Commercial Insurance Coverage for Medical Devices: Payer Policy and Prior Auth

Guide to US commercial and private-payer coverage for medical devices — medical policy, prior authorization, ERISA self-funded plans, appeals, and the Medicare NCD/LCD benchmark.

Medicare Coverage Does Not Guarantee Commercial Coverage — But It Is the Starting Point

A Medicare National Coverage Determination (NCD) or Local Coverage Determination (LCD) is often the first domino for device reimbursement in the US — but commercial payers are not bound by it. About two-thirds of Americans have private insurance coverage. According to the US Census Bureau (P60-288, 2024 data), 66.1% of the population had private health insurance: 53.8% through employer-sponsored coverage and 10.7% through direct-purchase plans. Medicare covered 19.1%, Medicaid 17.6%, and about 8.0% were uninsured. By count, approximately 165.6 million people under age 65 had employer-sponsored insurance as of early 2025 (KFF estimates, approximately 60% of the nonelderly population).

Commercial payers develop their own medical policies — frequently referencing Medicare NCD/LCD as a starting point but issuing criteria that can be more restrictive, less restrictive, or structured differently. They layer prior authorization, step therapy, and quantity limits on top. And the largest segment of the commercially insured population — workers in self-funded/ERISA employer plans — sits outside the reach of most federal and state prior-authorization reform legislation.

For medical device manufacturers, this means that winning a Medicare NCD or LCD is necessary but not sufficient. The commercial coverage playbook is a separate, payer-by-payer effort: secure a HCPCS/CPT code, build the evidence dossier, win payer medical-policy adoption, manage prior authorization, and use the ACA section 2719 external-review right to overturn medical-necessity denials.

Do Commercial Plans Follow CMS (Medicare) Coverage Guidelines for Devices?

Often as a reference point, but never as a binding rule. The relationship between Medicare and commercial coverage operates on several levels:

Medicare as the Coverage Anchor

Medicare uses a statutory coverage standard: a service must be "reasonable and necessary for the diagnosis or treatment of illness or injury" under Section 1862(a)(1)(A) of the Social Security Act. CMS implements this standard through NCDs (national) and LCDs (regional MACs). When a new device receives an NCD or favorable LCD, commercial payers notice — the Medicare determination serves as a credibility signal and a reference for their own medical-policy committees.

How Commercial Payers Diverge

Commercial payers use contractual "medical necessity" definitions that vary by plan, employer, and benefit design. Common divergence patterns include:

Dimension	Medicare NCD/LCD	Typical Commercial Medical Policy
Coverage standard	"Reasonable and necessary" (statutory)	"Medically necessary" (contractual, defined by plan document)
Evidence threshold	CMS evidence review, technology assessments	Payer medical-policy committee review, may accept or reject CMS findings independently
Prior authorization	Required for some services (e.g., DMEPOS, MA plans)	Frequently required, with payer-specific forms and timelines
Step therapy	Rare in traditional Medicare	Common — patient may need to fail conservative treatment before the device is covered
Quantity limits	Specific to benefit category (e.g., DME replacement schedules)	Payer-specific, may be more restrictive
Off-label coverage	Generally not covered unless NCD/LCD allows	Varies — some commercial plans cover off-label uses with sufficient evidence
Appeal process	Medicare Redetermination → QIC → ALJ → Medicare Appeals Council → Federal court	Internal appeal → External review under ACA section 2719

The "Follow-the-Leader" Effect

In practice, many commercial payers adopt Medicare coverage criteria as a baseline — particularly for well-established device categories where the CMS evidence review is thorough. For novel or high-cost devices, commercial payers may wait for the Medicare NCD/LCD before developing their own policy, or they may classify the device as "investigational/experimental" and decline coverage until they conduct their own evidence review.

The NIH SEED Reimbursement Knowledge Guide for Medical Devices (January 2024) describes this dynamic: "Private payers may follow Medicare coverage determinations, but they are not required to. Each private payer makes its own coverage decisions based on its assessment of the clinical evidence."

How Do Commercial Payers Develop a Medical Policy for a Device?

Commercial payers maintain medical-policy libraries — publicly searchable databases of coverage criteria for specific procedures, devices, and services. Major payer medical-policy portals include:

UnitedHealthcare: Commercial Reimbursement Policies and Medical Policies (uhcprovider.com)
Cigna: Coverage Policies (cigna.com)
Aetna: Clinical Policy Bulletins (aetna.com)
Anthem/Elevance Health: Medical Policies (anthem.com)
Humana: Medical Coverage Policies (humana.com)

The Medical-Policy Development Process

A typical commercial payer medical-policy lifecycle for a new device:

Stage 1 — No Policy: The device has no specific coverage criteria. Coverage decisions are made on a case-by-case basis, often defaulting to "investigational/experimental" for novel technologies.

Stage 2 — Investigational/Experimental: The payer issues a medical policy classifying the device as investigational. Coverage is denied except in the context of approved clinical trials. This is the most common barrier for innovative devices.

Stage 3 — Limited Coverage: The payer recognizes sufficient evidence and issues a medical policy with specific coverage criteria — patient eligibility, clinical indications, documentation requirements, provider qualifications. Prior authorization is typically required.

Stage 4 — Broad Coverage: After accumulating positive clinical evidence, the payer broadens coverage criteria, reduces prior-authorization requirements, or aligns with Medicare NCD/LCD criteria.

What Manufacturers Must Do

Device manufacturers can influence the medical-policy process by:

Submitting clinical evidence dossiers (ideally structured as a health economics and outcomes research package — see HEOR and the global value dossier)
Requesting meetings with payer medical directors
Monitoring medical-policy updates and comment periods
Providing peer-reviewed publications, health technology assessments, and economic analyses
Supporting clinical registries and post-market studies that generate the real-world evidence payers increasingly demand (see real-world evidence for medical devices)

What Are Prior Authorization, Step Therapy, and Quantity Limits Under Commercial Plans?

Prior Authorization

Prior authorization (also called prior approval or precertification) requires the insurer to approve a service before the provider performs it. The provider submits clinical documentation, and the payer reviews it against the medical-policy criteria. If approved, the service is authorized for a specified period. If denied, the provider or patient can appeal.

The burden of prior authorization is substantial and well-documented:

The AMA's 2025 Prior Authorization Physician Survey found that approximately 93–95% of physicians report that prior authorization delays access to necessary care, and approximately 79–82% report that patients abandon treatment due to prior-authorization barriers.
Medicare Advantage insurers alone made approximately 53 million prior-authorization determinations in 2024, with a 7.7% denial rate — approximately 4.1 million denials (KFF analysis of CMS MA data).

Step Therapy

Step therapy (also called fail-first) requires a patient to try and fail a lower-cost or first-line treatment before the payer will cover a more expensive or specialized option. For devices, this might mean:

Trying physical therapy before approving a spinal cord stimulator
Using a standard wound dressing before covering a negative-pressure wound therapy (NPWT) device
Failing oral medication before approving an implantable drug-delivery system

Step-therapy requirements are specified in the payer's medical policy and can add weeks or months to the coverage timeline.

Quantity Limits

Quantity limits cap how many units, supplies, or services are covered within a time period. For devices and device-related supplies, common examples include:

Continuous glucose monitor (CGM) sensor replacement limits (e.g., one sensor every 10–14 days)
Ostomy supply quantity limits per month
Wheelchair or prosthetic replacement schedules

What Is the Difference Between Fully Insured and Self-Funded/ASO (ERISA) Plans?

This distinction is one of the most important — and most overlooked — factors in commercial device coverage strategy. The two plan types are regulated by entirely different legal frameworks, and many federal prior-authorization reform rules apply to one type but not the other.

Fully Insured Plans

In a fully insured arrangement, the employer purchases a health insurance policy from an insurance company (UnitedHealthcare, Cigna, Aetna, etc.). The insurer bears the financial risk — it collects premiums from the employer and pays claims from its own reserves. Fully insured plans are regulated by state insurance commissioners and must comply with state mandated-benefit laws, state prior-authorization reform laws, and state external-review requirements.

Self-Funded (ERISA) Plans

In a self-funded arrangement (also called Administrative Services Only or ASO), the employer pays claims directly from its own funds. The employer typically contracts with an insurance company or third-party administrator (TPA) to process claims, manage the provider network, and handle prior authorization — but the financial risk stays with the employer. Self-funded plans are regulated by the Employee Retirement Income Security Act of 1974 (ERISA), a federal law that preempts most state insurance regulation.

How Big Is the Self-Funded Market?

The KFF Employer Health Benefits Surveys (2024–2025) report that approximately 63–67% of covered workers are in self-funded or partially self-funded plans. At large firms (200+ employees), self-funding reaches approximately 80%. This means the majority of commercially insured Americans are in plans that:

Are not subject to state insurance regulation (ERISA preemption)
Are not subject to state prior-authorization reform laws
Are not directly regulated by the CMS prior-authorization turnaround rules (which target MA, Medicaid/CHIP, and Marketplace QHPs)
Are subject to ACA section 2719 internal appeals and external review (for non-grandfathered group health plans)

Feature	Fully Insured	Self-Funded (ERISA)
Financial risk bearer	Insurance company	Employer
Primary regulator	State insurance commissioner	Federal (DOL/ERISA)
State insurance regulation	Yes	No (ERISA preemption)
State mandated benefits	Yes	No (ERISA preemption)
ACA mandated provisions	Yes (essential health benefits, preventive services, dependent coverage to 26, annual/lifetime limits ban)	Partially — ACA market reforms apply, but EHB benchmark does not apply to self-funded plans
CMS prior-auth turnaround rules (CMS-0057-F)	Only if plan is a Marketplace QHP	No
State prior-auth reform laws	Yes	No (ERISA preemption)
ACA section 2719 internal appeals and external review	Yes (non-grandfathered)	Yes (non-grandfathered)

Implication for Device Manufacturers

The ERISA preemption means that even when a state passes strong prior-authorization reform (like the Texas gold-card law), the reform applies only to fully insured plans — not to the majority of commercially insured workers who are in self-funded/ERISA plans. Device manufacturers must understand this split when projecting the impact of state-level reforms on their market access.

The CMS Prior-Authorization Timeline: What Applies Where?

Several recent CMS rules have introduced prior-authorization guardrails — but their scope is limited and does not extend to most commercial plans:

CMS-0057-F (Interoperability and Prior Authorization Final Rule)

Finalized January 17, 2024 (Federal Register February 8, 2024). Key provisions:

72-hour (expedited) and 7-calendar-day (standard) prior-authorization decision timeframes
Reason-for-denial disclosure requirement
Prior Authorization API requirement for electronic prior-auth submission
Operational compliance: January 1, 2026
API compliance: January 1, 2027

Scope: Medicare Advantage organizations, Medicaid/CHIP fee-for-service and managed care, and Qualified Health Plan (QHP) issuers on the Federally-facilitated Exchange. Excludes: employer-sponsored commercial plans — both fully insured and self-funded/ERISA — which the rule does not directly regulate. (The 72-hour/7-day decision timeframes and denial-reason requirements also exclude FFE QHP issuers, although those issuers must still implement the interoperability APIs.)

CMS-4205-F (CY2025 Medicare Advantage and Part D Final Rule)

Additional MA-specific prior-authorization guardrails, including requirements for MA plans to use clinical criteria that are evidence-based and to cover mid-year formulary and prior-auth criteria changes.

CMS-4201-F (CY2024 Medicare Advantage Rule)

Introduced the 90-day continuity-of-care transition: when a patient switches Medicare Advantage plans mid-treatment, the new plan must continue coverage without prior authorization for 90 days. Effective January 1, 2024. Note: this rule applies to MA plans, not to commercial plans.

State-Level Prior-Authorization Reform: The Texas "Gold Card" Example

Texas House Bill 3459 (87th Legislature, 2021) created a prior-authorization exemption — commonly called the "gold card" — for physicians who achieve a 90% or higher prior-authorization approval rate with a specific health plan over an evaluation period. Qualifying physicians are exempted from prior-authorization requirements for the services they have historically been approved to provide.

The law was updated by HB 3812 (89th Legislature, 2025), which changed the evaluation period to 12 months (effective September 1, 2025). Several other states (Michigan, West Virginia, Louisiana, and others) have enacted or proposed similar gold-card laws.

Critical limitation: Texas gold-card laws apply only to fully insured plans regulated by the Texas Department of Insurance. Self-funded/ERISA employer plans are exempt from state insurance regulation, so the gold card does not apply to the majority of commercially insured workers at large employers.

How Do Appeals and ACA Section 2719 External Review Work for Device Denials?

When a commercial plan denies coverage for a device or device-related service, the provider or patient has a structured appeal pathway under the Affordable Care Act:

Step 1: Internal Appeal

ACA section 2719 (implemented at 29 CFR 2590.715-2719) requires all non-grandfathered group health plans and individual health insurance to maintain an internal appeals process. The plan must provide:

A full and fair review by a reviewer who did not participate in the initial denial
Consideration of all relevant evidence, including new information submitted by the claimant
A decision within specified timeframes (typically 30 days for pre-service, 60 days for post-service, 72 hours for urgent/expedited)

Step 2: External Review

If the internal appeal is denied, the claimant has the right to an independent external review. This is one of the most powerful — and most underutilized — tools in device coverage:

The external review is conducted by an independent review organization (IRO) — not the health plan's own medical staff
The IRO applies the plan's medical-necessity definition and clinical evidence standards
The external reviewer's decision is binding on the plan — if the IRO determines the service is medically necessary, the plan must cover it
External review is available for all non-grandfathered group health plans, including self-funded/ERISA plans — this is one area where ERISA preemption does not prevent patient protections

Why External Review Matters for Devices

External review is particularly important for innovative devices because:

The independent reviewer applies clinical evidence directly, without the plan's financial incentive to deny
For devices with strong clinical evidence but new-to-market status, external review can overcome a plan's default "investigational/experimental" classification
The binding nature of the decision creates a precedent (even if informal) that can influence the plan's future medical-policy development

Manufacturer Strategy for Appeals

Device manufacturers cannot file appeals themselves — only providers and patients can. But manufacturers can support the process by:

Creating appeal template letters with pre-populated clinical evidence
Providing clinical evidence summaries and relevant peer-reviewed publications
Offering peer-to-peer talking points for physicians to use in plan-mandated peer review calls
Training field reimbursement managers to assist provider offices with the appeal process
Tracking denial and appeal outcomes by payer to identify patterns and target medical-policy engagement

Does the No Surprises Act Affect Device Coverage?

The No Surprises Act (effective January 1, 2022) protects patients from surprise out-of-network bills in emergency settings and certain non-emergency settings at in-network facilities. The law does not change coverage determinations or prior-authorization requirements. Its primary impact on devices is indirect:

Independent Dispute Resolution (IDR): When an out-of-network provider and a plan disagree on payment for a service, either party can initiate IDR. The IDR entity uses the Qualifying Payment Amount (QPA) — typically the median in-network rate — as a reference. For high-cost devices, this can affect the payment rate when the device is used by an out-of-network provider.
Balance billing protections: Patients cannot be billed for the difference between the out-of-network charge and the plan's allowed amount in covered situations. This shifts the financial risk to providers and plans, not patients.

The Commercial Coverage Playbook for Device Manufacturers

Winning commercial coverage is a structured, multi-step process. The following playbook synthesizes the strategies discussed throughout this guide:

Step 1: Secure the Code

A HCPCS, CPT, or APC/DRG code is the foundation for billing and coverage. Without a code, the device cannot be systematically billed or covered. See CPT, HCPCS, and ICD coding for devices for a detailed guide to the coding process.

Step 2: Build the Evidence Dossier

Commercial payers evaluate clinical evidence, economic analyses, and real-world outcomes. The evidence dossier should include:

Randomized controlled trial data (pivotal trial, if available)
Health technology assessments and systematic reviews
Health economic analysis (cost-effectiveness, budget impact)
Real-world evidence from registries and observational studies
Patient-reported outcomes
Society guidelines and consensus statements

See HEOR and the global value dossier for guidance on structuring the evidence dossier.

Step 3: Map the Payer Landscape

Identify which commercial payers cover the device category, what medical policies exist, and where coverage gaps remain. Prioritize payers by covered-lives volume and geographic overlap with your sales territories.

Step 4: Engage Payer Medical-Policy Committees

Submit evidence dossiers proactively. Request meetings with payer medical directors. Respond to medical-policy comment periods. Track policy updates and respond to changes in coverage criteria.

Step 5: Support Prior-Authorization Management

Equip provider offices with prior-authorization submission templates, clinical documentation checklists, and appeal materials. Train field reimbursement managers to assist with denials and appeals.

Step 6: Use the ACA Section 2719 External Review as a Backstop

When internal appeals fail, guide providers and patients through the external-review process. Track external-review outcomes to build evidence that the plan's coverage denial is inconsistent with clinical evidence.

Step 7: Monitor and Respond

Payer medical policies are living documents. Monitor for updates, respond to coverage changes, and continuously submit new evidence as it becomes available. See outcomes-based and value-based device contracts for alternative coverage arrangements that may accelerate adoption.

Frequently Asked Questions

Do the New CMS Prior-Authorization Turnaround Rules (72 Hours / 7 Days) Apply to Commercial Plans?

No. CMS-0057-F applies to Medicare Advantage organizations, Medicaid/CHIP fee-for-service and managed care, and Marketplace Qualified Health Plans (QHPs). It does not apply to employer-sponsored commercial plans — neither fully insured nor self-funded/ERISA. The majority of commercially insured Americans are in plans unaffected by these rules.

What Is a Payer Medical Policy and Where Do I Find It?

A payer medical policy is the insurer's publicly available document specifying the coverage criteria for a specific procedure, device, or service — including clinical indications, documentation requirements, coding instructions, and prior-authorization requirements. Major payer medical-policy portals are searchable online at UnitedHealthcare (uhcprovider.com), Cigna (cigna.com), Aetna (aetna.com), Anthem (anthem.com), and Humana (humana.com).

Does the No Surprises Act Affect Device Billing?

The No Surprises Act addresses surprise out-of-network billing, not coverage determinations. It protects patients from balance billing in covered situations and establishes an Independent Dispute Resolution process for provider-payer payment disputes. Its direct impact on device coverage decisions is limited, but it can affect the payment rate for devices used by out-of-network providers.

What Percentage of Americans Have Commercial vs. Medicare Coverage?

According to Census Bureau P60-288 (2024 data): 66.1% had private health insurance (53.8% employer-based, 10.7% direct-purchase); 19.1% had Medicare; 17.6% had Medicaid; and approximately 8.0% were uninsured. These categories overlap — many people have multiple sources of coverage (e.g., Medicare plus a supplemental commercial plan).

Can a Manufacturer Appeal a Commercial Plan's Prior-Auth Denial?

No — only the provider or the patient (or an authorized representative) can file an appeal. However, manufacturers can support the appeal process by providing clinical evidence summaries, appeal template letters, peer-to-peer talking points, and field reimbursement assistance. Tracking denial and appeal patterns by payer is an essential manufacturer function.

How Does Commercial Device Coverage Differ From Medicare DMEPOS?

DMEPOS prior authorization for devices covers the Medicare-specific prior-authorization program for durable medical equipment, prosthetics, orthotics, and supplies. Commercial plans have their own DME prior-authorization and quantity-limit policies, which may differ significantly from Medicare DMEPOS rules. Medicare DMEPOS uses competitive bidding and a Medicare Fee Schedule; commercial plans negotiate rates with DME suppliers directly.

For deeper context on US reimbursement and market access:

Medical device reimbursement guide — Overview of the US reimbursement landscape (Medicare-heavy); this article adds the commercial-payer dimension
Medicare Advantage prior authorization for devices — Medicare Advantage-specific prior-auth rules; contrast with commercial coverage
DMEPOS prior authorization for devices — Medicare DME prior-auth program; contrast with commercial DME coverage
CPT, HCPCS, and ICD coding for devices — Coding is the shared foundation for both commercial and Medicare claims
HEOR and the global value dossier — Building the evidence case for payer medical-policy adoption
Outcomes-based and value-based device contracts — Alternative commercial-payer coverage arrangements
Hospital value analysis committees and GPOs — Hospital buying is distinct from payer coverage; complementary