Under the hood, though, a gold-carding program is a set of consequential design decisions about thresholds, windows, scope, and revocation, and in Texas those decisions have been made for you by statute. Meanwhile CMS-0057-F's public metrics quietly changed the math on all of it: every request you exempt is a request that exits your published denominator.

The Texas template: gold carding as a statutory right

Texas is the reference implementation. HB 3459 (87th Legislature, 2021) created Insurance Code Chapter 4201, Subchapter N, requiring state-regulated HMOs and insurers to exempt physicians and providers from preauthorization for a particular health care service when the issuer — including its affiliates — approved (or would have approved) at least 90 percent of that provider's preauthorization requests for the service during the evaluation period. HB 3812 (89th Legislature, 2025) amended the framework: the evaluation period moved from six months to one year, and the provider must have provided the particular service at least five times during that period. Texas Department of Insurance rules implement the details; TDI's own FAQ confirms exemptions are evaluated per service against a minimum of five eligible requests at the 90 percent threshold.

The mechanics that follow from the statute are instructive for anyone designing a program, mandated or not:

• The exemption attaches to an NPI and a service. Under TDI rules, exemptions are granted under the NPI a provider uses to submit requests, per particular health care service subject to preauthorization — not blanket, not per specialty.
• Evaluation is automatic and periodic. Issuers must evaluate whether a provider qualifies once every year (originally every six months) and send notices granting or denying exemptions; the "would have approved" language means issuers must score requests even where no determination formally issued.
• Rescission is constrained. An issuer wanting to rescind an exemption must conduct a retrospective review of a sample — between five and twenty claims from the evaluation period — and find that fewer than 90 percent met the medical-necessity criteria the issuer would have applied prospectively. The provider can take that determination to an independent review organization, and HB 3812 added issuer reporting to TDI on exemptions granted, denied, rescinded, and the outcomes of independent reviews.
• Scope is bounded by regulation type. The statute reaches state-regulated commercial coverage — the "TDI/DOI on the card" test — not self-funded ERISA plans, and not Medicare Advantage or Medicaid, which sit under federal and separate state frameworks.

Other states have enacted their own variants with different thresholds, windows, and lines of business, and the map keeps changing — verify the statute in each state you operate in rather than generalizing from Texas. But the Texas structure — per-service, per-provider, threshold plus minimum volume, constrained revocation, external review — is the skeleton most legislation and most voluntary programs share.

Design choices for a voluntary program

If you are building gold carding without a mandate — as burden reduction, network relations, or a hedge against the legislation arriving anyway — the same levers need explicit settings.

Eligibility window and volume floor. A short window reacts faster but is noisier; five requests over a year (the Texas floor) is a thin evidentiary base, and a provider can qualify on 5-for-5 luck. Longer windows and higher volume floors make the exemption statistically honest at the cost of excluding low-volume providers — which is exactly the trade the Texas amendment made when it stretched the window to a year and added the volume minimum.

Service scope. Per-code exemptions are precise but administratively heavy; service-category exemptions are legible to providers but can sweep in codes with genuinely different approval profiles. The honest approach is to score at the level your clinical criteria actually vary. An imaging category where every code runs the same criteria can be one exemption; grouping spinal procedures with wildly different medical-necessity profiles cannot.

What "approved" means. Partial approvals, approvals after peer-to-peer, and approvals on appeal all inflate or deflate the rate depending on how you count them. Decide before launch, write it down, and apply it the way you apply your metrics definitions — because a provider denied an exemption will ask, and in Texas they can ask an independent reviewer.

Revocation and the audit backstop. Every gold card shifts your control point from prospective review to retrospective monitoring. That means claims-based surveillance for utilization drift on exempted services, a sampling methodology you can defend, and a rescission process with due process built in. A program that can only grant and never defensibly revoke will accumulate exemptions it no longer believes in.

What gold carding does to your CMS-0057-F metrics

Here is the interaction UM leaders keep underestimating. CMS-0057-F requires impacted payers to publish annual prior authorization metrics — approval and denial percentages, appeal outcomes, decision timing — with the first reports due March 31, 2026. Gold carding rewrites those numbers without changing a single clinical decision.

The mechanism is selection. Gold-carded requests were, by construction, your highest-approval traffic — that is how they earned the exemption. Remove them from the request stream and the remaining pool is enriched for the marginal, contested cases. Your published approval rate can fall while your actual behavior is unchanged or friendlier; your average decision time can rise because the fast, obvious approvals left the denominator. A payer that aggressively gold-cards and a payer that reviews everything will publish numbers that are not comparable — and nothing in the published format explains that.

None of this is a reason not to gold-card. It is a reason to instrument. Track exempted volume as a first-class metric beside the published ones: how many requests would have been submitted (claims data for exempted provider-service pairs is your proxy), what share of total PA-subject volume is exempt, and how the exempt share trends. When your denial percentage ticks up year over year, you want to be able to show — internally and to anyone who asks — how much of the movement is mix shift from exemptions rather than tightened review. The same discipline your metrics definitions document applies to requests and denials should cover exemptions explicitly: are gold-carded services still on your published list of items requiring prior authorization, with a footnote, or off it entirely? For Texas business the list question has a statutory edge, since exemption notices carry claim-coding guidance and providers rely on them.

There is also a quieter alignment worth noticing: gold carding and the rule's transparency push point the same direction. A payer whose denial rates on a service run near zero is paying review costs to generate abrasion, and now publishing the evidence annually. The metrics give you the targeting data — services and provider cohorts with sustained near-total approval — and a gold-card program is the operationally clean way to act on it before a legislature acts on it for you.

Verify state gold-carding requirements against the current statute and regulations in each state — for Texas, Insurance Code Chapter 4201 Subchapter N as amended by HB 3812 (2025) and the TDI rules at 28 TAC §§19.1730–19.1732 — and metric specifications against the CMS-0057-F rule text; both have moved recently and will move again.