Who Decides Your Prior Authorization? The Review Vendors Named by 254 Payers

When a prior authorization request leaves a practice, it often does not land at the health plan at all. It lands at a review vendor the plan has hired to make the medical necessity decision for a defined set of services. In September 2026 we collected the public policy documents of 278 payers and counted which vendors they name. eviCore is named in the materials of 70 of the 254 payers we assessed. Carelon is named by 51. Evolent by 32.

The single most useful finding is not the ranking. It is that for the services a vendor owns, the vendor sets the portal, the code list, the criteria and the phone number. The plan on the member's card is not the address the request goes to.

What we did

We collected the public policy documents published by 278 payers in September 2026: medical policies, prior authorization code lists, provider manuals, clinical guideline libraries and criteria hierarchy statements. We read them and wrote a structured assessment for 254 of those payers, covering 65,851 documents in total. Every count below is a count of what those public documents said on 15 September 2026, so it describes the 254 payers we assessed, not every health plan in the United States.

The vendors named most often

Fourteen review vendors appear across the corpus. eviCore and Carelon together account for most of the named delegation, and the long tail is specialist: laboratory, oncology, musculoskeletal surgery, state Medicaid programs.

Two reading notes. NIA is Evolent's former name and both forms appear in current provider material, so a payer can legitimately show up under each. And a count here is the number of payers we reviewed whose public materials name that vendor anywhere, which includes programs that have since ended. North Carolina Medicaid, for example, still carries the record that eviCore handled imaging prior authorization until 1 July 2021.

What a delegated review vendor actually is

The health plan keeps the coverage obligation. It signs the member contract, it owes the decision, it takes the appeal. What it delegates is the review itself: a specialist utilization management company takes requests for a named list of procedure codes, applies its own clinical criteria, and returns the approval or denial that the plan then stands behind.

Plans do this for three reasons that show up plainly in the documents. The criteria are specialist and expensive to maintain, particularly for imaging, oncology and genetic testing where the evidence moves every quarter. The volume is concentrated, so a handful of service lines produce most of the requests. And the vendors are themselves large: Carelon is the former AIM Specialty Health and sits inside Elevance, and eviCore sits inside Cigna's Evernorth.

For a provider, delegation changes four practical things at once, all for the same patient and the same plan: a different portal to submit through, a different code list that defines what needs review, a different criteria set that decides the outcome, and a different phone number when the case stalls.

One member, one plan, four review desks

The clearest example in the corpus is Blue Cross and Blue Shield of North Carolina, because its prior plan approval code list carries a reviewer field against every code. Carelon reviews commercial radiology, cardiology, musculoskeletal, surgery, oncology, rehabilitation and sleep. Avalon Healthcare Solutions reviews commercial laboratory services, 468 codes of them. Prime Therapeutics handles pharmacy benefit drugs. Blue Cross NC itself keeps the remaining 1,258 commercial codes plus behavioral health and Part B drugs.

Blue KC splits the same way with a different cast. eviCore takes advanced imaging and interventional pain and spine injections. TurningPoint takes cardiac procedures and musculoskeletal and spine surgery. Avalon authors about 75 laboratory and genetic testing policies. Lucet handles behavioral health. OncoHealth reviews oncology drug and radiation requests.

Horizon Blue Cross Blue Shield of New Jersey runs three medical vendors in parallel: eviCore for cardiology imaging, radiology, radiation therapy, molecular and genomic testing, gastroenterology and musculoskeletal pain management; Carelon for cardiovascular, diagnostic imaging, musculoskeletal, oncology and sleep; and TurningPoint for its surgical and implantable device program covering cardiac, orthopedic and spine services.

Point32Health goes further still, with Evolent on imaging, cardiac testing and joint, spine and pain procedures, Carelon on genetic and molecular testing, eviCore on sleep studies and PAP supplies, OncoHealth on outpatient chemotherapy, Optum on behavioral health, Progeny Health on NICU care and Optum's post-acute unit on skilled nursing, rehabilitation and home health. Of its 220 published medical necessity guideline entries, 36 do not contain criteria at all. They link out to a vendor site.

At the far end, Health Alliance Plan in Michigan publishes no medical policies whatsoever. Its entire public statement of prior authorization scope is a two page PDF listing 30 service categories with footnoted vendors: eviCore for sleep, eviCore again for high-tech imaging and pain management, TurningPoint for musculoskeletal and cardiac procedures, and a separate behavioral health manager. The code level lists sit behind a provider login.

The same service can go to a different vendor in a different state

Vendor routing is not a property of the plan. It is a property of the plan plus the line of business plus the state plus the date.

Humana is the sharpest illustration. Cohere Health reviews advanced imaging, cardiac interventions, endoscopy, orthopedic surgery, pain management and therapy, except in Florida, Georgia, North Carolina, South Carolina and Virginia, where Humana reviews those itself. Evolent handles ablation, radiation oncology, surgical oncology and chemotherapy in most states. OncoHealth handles chemotherapy and supportive drugs in Connecticut, Delaware, Maine, Maryland, Massachusetts, New Hampshire, New Jersey, New York, Pennsylvania, Rhode Island and Vermont. eviCore covers Kentucky Medicaid. Carelon Behavioral Health covers behavioral health in Florida Medicaid and the Illinois dual plan. Molecular diagnostics and genetic testing stay in house.

Line of business splits the same way. At Blue Cross and Blue Shield of Rhode Island, eviCore covers cardiology and radiology for both Medicare Advantage and commercial, spine procedures for Medicare Advantage and fully funded commercial from 1 November 2025, and physical and occupational therapy for Medicare Advantage only from 1 January 2026. Three programs, three different footprints, one vendor.

The vendor decides which rules apply, and how much of them you can read

Once a service is delegated, the plan's own medical policy is no longer the rule that decides it. The vendor's guideline is. How much of that guideline a provider can read before submitting varies enormously.

Carelon publishes its full decision criteria openly: 108 guideline documents covering imaging, cardiology, sleep, musculoskeletal, genetic testing, radiation oncology, medical oncology pathways, post-acute level of care, endoscopy and fertility, with future effective dates published in advance. eviCore also posts full guideline PDFs with explicit criteria trees, but organises them per health plan rather than nationally: its guideline pages list documents for 110 of the 205 health plans in its plan picker, and it publishes no national prior authorization list at all. What needs prior authorization is set by each client plan, not by the vendor.

Others are closed. TurningPoint posts code to policy crosswalks publicly but keeps the criteria behind a registration wall. OncoHealth's criteria are not public, so the scope code list is all a provider gets in advance. Avalon sits in between, because payers republish its laboratory policies inside their own libraries: Presbyterian Health Plan carries 64 Avalon authored laboratory policies and Blue KC about 75.

One more wrinkle worth knowing. Delegation is not absolute. Blue Cross NC's own guidance states that where both a plan policy and the licensed criteria address a service, the plan policy takes precedence. So the answer to "which rule applies" can be the vendor's guideline, the plan's policy, a Medicare national or local coverage determination, or a state Medicaid rule, in an order the plan defines. Idaho Medicaid's vendor manual puts it bluntly: every case must meet Idaho Medicaid criteria before any other criteria are applied.

Routing changes, and it changes on a date

A vendor answer that was right last year is not automatically right this year. The documents are full of dated handovers. Blue Cross Blue Shield of Michigan moved radiation oncology to OncoHealth on 1 September 2026, having used eviCore before that. CareOregon moved a block of prior authorizations to HealthHelp for dates of service on or after 1 May 2026. BlueCross BlueShield of Tennessee moved commercial prior authorization to Cohere Health in September 2025 and the remaining lines of business in December 2025. AmeriHealth Caritas moved South Carolina services off eviCore in February 2024. MVP Health Care removed its eviCore references during its 2026 policy revisions.

How to find out who reviews your request

Five checks, in this order, answer the question for almost any payer.

1. Open the code level list, not the member facing summary. The routing is in the columns, when there are columns at all, and what payers publish as a prior authorization list varies widely. Blue Cross NC's code list carries a reviewer field on every row. CommunityCare Oklahoma publishes an 18,285 row spreadsheet with a "Delegated Management" column: of the 2,344 codes flagged as requiring prior authorization, 1,393 are the plan's own, 771 are Evolent, 154 are the pharmacy vendor and 26 are split between two. Centene's Meridian Illinois list runs to roughly 59,000 rows mapping each code to its reviewer and policy.
2. Read the footnotes. Where there is no column, there is usually a marker. Independence Blue Cross's precertification PDF is a narrative list of services with footnote markers that carry the Carelon and eviCore routing.
3. Check the line of business. Commercial, Medicare Advantage and Medicaid frequently route to different desks inside the same brand, and self funded groups can opt out of a vendor program entirely.
4. Check the state and the product. A national plan can review a service itself in five states and delegate it everywhere else.
5. Check the effective date, and note who to call. Programs start and stop on fixed dates. InStil Health's public preauthorization table is the model here: three columns, the service, who to call, and the penalty if preauthorization is not obtained.

What this means for you

For payers

Every delegate is a connectivity problem. Under CMS-0057-F the prior authorization API has to answer for the service, regardless of who reviews it, and the obligation does not transfer with the review. That is not a theoretical gap. eviCore publishes no public developer portal or prior authorization API documentation, and Carelon's own provider material indicates that the API surface for Carelon managed services would be exposed through the client health plan's systems. In other words, the plan has to carry its vendors' decisions into its own API, including status, criteria references and denial reasons that currently live in a vendor portal. Map the delegated footprint code by code before scoping the API work, because the vendor boundary is where most integration effort actually sits. Our CMS-0057-F readiness scoping guide covers how to frame that assessment.

For providers and RCM teams

The vendor decides which rules apply, so routing the request correctly is half the battle. A request submitted to the plan when the service is delegated does not get a faster decision, it gets a redirect and a restart. Build the routing into the worklist rather than into individual staff memory: reviewer by payer, by plan type, by code, with the effective date attached. That table is also the one that tells a revenue cycle team which criteria document to attach, because the vendor's guideline is the document the reviewer is reading.

For vendors building software

Vendor routing is a required field, not a nice to have. Any product that tells a user whether prior authorization is needed has to answer the second question too: who reviews it, under which criteria, through which channel, effective from when. A coverage requirements service that returns "yes, authorization required" and stops has answered half the question. The data to populate that field exists in public payer documents, but it is spread across code lists, footnotes and program pages rather than published as one clean feed, which is exactly why it is worth building once.

Limitations

This is a snapshot of public documents as of 15 September 2026. It counts documents and payers, not members or claim volume, so a vendor named by two payers may still review more requests than one named by ten. It reflects only what payers publish publicly, so delegation that appears solely in provider portals or contracts is invisible here. Counts are of payers naming a vendor anywhere in their materials, which can include ended programs. And 24 of the 278 payer folders we collected do not yet carry a written assessment, so the denominator throughout is 254.

Further reading from our research on the same corpus: CMS-0057-F explained for what the rule requires and when, the prior authorization automation guide for the workflow itself, and the prior authorization software buyer's guide if you are evaluating tooling.

Mapping delegated vendors onto a working prior authorization API is an interoperability problem before it is a user interface problem, and the FHIR layer is only as good as the routing data behind it. We help payers and digital health teams build exactly this: the delegated footprint, the coverage rules, and the automation on top. See our healthcare AI solutions work for the automation side, and talk to our team if you want the vendor map for your own payer list.