2026 prior authorization changes: CMS's WISeR model

Key Takeaways

• CMS's WISeR model, running January 1, 2026 through December 31, 2031, adds new prior authorization requirements to Original Medicare, but only in six specific states: New Jersey, Ohio, Oklahoma, Texas, Arizona, and Washington, not nationally.

• The model covers a defined list of service categories CMS has identified as high-risk for overuse, including epidural steroid injections, knee arthroscopy for osteoarthritis, cervical fusion, electrical nerve stimulator implants, and skin substitutes for chronic wounds; sources differ on the exact count, citing figures from roughly 13 to 17 categories.

• This is a meaningful shift specifically for practices in the six affected states that historically didn't need prior authorization under traditional Medicare, since the model targets fee-for-service Medicare, not just Medicare Advantage plans, which already used prior authorization more broadly.

• The most common cash flow failure point isn't the authorization decision itself; it's authorization expiring before the service is actually performed, or a scheduling change occurring without updating the authorization to match.

• An authorization approved for the wrong CPT or HCPCS code produces a denial even when the underlying medical necessity was genuinely approved, since the payer's system matches the billed code against the specific approved code, not the general service category.

A practice in Texas performs a knee arthroscopy for osteoarthritis, a procedure that never required prior authorization under traditional Medicare in prior years, and the claim comes back denied for lack of authorization. This isn't a billing error. It's a direct consequence of CMS's WISeR model, which added this exact procedure category to the list requiring prior authorization starting in 2026 for practices in six specific states, and practices that haven't updated their intake workflow are the ones absorbing the resulting denials.

Numetix takes an expert-led, AI-powered, and human-in-the-loop approach to prior authorization tracking, flagging newly covered service categories before a claim gets denied for a requirement the practice didn't know applied yet. This guide covers what WISeR actually changed, exactly where it applies, and where the revenue cycle typically breaks under it.

Quick Answer: What does CMS's 2026 WISeR prior authorization model cover?

• WISeR adds prior authorization requirements to a defined list of service categories under traditional, fee-for-service Medicare, but only in six states: New Jersey, Ohio, Oklahoma, Texas, Arizona, and Washington, running from January 1, 2026 through December 31, 2031.

• Covered categories include epidural steroid injections, knee arthroscopy for osteoarthritis, cervical fusion, electrical nerve stimulator implants, and skin substitutes for chronic wounds; check the official CMS WISeR model page for the current, complete list, since sources cite varying counts.

• The most common cash flow disruption comes not from authorization denials themselves, but from expired authorizations, mismatched procedure codes, or incomplete documentation restarting the review clock.

What WISeR actually is, and exactly where it applies

CMS's WISeR model expands prior authorization to a defined list of service categories under Original Medicare, but strictly within six states selected for the model: New Jersey, Ohio, Oklahoma, Texas, Arizona, and Washington. This is not a nationwide change to traditional Medicare, a distinction that matters enormously for any multi-location practice, since a service performed in an unaffected state may carry no new authorization requirement at all, while the identical service performed at a location in one of the six model states does. CMS has indicated the model may expand to additional services or potentially additional states in future years, so practices outside the current six states shouldn't assume permanent exemption, only that no requirement applies under the current model as implemented.

The five places revenue actually gets stuck

Missing prior authorization submitted after the service was already performed is the most straightforward failure: the documentation may be complete, but no one obtained authorization first, and retroactive authorization requests succeed inconsistently at best. Incomplete clinical documentation in the initial request stops the payer's review clock entirely; the clock restarts once the missing records are provided, meaning what could have been a fast turnaround stretches out purely from an incomplete initial submission. A wrong CPT or HCPCS code on the authorization request can result in an approval for a different code than what's ultimately billed, producing a denial for lack of authorization on the actual billed code, similar in effect to a CO-16 missing-information denial even though authorization was technically obtained for something adjacent. An authorization that expires before the service is actually performed, since most authorizations carry a defined validity window, requires restarting the entire process if the service date slips past that window. And a change in care level or setting, an admission changing from observation to inpatient status, for example, without updating the authorization to match, creates a mismatch between what was approved and what was actually billed, the kind of gap that later surfaces as an unexpected contractual adjustment if not caught before the claim is filed.

Why this needs a workflow change, not just staff awareness

Simply informing scheduling staff in the six affected states that these procedures now require authorization isn't sufficient on its own; the practical fix requires building a checkpoint into the actual scheduling and intake workflow that flags any affected service category before the appointment is confirmed, not after the service has already been performed. Practices should also build in a verification step confirming the authorization is still valid, tied to the correct procedure code, and covers the actual planned care setting, immediately before the date of service, not only at the time the authorization was originally requested weeks earlier. This same discipline, catching a gap before the claim is billed rather than disputing it after, is what keeps a practice from treating every resulting denial as final the way the common billing misconceptions around denial finality tend to assume.

Frequently asked questions

Does WISeR apply to Medicare Advantage plans as well as traditional Medicare?

WISeR specifically targets traditional, fee-for-service Medicare in the six model states. Medicare Advantage plans already operate under their own separate prior authorization requirements, set independently by each plan, which in many cases already covered some or all of these same service categories before WISeR took effect for Original Medicare.

What should a practice do if a service is performed and only afterward discovered to need authorization under WISeR?

Some payers and programs allow a retroactive or expedited authorization request in specific circumstances, but success is inconsistent and shouldn't be relied upon as a standard practice. The far more reliable approach is preventing the gap entirely through a pre-service verification step, since a retroactive request is fundamentally a recovery attempt after the fact, not a guaranteed path to payment.

How can a practice stay current if CMS adds more states or service categories to WISeR in the future?

CMS publishes updates to the WISeR model's covered states and service list through the official model page and its regular rulemaking channels, and practices should build a recurring review of this list into their compliance calendar, rather than assuming the current scope is permanently fixed. A model built specifically around expanding prior authorization coverage should be expected to add further states or categories over time, not treated as a one-time change to absorb and forget.

For medical practices in WISeR model states that need newly covered prior authorization categories flagged before a claim is denied, our bookkeeping services connect revenue cycle tracking to current payer requirements, expert-led, AI-powered, and human-in-the-loop.

See the healthcare revenue cycle guide and the healthcare AR guide for the full billing and authorization framework.