The X12 278 request, loop by loop
The 278 Health Care Services Review is the standard transaction for asking a health plan to review a proposed service. Most people who work with prior authorization never see one, because a portal or a practice management system builds it. Knowing its structure still pays, because when a payer rejects a request for a missing element, the rejection names the loop.
#The loop structure
| Loop | Who or what | Carries |
|---|---|---|
| 2010A | Utilization Management Organization | The entity being asked to decide. The payer, or a delegated reviewer acting for it. |
| 2010B | Requester | The provider or facility asking. Identified by NPI, and usually by tax ID. |
| 2010C | Subscriber | The policy holder. Name, member identification number, date of birth. |
| 2010D | Dependent | The patient, when the patient is not the subscriber. Omitted when they are the same person. |
| 2000E | Patient Event | The clinical event: service type, dates, place of service, diagnosis codes. |
| 2000F | Service | The specific procedure: CPT or HCPCS code, units, and the servicing provider if different from the requester. |
#The fields that decide whether you get reviewed
Member identification- Must match the payer's record exactly, including any alpha prefix. This is the single most common cause of a request bouncing before any human sees it. Take it from the eligibility response, not from the card, because the card is a photograph of a moment and the 271 is the plan's current record.
Requesting provider NPI- The plan checks this against its provider file. A locum, a newly credentialed physician, or a provider whose enrollment lapsed will fail here, and the failure message rarely says so plainly.
Diagnosis codes- ICD-10-CM. The relationship between the diagnosis and the procedure is what the medical policy is written against. A technically valid code that does not support the indication gets a clinical denial rather than a rejection, which is slower and more expensive.
Procedure codes- CPT or HCPCS, with units. Specific matters: many policies attach to individual codes rather than families.
Place of service- The same procedure in an office, an ambulatory surgical centre and an inpatient setting can have different requirements and different criteria. Place of service is a code, not a description, and getting it wrong changes which policy is applied.
Date or date range- A single date for a discrete procedure, a range for a course of treatment. Approvals are bounded by these dates and a service delivered outside them is unauthorized even though an authorization exists.
Certification type- Initial, extension, or a revision to an existing review. Sending an extension as an initial request creates a duplicate rather than extending anything.
#Urgency is a clinical assertion
The request can be marked expedited or urgent, which invokes a shorter decision timeline. Under CMS-0057-F, impacted payers must decide expedited requests within 72 hours against seven calendar days for standard requests. That is a large difference and the temptation to mark everything urgent is obvious.
It is also a claim about the patient's clinical situation, made to a reviewer who sees your whole volume. Practices that mark everything urgent find their urgent flag stops meaning anything, and the genuinely urgent case waits with the rest. Use it when the clinical facts support it and be prepared to say why.
#What comes back is not always an answer
The 278 response uses the same transaction set in the other direction. Its action code is the decision, and one of the common values is not a decision at all but a statement that review is continuing. That is covered in Reading the 278 response.