The State Prior-Auth Reform Map

Insurance is regulated twice in America — once in Washington and once in fifty state capitols — and prior authorization reform is happening almost entirely in the second place. Since Texas issued the first “gold cards” in 2021, state legislatures have passed dozens of laws constraining how insurers run prior auth: who is qualified to say no, how fast the answer must come, and — the newest front — what an algorithm is allowed to decide.¹¹

One limit applies to every row below. State insurance law reaches only state-regulated coverage: fully insured employer plans, marketplace plans, and, where the statute says so, state-employee benefits. Self-funded employer plans are governed by ERISA and answer to federal rules, not to any statute on this page. Before you plan around a state deadline, confirm which kind of plan you are dealing with — our appeals-process guide covers how to tell.

The wave, counted

2021

1st¹

Texas HB 3459 — the first statewide gold-card law

2023

9+DC¹¹

states enacted prior-auth reform laws, per the AMA's tally

2024

10¹²

more states enacted reforms — CO, IL, ME, MD, MN, MS, OK, VT, VA, WY (AMA)

2025

110+¹⁴

prior-auth bills tracked across 40 states in the session (ASCO)

The ledger, by category

Four reform categories carry most of the weight. The same statute can appear in more than one — Texas HB 3459 is both a gold-card law and a peer-review law — so read by category, not by state.

Gold-carding — exemptions earned by track record

Providers whose requests are almost always approved earn an exemption from prior authorization — the payer's own approval data makes the case that reviewing them is waste.

TX2021
Texas — HB 3459¹
The original. A physician earns a continuing exemption for a service after five or more requests with a 90% approval rate over six months; the Texas Department of Insurance administers and enforces it.
↳ TDI-regulated plans only — ERISA self-funded plans are outside its reach
WV2023
West Virginia — SB 267 (amending the 2019 prior-auth law)³⁴
SB 267 revised the state’s gold-card status: a provider is exempt for at least six months after a 90% final-approval rating over a six-month period, in a service where they average 30 procedures. Enforced by the Offices of the Insurance Commissioner (Bulletin 24-03).
AR2025
Arkansas — Act 575 (2023), amended by Act 511⁵⁶
Exemption at a 90% approval rate over twelve months. The 2025 amendment extends a physician's gold card to their group practice and removes the insurer's unilateral withdrawal trigger.
CO2024
Colorado — HB24-1149⁷
Honesty requires the asterisk: not a blanket gold card. The law requires insurers to adopt programs that modify prior-auth requirements for qualified providers (exemption programs among them), bars re-authorizing a chronic maintenance drug more than once every three years, and extends approval durations to a full calendar year. Effective August 2024.
↳ Alternative-program mandate — weaker than the TX/WV/AR earned-exemption model

Response clocks — deadlines with consequences

Statutory time limits on the payer's answer. The strongest versions carry a default judgment: miss the clock and the authorization is granted.

MI2022
Michigan — SB 247 / Public Act 60 of 2022⁸
72 hours for urgent requests; seven calendar days for non-urgent (tightened from nine in 2024). The teeth: a request the insurer fails to act on in time is deemed granted.
IN2025
Indiana — SEA 480⁹
The fastest verified clocks on this ledger: 24 hours urgent, 48 hours non-urgent, applying to plans issued or renewed from July 1, 2025. Also bars prior auth on the first twelve physical-therapy or chiropractic visits per episode.

Qualified review — who is allowed to say no

Requirements that denials and pre-denial peer-to-peer calls be handled by a physician who actually practices in the field being reviewed.

TX2021
Texas — HB 3459 (peer-review provision)²
The same statute that created gold cards also requires that a peer-to-peer call before a utilization review denial be conducted by a Texas-licensed physician of the same or a similar specialty as the requesting physician.
MT2025
Montana — HB 399 (five-bill package)¹⁰
Adverse prior-auth determinations must be reviewed by a physician in the relevant specialty; the law also bars prior auth on generic drugs and pre-existing prescriptions. Part of a five-bill 2025 package that included continuity-of-care protections.

AI review — limits on the algorithm

The newest front: statutes that bar an algorithm from being the decision-maker on medical necessity and put the final call on a licensed clinician.

CA2024
California — SB 1120 — “Physicians Make Decisions Act”¹⁵¹⁶
AI, algorithms, and similar software may not deny, delay, or modify care based on medical necessity; that determination belongs only to a licensed physician or a licensed professional competent to evaluate the clinical issues. The Department of Insurance has issued implementing guidance.
TX2025
Texas — SB 815¹⁷
An AI algorithm may not be the sole basis for denying, delaying, or modifying care on medical-necessity grounds; TDI gains authority to audit how utilization review agents use AI. Effective September 1, 2025.

TRACKER LOG · updated July 2026 — 8 states, 11 named laws, 10 ledger rows, each checked against the statute text or the named tracker · next scheduled pass: October 2026 · cadence: quarterly.

What a practice does with this

Two practical uses. If you practice in a gold-card state, ask each payer for your exemption status in writing — the statutes make the payer do the math, not volunteer the result. And when a prior-auth denial does land, these laws are appeal material: a denial issued past a statutory deadline, by a reviewer outside the specialty, or by an algorithm in a state that forbids it is a procedural defect worth naming. Our prior-authorization guide covers the request-side mechanics; the appeals-process and external-review guides cover what happens after a no.

Methodology & caveats

Each ledger row was verified in July 2026 against the state legislature's bill record or the state regulator's implementation page (linked in the sources); session counts are attributed to the organization that produced them (AMA, ASCO) rather than recounted by us. Categories overlap by design — one statute can hold several reforms — so rows count laws-in-category, not states.

Deliberately omitted from this pass: states whose reforms we could not yet tie to a named, checkable statute (Louisiana's gold-card law among them — widely reported, but we had not verified the act text by press time), everything enacted after June 2026, and Medicaid fee-for-service rules, which follow a different legal track. Omission is a verification status, not a judgment that no law exists. Rows are added as they clear the check; the tracker log above records each pass.