What does denial code CO-198 mean?

CO-198 means the claim was denied because prior authorization was obtained, but the service exceeded the authorization's approved limits — too many visits were delivered, too many units were billed, or the date of service fell outside the approved date range. Unlike CO-197 (no auth obtained), CO-198 means authorization exists but was exceeded. The fix is requesting additional authorization from the payer's Utilization Management department for the number of additional visits or units needed to cover the denied services.

What is the difference between CO-197 and CO-198?

CO-197 means prior authorization was not obtained before the service was rendered, or the auth on file does not match the service billed. CO-198 means authorization was obtained and the auth number is valid, but the approved limits were exceeded — more visits were delivered than approved, more units were billed than authorized, or services extended beyond the approved date range. CO-197 requires retro-authorization or an appeal for a service with no auth. CO-198 requires requesting additional units or an extension of an existing authorization. Both are auth-related but follow completely different remediation pathways.

Can I bill the patient for CO-198 denials?

Generally no, unless the patient was informed in advance — in writing — that additional visits beyond the authorized number might not be covered and accepted financial responsibility. If you delivered services beyond the authorized limit without notifying the patient, the denied claims are typically a provider write-off. For Medicare, an Advance Beneficiary Notice (ABN) must be given before the service for patient billing to be valid. Prevention — tracking auth limits before they are reached and obtaining additional auth before delivering the over-limit services — is far more effective than trying to recover CO-198 after the fact.

What services most often generate CO-198 denials?

CO-198 is most common in services with visit-limited authorizations: physical therapy, occupational therapy, speech therapy, chiropractic, behavioral health outpatient (psychotherapy, IOP), home health services, skilled nursing facility stays beyond the initially approved length of stay, cardiac rehabilitation, and pulmonary rehabilitation. These services involve ongoing care where the patient's needs may exceed the initial approval — making auth tracking and proactive re-authorization requests critical to avoiding CO-198.

CO Contractual Obligation · CARC Code 198

CO-198

Authorization Approved but Limits Exceeded

CO-198 means prior authorization was obtained and is valid — but the number of approved visits, units, or the authorized date range was exceeded. Unlike CO-197 (no auth at all), the auth exists. The fix is requesting additional authorization from the payer's Utilization Management department before resubmitting the denied claims.

Updated August 2026 · Group code: CO (write-off if not recovered) · Root cause: auth limit tracking failure · Fix: request additional auth units from UM

CO-198 in plain English

CO-198 means you have a valid prior authorization, but you delivered more services than it approved. The authorization approved a specific number of visits, units, or a date range — and the service on the denied claim goes beyond that limit. The fix is going back to the payer's Utilization Management department and requesting additional authorization for the over-limit services. CO-198 is entirely preventable if you track remaining auth units before scheduling each additional visit. Every CO-198 is a tracking failure, not a clinical failure.

⚠️

Do not deliver additional services without requesting more authorization first

When an auth is at its limit, stop scheduling new visits under that auth. Contact UM immediately to request additional units. If you continue delivering services while the additional auth request is pending and UM ultimately denies it, those services become a write-off. The only safe sequence is: request more auth → receive approval → then schedule the additional visit.

The 3 types of CO-198 limits

What was exceeded — and how to request more

Limit Type	What It Means	Common Specialty	What to Request from UM
Visit limit exceeded	Auth approved N visits (e.g., 12 PT sessions). The denied claim is for visit N+1 or beyond.	PT, OT, ST, Chiropractic, Behavioral Health outpatient	Additional visits (e.g., "requesting 8 additional PT visits for continued rehabilitation"). Provide updated functional status and clinical rationale.
Unit limit exceeded	Auth approved a specific number of units per claim (e.g., 4 units of a timed therapy code). The claim billed more units than the auth allows.	Physical therapy (timed codes), infusion, DME, home health aide hours	Additional units per session, or a revised auth that increases the per-visit unit limit. Document why the additional time was clinically required.
Date range exceeded	Auth was valid through a specific end date (e.g., valid 6/1–8/31). A service was rendered after the auth's expiration date but within the policy period.	All specialties with time-limited auths — especially post-surgical rehab, SNF, home health	Auth renewal or extension for the additional date range. This is a new auth request, not an amendment to the original.

Step-by-Step Fix

What to do when you receive CO-198

Audit the auth: how many units/visits were approved vs. used

Pull the original authorization record. Document: (a) total approved limit (visits, units, or end date), (b) how many were used on claims that paid, (c) how many are on the denied claim, and (d) how many additional services have been or will be scheduled. This audit gives you the exact scope to present to UM when requesting additional authorization.
Call UM and request additional authorization before any more services

Contact the payer's Utilization Management or Prior Authorization department. Identify yourself, provide the original auth number, and state: "We have a CO-198 denial — the approved [visits/units] were exceeded. We're requesting additional [N visits/units] to cover the denied service and continue care." Have the treating clinician's progress notes ready to support medical necessity for the additional services.
Once additional auth is approved — resubmit denied claims

Get the new or amended auth number from UM in writing (portal confirmation or fax). Resubmit the CO-198 denied claims with the new auth number in Box 23 / REF*G1. If the payer amended the original auth number, note the amendment in the claim remarks. Watch the timely filing clock — resubmit within the payer's window from the original date of service.
If UM denies additional auth — file a clinical appeal with the treating provider

A letter of medical necessity from the treating physician or therapist is the strongest element of a CO-198 appeal. The letter should: describe the patient's starting functional status, document measurable progress made during the authorized visits, state the specific functional goals that require additional visits to achieve, and cite any clinical guidelines (CMS, specialty society) that support the additional care. Request a peer-to-peer review with the payer's medical director if the first-level appeal is denied.

💡

Request additional auth when 2 visits remain — not after you've hit the limit

UM processing typically takes 3–5 business days for non-urgent requests. If you wait until the auth is exhausted to request more, you'll deliver services in the gap between the old auth and new approval — and those services will generate CO-198. The rule: request additional auth when 2 visits or 20% of units remain, whichever comes first. This provides a buffer for UM processing time.

Prevention

How to prevent CO-198 — auth limit tracking is the only real fix

Track remaining auth units in your scheduling system in real time. Every time a visit is scheduled and completed, decrement the remaining auth count. The scheduler should see the remaining authorized visits before booking the next appointment. If the remaining count is 2 or fewer, an auth request must be initiated before the next appointment is confirmed.
Build a hard stop for scheduling beyond the auth limit. Configure your EHR or scheduling system to block appointment creation when a patient has zero remaining authorized visits under an active auth. The block should require an auth override (which triggers an immediate auth request) before the appointment can be booked.
Track auth end dates separately from visit counts. An auth can expire by date even if visits remain. Set a calendar alert for 10 days before each auth's expiration date. If the patient still requires ongoing care, submit the auth renewal request before the expiration — not after the claim denies.
For behavioral health and rehab services, document progress toward functional goals at every visit. UM's decision to approve additional visits depends almost entirely on documented progress and ongoing clinical need. Clinicians who document measurable functional gains and specific goals remaining have significantly higher additional-auth approval rates than those who submit generic progress notes.
Run a CO-198 denial report monthly by service type and clinician. A spike in CO-198 at a specific therapist or location reveals a broken auth tracking workflow at that site. Address the process — not just the individual claims.

Frequently Asked Questions: CO-198

CO-198 means a valid prior authorization exists for the service, but the claim was denied because the authorization's approved limit was exceeded — either too many visits were delivered, too many units were billed, or the service date fell outside the authorization's approved date range. CO-198 is different from CO-197 (which means no auth was obtained at all). The fix is requesting additional authorization from the payer's Utilization Management department and resubmitting the denied claims with the new auth number once it's approved.

CO-197 means prior authorization was not obtained before the service — no auth exists, or the auth on file doesn't match the service billed. CO-198 means authorization was obtained and is valid, but the service exceeded the authorization's approved limits. CO-197 requires retro-authorization or an appeal for a service rendered without approval. CO-198 requires requesting additional units or an extension of an existing authorization. Both are auth-related denials but follow completely different fix pathways.

Generally no, unless the patient received advance written notice that services beyond the authorized limit may not be covered and accepted financial responsibility in writing before those services were delivered. If you delivered over-limit services without notifying the patient, the denied claims are typically a provider write-off. For Medicare patients, an Advance Beneficiary Notice (ABN) must have been issued before the service. Prevention — requesting additional auth before the limit is reached — is far more effective than attempting to recover CO-198 after the fact.

Non-urgent additional authorization requests typically take 3–5 business days for commercial payers. Urgent concurrent review requests (for inpatient stays or ongoing acute care) may require a 24–72 hour turnaround. Some payers offer real-time auth extensions via their provider portal for common services like PT and OT. Check the payer's portal before calling — portal-based extensions are often faster than phone UM requests. Do not wait until the auth is exhausted to request more — initiate when 2 visits or 20% of units remain.

Authorization Approved but Limits Exceeded

What was exceeded — and how to request more

What to do when you receive CO-198

How to prevent CO-198 — auth limit tracking is the only real fix

Frequently Asked Questions: CO-198

Denial codes commonly seen with CO-198

CO-198 is a scheduling problem, not a billing problem.