Guide

Oregon Prior Authorization Law

ORS 743B.420/423—2-day PA, binding approvals, HB 3134 surgical & API reforms.

10 min read

What is prior authorization?

Prior authorization (PA) means the health plan must approve certain care before it will cover it. Providers often submit requests for you, but you still have rights if PA is denied or delayed.

Overview: Prior authorizations. Oregon-only details below.

Confirm plan type: Oregon: Start Here.

Oregon PA rules

Oregon regulates prior authorization through ORS 743B.420, ORS 743B.423, and OAR 836-053-1200. House Bill 3134 (2025, effective January 1, 2026) added reporting, surgical PA limits, and a mandatory PA API timeline.

Decision timelines (ORS 743B.423, OAR 836-053-1200)

  • Nonemergency requests: determination within 2 business days after receipt (or within 2 business days after receiving additional information, up to 15 days total in some cases)
  • Expedited prior authorization: when delay would jeopardize life, health, or ability to regain maximum function—handled on an urgent timeline per plan and regulation
  • Emergency services: no prior authorization required under ORS 743A.012 and plan standards

Binding prior authorization (ORS 743B.420, 743B.423)

  • Medical necessity / coverage PA: binding on the insurer if obtained within 60 days before service (or longer per approved duration under § 743B.423(m))
  • Eligibility PA: binding if within 5 business days before service
  • Many approved maintenance prescription drugs: binding for 1 year from start of treatment when criteria in § 743B.423(n) are met

Transparency and changes (ORS 743B.423)

  • PA requirements and clinical criteria posted on insurer websites with secure electronic submission
  • 60-day advance notice before new or changed utilization review requirements
  • DFR publishes aggregate PA approval/denial statistics annually

HB 3134 reforms (effective 2026)

  • During surgery: insurers generally cannot require separate PA for an additional or related procedure discovered during an already-authorized surgery when delaying care is not medically advisable (HB 3134 § 2)
  • PA API: insurers must implement a prior authorization application programming interface by January 1, 2027 (45 C.F.R. 156.223(b) standards)
  • Provider exemptions: insurers must establish processes to exempt qualifying providers from PA for certain services under circumstances defined in updated statutes—criteria vary by insurer; not a single statewide percentage threshold like some other states

Gold carding

Oregon does not use a fixed statutory 90% gold-card threshold in ORS 743B.420. HB 3134 directs insurer-specific exemption programs instead. Some national carriers operate voluntary gold card programs in Oregon.

Federal CMS timing (many plans, 2026)

Many Marketplace, Medicare Advantage, and Medicaid managed care plans must also follow federal PA rules (72-hour urgent / 7-day standard, denial reasons, and public reporting).

Where to look up PA rules

Check your plan materials and the carrier's member or provider portal first.

DFR overview: Prior authorization (DFR).

Carrier links: Oregon prior auth & internal appeals links.

Medicaid

Oregon Health Plan prior authorization follows OHCA and coordinated care organization (CCO) rules—not commercial ORS 743B.420 binding-PA provisions.

See Oregon internal appeals.

If PA is denied

Appeal through your plan's internal grievance under ORS 743B.250, then external review through DFR if the denial is an adverse benefit determination eligible for IRO review.

Next: Oregon internal appeals.

Urgent care

Request expedited prior authorization when standard timelines would jeopardize life or health. If PA is denied, request expedited internal appeal and may qualify for expedited external review (3 calendar days under DFR guidance) with physician certification.

The weekly brief

Patient advocacy notes, in your inbox.

One short email a week — policy changes, denial trends, and new guides. Free. No spam.

  • ~1 email / week
  • Plain English
  • Unsubscribe anytime

Join 38,000+ readers. See our privacy policy.