42 CFR § 440.230 - Sufficiency of amount, duration, and scope.
(a) The plan must specify the amount, duration, and scope of each service that it provides for—
(1) The categorically needy; and
(2) Each covered group of medically needy.
(b) Each service must be sufficient in amount, duration, and scope to reasonably achieve its purpose.
(c) The Medicaid agency may not arbitrarily deny or reduce the amount, duration, or scope of a required service under §§ 440.210 and 440.220 to an otherwise eligible beneficiary solely because of the diagnosis, type of illness, or condition.
(d) The agency may place appropriate limits on a service based on such criteria as medical necessity or on utilization control procedures.
(e) For prior authorization requests for items and services (excluding drugs, as defined in § 431.60(b)(6) of this chapter), the State Medicaid agency must—
(1) Beginning January 1, 2026, make prior authorization decisions within the following timeframes:
(i) For a standard determination, as expeditiously as a beneficiary's health condition requires, but in no case later than 7 calendar days after receiving the request, unless a shorter minimum timeframe is established under State law. The timeframe for standard authorization decisions can be extended by up to 14 calendar days if the beneficiary or provider requests an extension, or if the State agency determines that additional information from the provider is needed to make a decision.
(ii) For an expedited determination, as expeditiously as a beneficiary's health condition requires, but in no case later than 72 hours after receiving the request, unless a shorter minimum timeframe is established under State law.
(2) Provide the beneficiary with notice of the agency's prior authorization decision in accordance with § 435.917 of this chapter and provide fair hearing rights, including advance notice, in accordance with part 431, subpart E, of this chapter.
(3) Beginning in 2026, annually report prior authorization data, excluding data on drugs, as defined in § 431.60(b)(6) of this chapter, at the State level by March 31. The State must make the following data from the previous calendar year publicly accessible by posting them on its website:
(i) A list of all items and services that require prior authorization.
(ii) The percentage of standard prior authorization requests that were approved, aggregated for all items and services.
(iii) The percentage of standard prior authorization requests that were denied, aggregated for all items and services.
(iv) The percentage of standard prior authorization requests that were approved after appeal, aggregated for all items and services.
(v) The percentage of prior authorization requests for which the timeframe for review was extended, and the request was approved, aggregated for all items and services.
(vi) The percentage of expedited prior authorization requests that were approved, aggregated for all items and services.
(vii) The percentage of expedited prior authorization requests that were denied, aggregated for all items and services.
(viii) The average and median time that elapsed between the submission of a request and a determination by the State Medicaid agency, for standard prior authorizations, aggregated for all items and services.
(ix) The average and median time that elapsed between the submission of a request and a decision by the State Medicaid agency for expedited prior authorizations, aggregated for all items and services.