Medicaid Managed Care PA: Where Federal Floors Meet State Contracts

Prior authorization compliance in Medicaid managed care has a structure that trips up payers arriving from the commercial or Medicare Advantage worlds: the binding rule set is almost never the federal regulation alone. Federal law sets a floor at 42 CFR 438.210; the state Medicaid agency contracts on top of it, frequently with stricter timeframes, additional carve-outs, and reporting obligations of its own; and the MCO answers to the state, which in turn answers to CMS. A multi-state plan is therefore not running one Medicaid PA program — it is running as many programs as it has state contracts, over one operating platform.

This article walks the federal floor as amended by CMS-0057-F, then the state layer, then what a compliance architecture that survives both looks like.

The federal floor: 42 CFR 438.210, post-amendment

Section 438.210 is written as contract requirements — things every contract between a state and an MCO, PIHP, or PAHP "must provide for" — which is itself the tell about how enforcement flows. The pieces that matter for prior authorization:

Standard decisions: 7 calendar days. Under 438.210(d)(1), standard authorization decisions must be noticed "as expeditiously as the enrollee's condition requires," within state-established timeframes that may not exceed 14 calendar days for rating periods starting before January 1, 2026, and 7 calendar days for rating periods starting on or after that date. The 7-day figure is the CMS-0057-F amendment (89 FR 8980, amending the section in February 2024) — it halved the prior federal ceiling. Note the trigger: rating periods starting on or after January 1, 2026, so a plan whose rating period began July 1, 2025 carried the 14-day ceiling until its mid-2026 renewal.

Expedited decisions: 72 hours. Under 438.210(d)(2), where the provider indicates — or the plan determines — that the standard timeframe could seriously jeopardize the enrollee's life, health, or ability to attain, maintain, or regain maximum function, the plan must decide and notify no later than 72 hours after receipt. CMS-0057-F left this figure unchanged; it was already tighter than the rule's cross-program 72-hour expedited standard needed it to be.

Extensions: up to 14 additional calendar days. Both tracks can be extended by up to 14 calendar days if the enrollee or provider requests it, or if the plan justifies — to the state agency, on request — a need for additional information and how the delay is in the enrollee's interest. That second clause deserves respect: the justification standard is enrollee benefit, not plan convenience, and extension usage is now publicly visible (below). Plans that used extensions as a pressure-relief valve for staffing are advertising that fact annually.

Public metrics at the plan level. CMS-0057-F added 438.210(f): beginning January 1, 2026, each MCO, PIHP, or PAHP must post plan-level prior authorization data on its website by March 31 following each contract year — the list of items and services requiring PA, approval and denial percentages for standard and expedited requests, approvals after appeal, the percentage of extended-and-approved requests, and average and median decision times, all excluding drugs. The mechanics overlap with the cross-payer report covered in the metrics article, but the Medicaid wrinkle is the plan-level granularity — a national Medicaid carrier posts per-plan numbers, state by state, which makes cross-state variation in its own operations publicly comparable.

Around the timeframes sit older 438.210 requirements that state auditors lean on heavily: authorization policies must cover "initial and continuing authorizations" with written procedures, review criteria must be applied consistently with mechanisms to ensure it, any denial or reduction must be made by someone with appropriate clinical expertise, adverse decisions trigger the notice machinery of 438.404, and — per 438.210(e) — UM compensation must not incentivize denials. Delegating review does not delegate any of this; 42 CFR 438.230 keeps ultimate responsibility with the plan, a chain examined in the delegation oversight article.

The state layer: where the floor stops mattering

Everything above is the minimum a state contract may allow. States are explicitly free to set shorter timeframes — 438.210(d)(1) says "state established time frames that may not exceed" the federal ceiling — and many do. KFF's survey work on Medicaid managed care PA policies found roughly half of responding MCO states already required standard decisions in 7 calendar days or less before the federal change took effect, with a meaningful group requiring shorter-than-72-hour expedited decisions. Qualitatively, the state layer varies along several axes at once:

• Tighter clocks, sometimes expressed in business days or hours, and sometimes different for specific services (behavioral health, home- and community-based services, EPSDT-related requests for enrollees under 21).
• PA prohibitions and carve-outs — services a state forbids the MCO from subjecting to prior authorization at all, or routes to a state vendor instead.
• Continuity requirements — honoring an outgoing plan's authorizations for a transition period after an enrollee changes plans, with the period varying by state and population.
• State-specific reporting — PA turnaround and denial reports to the state agency on the state's template and cadence, separate from and rarely aligned with the federal public metrics.
• Definitional drift — states define "receipt," "clean request," and "urgent" in contract language that does not always match the federal regulation's phrasing, which matters enormously when computing a clock.

The compliance trap for a multi-state MCO is treating any of this as footnote variation on a federal theme. The state contract is the enforceable instrument; the state agency is the auditor with sanction authority, corrective action plans, and — in the worst cases — enrollment freezes. Federal 438.210 compliance is necessary and nowhere near sufficient.

Engineering for the stack: strictest-rule-wins

The only architecture that survives this is one that treats the applicable rule as data, resolved per request. Every authorization request carries attributes — state, program, population, service category, urgency — and a rules layer resolves them to the binding parameters: decision deadline, extension allowance, notice requirements, reviewer qualifications. The resolution principle is strictest-rule-wins between the federal floor and the state contract, evaluated per parameter rather than per document (a state can be stricter on standard timeframes while silent on extensions). The general pattern — and why hardcoding any of it is a mistake — is the subject of the strictest-rule-engine article; the Medicaid-specific points are worth stating on their own:

Rating-period awareness. The 7-day federal ceiling attached by rating period, and state contract amendments attach by contract year. A rules layer that cannot represent "this parameter changes for this plan on this date" forces big-bang cutovers that never land cleanly.

Calendar-day discipline. The federal timeframes are calendar days from receipt of the request. Where a state contract speaks in business days, the conversion must live in the rules layer, not in the heads of intake staff — and receipt-date capture must be channel-honest, since a request faxed on Saturday started its federal clock on Saturday. The intake mechanics are covered in the fax and legacy channels article.

Extension governance. Because extensions require a justification the state can demand and now feed a public metric, treat every extension as a structured event: who invoked it, on which ground, with what documentation. A free-text "extended per policy" note satisfies nobody in 2026.

Evidence per state. When a state agency audits, it will ask for turnaround distributions computed under its definitions. If your metrics pipeline computes one national number, each audit becomes a bespoke data project. Compute per state-program from the start; aggregate upward for the federal report.

The honest framing for a compliance lead building a multi-state Medicaid PA program: the federal floor tells you the worst you may do, the state contract tells you what you must do, and your platform decides whether knowing the difference takes a query or a war room.

Verify current timeframe and reporting language against 42 CFR 438.210 on eCFR, your state contracts and Medicaid managed care manuals, and the CMS-0057-F rule text (89 FR 8758) — state contract cycles amend faster than federal regulations.