EDI 278: Health Care Services Review (Authorization/Referral)
The EDI 278 is the X12 Health Care Services Review transaction used to request and receive prior authorizations and referrals. The provider sends a 278 request for approval of a planned service; the payer returns a 278 response with a certification/authorization number, a pended status, or a denial. It is the electronic standard for authorization workflow.
- Transaction
- 278 — Health Care Services Review
- Direction
- Request outbound, response inbound
- Pairs with
- 270/271 eligibility; precedes the 837
What is the EDI 278?
The 278 is the authorization transaction. Before a service that needs prior authorization, a provider can submit a 278 request; the payer's utilization-management process reviews it and returns a 278 response — approved with a certification number, pended for more clinical information, or denied. It is the electronic backbone of the referral and authorization workflow.
It sits alongside the 270/271 in front-end work: eligibility confirms coverage, the 278 confirms the service is authorized.
How does the request and response work?
- The provider builds a 278 request: patient, requesting and servicing providers, the requested service and diagnosis, and supporting data.
- The payer\'s utilization management reviews it against medical-necessity criteria.
- The 278 response returns a certification/authorization number, a pend, or a denial with a reason.
- The authorization number is carried on the later 837 claim to link the approval to the bill.
How does it fit the workflow?
Capture the 278 authorization number at scheduling and attach it to the claim; a service that required auth and was billed without the number denies (often CO-197). For services that need clinical review to establish medical necessity, the 278 pend status tells you the payer wants records before deciding — respond fast to avoid a scheduling delay.
Any practical notes?
Frequently asked questions
The 278 is the electronic prior-authorization and referral transaction. A provider submits a 278 request describing the patient, the requested service, and the supporting information; the payer's utilization-management process returns a 278 response with an authorization/certification number, a pend for more information, or a denial. It is the HIPAA standard for the services-review workflow.
No. A 278 authorization confirms the service met the payer's medical-necessity criteria at the time of review, but payment still depends on eligibility on the date of service, correct claim coding, benefit limits, and other adjudication rules. An authorized service billed with the wrong codes or for a terminated member can still deny. Authorization removes one hurdle, not all of them.
Although the 278 is the standard, adoption for complex authorizations has lagged because many require clinical attachments and back-and-forth that the basic transaction handled awkwardly. Payers often route complicated requests through portals or fax. Electronic 278 works well for straightforward, rules-based authorizations and is expanding as attachment standards mature.
Sources & further reading
Reviewed by the ImmediCare Solutions RCM team
Certified billers and coders handling claims across 50+ specialties nationwide. This entry is reviewed against current payer policy and CMS rules. Last review: Jul 5, 2026.
Stop losing revenue to problems like this.
A free billing audit shows exactly where your practice is leaking money — no cost, no commitment.
