X12 278: the HIPAA prior authorization transaction

What is the X12 278?

The X12 278, Health Care Services Review, is the HIPAA standard for the referral certification and authorization transaction: a provider asks a health plan to review and approve a service before it is delivered, and the plan responds. The required version is 005010X217 (45 CFR 162.1302).

A 278 request identifies the patient and member ID, the requesting and servicing providers, the diagnosis codes, the procedure or service codes, and the requested dates (X12 example). The response carries the decision and, when approved, a certification or reference number.

Decision codes in a 278 response

The plan's decision is reported in the HCR segment. CMS's companion guide for Medicare prior authorization programs describes these action codes (CMS esMD 278 Companion Guide):

Under the voluntary CORE prior authorization data content rule, a pended response (A4) should also say what documentation is needed, using an attachment report type or LOINC code (CORE 278 Data Content Rule).

Why most prior authorizations still skip the 278

The 278 has been the HIPAA standard for years, but adoption is low. In the 2024 CAQH Index, 35% of medical prior authorizations were conducted fully electronically with the X12 278, 43% were partially electronic through web portals or IVR, and 22% were fully manual by phone, mail, fax, or email (CAQH Index 2024).

In CMS-0057-F, CMS noted that 278 utilization had not exceeded 21% in four reporting years and explained why: providers say the 278 does not include the data elements they need for complete processing, and many payers still do not support it. CMS also found it was the transaction least likely to be supported by payers, practice management systems, vendors, and clearinghouses (Federal Register).

The gap is costly. The 2024 CAQH Index estimated that a manual prior authorization costs a provider $12.88, a portal-based one $8.93, and a fully electronic one $5.38. Providers reported spending 24 minutes on a request by phone, fax, or email and 16 minutes on a portal (CAQH Index 2024). In the AMA's 2025 survey, physicians reported an average of 40 prior authorizations and 13 hours of physician and staff time per week, and 95% said prior authorization delays access to care (AMA).

Operating rules and attachments

Unlike eligibility, the 278 has no federally adopted operating rule (Federal Register). CORE publishes voluntary prior authorization rules. Its infrastructure rule calls for a final decision within two business days of receiving a complete request, and for a pended response to say what is missing (CORE 278 Infrastructure Rule). X12 has administered these rules since October 2026 (X12).

Attachments are the other gap. A prior authorization often depends on clinical notes, imaging reports, or therapy history. HHS proposed prior authorization attachment standards in 2022, but its March 2026 final rule adopted claims attachments only and left prior authorization attachments out (Federal Register). Supporting documents still usually travel by portal upload or fax.

Medicare fee-for-service and the 278

Traditional Medicare uses prior authorization for a limited set of programs. Through its Electronic Submission of Medical Documentation (esMD) system, CMS accepts X12 278 requests for its non-emergent, repetitive, scheduled ambulance transport; DMEPOS; home health pre-claim review; hospital outpatient department; inpatient rehabilitation facility; and ambulatory surgical center programs. Supporting documents can be sent as an X12 275 or through other esMD channels (CMS esMD 278 Companion Guide).

Decisions come back as affirmed, non-affirmed, or modified, and the response carries a Unique Tracking Number (UTN) for the request (CMS esMD 278 Companion Guide).

FHIR and the future of the 278

CMS-0057-F requires Medicare Advantage, Medicaid, CHIP, and federal Marketplace plans to offer a FHIR-based Prior Authorization API by 2027. A payer cannot meet that rule by offering only the 278 (CMS FAQ). Because HIPAA still names the 278, HHS announced on February 28, 2024 that it will not take enforcement action against covered entities that use an all-FHIR prior authorization process instead (CMS guidance letter).

The two can also work together. The HL7 Da Vinci Prior Authorization Support (PAS) guide lets an EHR send a FHIR request to an intermediary, which can convert it to an X12 278 when a payer needs one (HL7 PAS).

In April 2026, HHS proposed adopting FHIR standards, including PAS, as the HIPAA standard for prior authorization in place of the X12 278, with the Da Vinci CDex guide for attachments (Federal Register). The proposal was not final as of November 4, 2026.

What practices can do now

• Ask your clearinghouse and EHR vendor which payers accept the 278 today, and which will offer FHIR Prior Authorization APIs in 2027.
• Keep a payer-by-payer list of how each plan accepts requests: 278, FHIR API, portal, or fax.
• Track pended requests closely. A pend usually means the payer needs documentation you can send the same day.
• For Medicare fee-for-service programs, record the UTN from every esMD decision with the order.

Saga's agents assemble prior authorization requests from the chart, submit them through payer portals, and track them to a decision, with staff sign-off on sensitive actions. See prior authorization.