What is the denial code for no prior authorization?

CO-197 is the standard code when a service required precertification, authorization, or notification and the payer has none on file. If the plan instead required a referral from the primary care provider, the denial usually posts as CO-243. Check whether an authorization exists under a different code or date before treating it as missing.

Can I bill the patient when prior authorization was not obtained?

Generally no. Authorization denials normally carry a CO group code, which makes obtaining the authorization the provider's responsibility under the network contract. A patient can be billed only where the contract allows it and the patient agreed in writing, before the service, to pay for it.

Prior authorization denial codes

Authorization problems show up under four different codes, and each calls for different work. CO-197 means the service needed precertification, authorization, or notification and the payer has none on file. CO-39 means authorization was requested before the service and the payer turned it down. CO-198 means an authorization existed but the claim went past what it approved - more visits, more units, or dates outside its window. CO-243 is the referral version: a gatekeeper plan required the primary care provider to refer or authorize the visit. All four normally post with a CO group code, so the balance cannot simply be moved to the patient.

Also described as: no auth on file; precertification missing; authorization denied; visits exceeded the authorization; no referral.

The 4 codes and what separates them

CO-197 - Precertification, authorization, or notification is absent
The service required precertification, authorization, or notification and the payer has no valid authorization on file. Often one exists but is tied to a different code, date, or provider.
Who pays: Provider
CO-39 - Authorization was requested and refused
Authorization was requested before the service and the payer declined it. The claim denial follows that earlier decision, so the dispute is with the determination itself.
Who pays: Provider
CO-198 - The authorized limit for this service was exceeded
An authorization was approved, but the claim exceeds it - more visits or units than approved, or dates outside its window.
Who pays: Provider
CO-243 - Services were not authorized by the network or primary care provider
The plan requires a referral or authorization from the patient's primary care provider or network gatekeeper, and none was on file.
Who pays: Provider

How to tell which one you have

Ask one question first: did an authorization ever exist? If nothing was requested, it is CO-197 - or CO-243 on a referral plan - and the routes are a retroactive authorization where the payer allows one, or an appeal showing the requirement did not apply. If a request was made and refused, it is CO-39, and the appeal has to overturn the clinical decision behind the refusal. If an approval exists but the claim went past it, it is CO-198: request an extension or a retroactive increase for the extra services rather than appealing the whole claim. Before assuming an authorization is missing, compare the authorization number, procedure code, and date span on the claim with the approval letter.

Frequently asked questions

What is the denial code for no prior authorization?: CO-197 is the standard code when a service required precertification, authorization, or notification and the payer has none on file. If the plan instead required a referral from the primary care provider, the denial usually posts as CO-243. Check whether an authorization exists under a different code or date before treating it as missing.
Can I bill the patient when prior authorization was not obtained?: Generally no. Authorization denials normally carry a CO group code, which makes obtaining the authorization the provider's responsibility under the network contract. A patient can be billed only where the contract allows it and the patient agreed in writing, before the service, to pay for it.

Other denial reasons

Out of network Not medically necessary Service not covered Bundled or not paid separately Coding mismatch or invalid code Patient not eligible or coverage ended Another payer is responsible Missing information, duplicate, or late filing Provider not eligible or not credentialed Benefit or unit limit reached Deductible, coinsurance, or copay Paid less than billed

Every denial code in one table

Last reviewed October 3, 2026.

These are original plain-English summaries written for reference, not the official X12 code descriptions. Payer handling of any code varies by contract - always verify against the remittance advice and your payer agreement before adjusting a claim.