Back to resources

Concurrent review

How do PHP and IOP programs prepare a concurrent review that holds up?

A concurrent review that holds up is built before the call, not during it. The payer’s utilization-management reviewer spends a small amount of time per case — in our work with PHP and IOP programs, typically on the order of 5 to 15 minutes — and decides on the evidence in front of them at that moment. The job of the program is to put a structured packet in front of that reviewer that maps the patient’s current presentation to the specific criteria the plan applies (ASAM 4th Edition, LOCUS/CALOCUS-CASII, or MCG), documents that less intensive care has failed or is insufficient, and shows measurable movement on a defined treatment plan. Programs that run continued-stay review as an organized workflow rather than a scramble see fewer medical-necessity denials, shorter peer-to-peer cycles, and cleaner appeals when a denial does occur.

By Lucida clinical team

Published May 25, 2026 · Last updated May 25, 2026

Partial hospitalization programs (PHP) deliver at least 20 hours per week of structured psychiatric care as an alternative to inpatient hospitalization. Intensive outpatient programs (IOP) deliver roughly 9–19 hours per week. “Concurrent review” and “continued-stay review” are used interchangeably here for the ongoing, mid-episode authorization the payer requires to keep the patient at that level of care.

What is a concurrent review, and what is the UM reviewer actually checking?

A concurrent review is the payer’s ongoing check that the patient still meets medical necessity for the level of care being billed. It happens after the initial authorization is in place and runs on a recurring cadence until discharge or step-down. The reviewer — usually a licensed nurse or behavioral-health clinician working from the plan’s criteria — is not making a clinical decision about the patient. They are matching what the program has documented against the plan’s adopted criteria set and deciding whether the next block of days is authorized.

In practice the reviewer is checking three things: the diagnosis and acuity still meet the criteria for the current level of care; less intensive care is documented as inadequate or previously failed; and the treatment plan is producing measurable movement (or there is a defensible reason it is not). The criteria the reviewer applies depend on the plan and the diagnosis — ASAM 4th Edition at Optum/UnitedHealthcare, Cigna/Evernorth, Aetna (substance use), and Carelon for SUD reviews; LOCUS and CALOCUS-CASII at Aetna (mental health) and several Medicaid MCOs; MCG Behavioral Health Care Guidelines at Anthem/Elevance and several Medicare Advantage carriers. See our breakdown of LOCUS vs. ASAM vs. MCG for the current cross-payer map.

When does the first concurrent review hit, and how often after that?

The cadence varies by payer, level of care, and the length of the initial authorization. As a working baseline: initial PHP and IOP authorizations typically cover 5 to 7 days for the first block, after which the payer expects a continued-stay review every 5 to 7 days. Residential and detox blocks are often shorter at the front end — 3 to 5 days — tightening as the episode progresses. These windows are not universal; specific authorization lengths are set in the plan’s provider manual or assigned at the time of the prior authorization, and they change.

Two consequences follow. First, the UR function needs a forward calendar that knows when every active patient’s next review is due and which reviewer at which payer owns it. Missed reviews produce administrative denials that are harder to appeal than clinical ones. Second, the documentation cadence has to match the review cadence. If the payer expects to see measurable movement every 5 days, a treatment-plan update written every 14 days will create a documentation gap the reviewer can point at, regardless of how well the patient is actually doing.

What evidence does the payer actually want to see at each touchpoint?

The criteria sets ask overlapping questions, so the same structured evidence packet can satisfy ASAM, LOCUS, and MCG with minor framing changes. In our reading of the published criteria and the CMS standard, the minimum evidence elements are:

  • Current DSM-5-TR diagnosis and symptom severity with concrete clinical observations (not adjectives). Quantified where possible — PHQ-9, GAD-7, CIWA-Ar or COWS, Columbia-Suicide Severity Rating Scale, urine drug screen results, vitals for detox cases.
  • Risk profile for continued stay. Suicidality, self-harm, withdrawal risk, biomedical complications, recovery-environment factors. ASAM 4th Edition organizes this as dimensional risk; LOCUS asks it through risk-of-harm and functional-status dimensions; MCG asks it through discharge-readiness checklists.
  • Failure or inadequacy of less intensive care. Either a documented step-down attempt that did not hold or a clinical argument for why outpatient care is not sufficient given the risk profile. A core requirement under Medicare PHP coverage policy — Novitas’s Local Coverage Determination L37633 is a widely cited example, and other MACs publish equivalent PHP LCDs in their jurisdictions — and echoed in every commercial criteria set.
  • Physician certification for PHP. The physician’s attestation that inpatient psychiatric care would be required if PHP services were not provided. A Medicare-specific requirement under L37633 and the cleanest framing to lift into commercial notes.
  • Structured programming hours actually delivered. At least 20 hours per week for PHP, or the applicable IOP hour range, with the specific therapies attended on each date. Routinely audited — missing or vague hour logs are a clean denial path.
  • Measurable goals and progress against them. Treatment-plan goals with objective indicators and each progress note referencing movement or lack of movement. Aligned with MCG’s continued-stay indicators and LOCUS’s engagement dimension.
  • Coordination of care. Documented contact with the ordering physician, outpatient prescriber, family system where appropriate, and the next level of care. Often the difference between an approved continued-stay review and a medical-necessity denial.

How should the medical-necessity narrative be structured?

A clean concurrent-review narrative answers four questions explicitly: why this patient, why this level of care, why now, why still. “Why this patient” is the diagnosis, acuity, and risk picture. “Why this level of care” is the criteria-language mapping — if the plan uses ASAM, the narrative cites dimensional risks; if LOCUS, it cites dimension ratings; if MCG, it tracks the goal-length-of-stay framing. “Why now” ties the current presentation to the decision to be at this level of care this week. “Why still” is the continued-stay argument: what has changed, what has not changed, and what specifically still requires this intensity.

Two patterns produce stronger narratives than free-form notes. First, quote the criteria language back. When the plan’s criteria use a phrase like “significant impairment in functioning,” the narrative should describe the impairment in those terms and back it with observation. Second, write each narrative as if the reviewer has not read the prior ones — they often have not. The continued-stay note should re-state the risk profile and the rationale, not assume context.

Active voice and specifics carry weight. “Patient is tearful, reporting passive suicidal ideation without plan or intent, declined to engage in group on 5/22 and 5/23, requires one-on-one staffing per shift” reads as defensible. “Patient continues to benefit from PHP level of care” reads as boilerplate — and reviewers know it.

What kills a concurrent review most often?

The recurring failure modes we see in PHP and IOP authorization workflows are predictable and largely structural rather than clinical:

  • Cut-and-paste progress notes. Identical or near-identical language across multiple days signals to the reviewer that the patient is not actually being re-assessed. It is one of the cleanest pretexts a payer has for a medical-necessity denial.
  • Generic continued-benefit language. “Patient continues to make progress and benefit from programming” without specific indicators is not evidence of medical necessity — it is conclusory and easy to deny against.
  • Missing physician certification or recertification dates. For PHP under Medicare coverage policy — for example, Novitas’s LCD L37633, which applies to PHP claims in the Novitas MAC jurisdiction; other MACs publish equivalent LCDs with similar requirements — the physician must certify at admission and recertify on the cadence the plan requires. A missing recertification is a technical denial regardless of clinical merit.
  • Programming hours not documented at the date and modality level. If the note says “attended program” but the attendance log does not back the 20-hour PHP threshold for the week, the week is at risk.
  • No step-down or step-up rationale. The criteria sets all ask, in their own language, why the patient is at this level rather than the next one down. If the note never engages that question, the continued-stay argument is incomplete.
  • Narrative-to-criteria gaps. A clinically excellent note that does not use the plan’s criteria language will still be denied against criteria. The fix is not different clinical care — it is mapping the note to the criteria the reviewer has in front of them.
  • Missed review windows. Administrative denials from a missed continued-stay submission are harder to overturn than clinical denials, because there is no medical-necessity argument to make — only a timeliness appeal.

How should the program prepare before the call, not during it?

A defensible concurrent-review packet is assembled across the days leading up to the review, not in the fifteen minutes before. The pre-call packet should contain: the current diagnosis and risk picture in the plan’s criteria language; the relevant progress notes since the last authorization, flagged for the specific evidence the criteria ask for; programming attendance backing the hour threshold; the treatment plan with explicit goals and current progress indicators; physician certification or recertification dates; and the step-down rationale — what the next level of care would be and why the patient is not ready for it yet.

Programs that run this as a workflow rather than a per-case effort generally do three things differently. They maintain a running “defense file” per active patient that the UR nurse, clinical lead, and physician all contribute to. They build the note template against the plan’s criteria language for the patient’s actual payer, not a generic template. And they pre-write the peer-to-peer rationale at the time of the review submission, so that if the reviewer denies, the physician has a defensible argument ready rather than improvising on a 10-minute call.

How do concurrent reviews differ across Aetna, Cigna, Optum/UHC, Anthem, and Medicaid MCOs?

The mechanics differ in ways that matter operationally even when the underlying medical-necessity bar is similar. Optum/UnitedHealthcare applies ASAM 4th Edition for adult substance use commercial reviews and the 3rd Edition for adolescents (Optum ProviderExpress 4th Edition FAQ), with reviews submitted through ProviderExpress. Cigna/Evernorth applies ASAM nationally for SUD and publishes its medical necessity criteria publicly (Evernorth Medical Necessity Criteria). Aetna uses LOCUS and CALOCUS-CASII for mental health and ASAM for substance use (Aetna LOCUS/ASAM patient-care programs page). Anthem/Elevance applies MCG Care Guidelines for behavioral health, with ASAM applied to SUD where state law or member contract requires it (Anthem provider news: MCG Care Guidelines adopted for behavioral health services). Carelon Behavioral Health administers mental health benefits for a number of BCBS and state Medicaid plans and lists multiple recognized criteria sets depending on the benefit (Carelon Medical Necessity Criteria).

Medicaid MCOs are state-by-state. The state plan, the managed care contract, or a standalone behavioral-health bulletin sets the framework. A meaningful number of states have administratively adopted ASAM as the standard for SUD level-of-care determinations; mental-health criteria are more variable. The exact picture changes — confirm in the state’s current Medicaid provider manual before relying on it.

For Medicare Advantage, CMS’s April 2023 MA final rule (codified at 42 CFR 422.101) clarified that when a Medicare National Coverage Determination or Local Coverage Determination exists, those coverage criteria govern over proprietary utilization-management tools for the covered service. PHP coverage policy is set by the MAC with jurisdiction over the claim — Novitas’s LCD L37633 is one widely cited example, covering Novitas’s jurisdiction; other MACs publish their own PHP LCDs with substantively similar but not identical requirements. An MCG or InterQual criterion that is stricter than the applicable LCD is not enforceable for traditional Medicare-covered PHP; whether and how that principle reaches MA denials is an active area of dispute providers should track.

Underlying all of this, the 2024 federal parity final rule reclassified medical necessity criteria as a non-quantitative treatment limitation (DOL EBSA fact sheet). Enforcement of the new 2024 NQTL provisions is paused as of this writing, but the 2008 MHPAEA statute and the 2013 final rule remain in force — a denial that applies a stricter behavioral health criterion than the plan uses on the medical/surgical side is still a viable parity argument. See our payer-workflows overview for how this maps into operational playbooks.

Key takeaways

  • The reviewer decides on the evidence in front of them in a short window — preparation is the leverage point, not the call itself.
  • Continued-stay cadence is typically every 5 to 7 days for PHP and IOP, with shorter blocks for residential and detox; the documentation cadence has to match the review cadence.
  • The evidence packet is the same across ASAM, LOCUS, and MCG: diagnosis and acuity, risk profile, step-down rationale, physician certification, programming hours, measurable goals with progress, coordination of care.
  • Cut-and-paste notes, generic “continues to benefit” language, missing physician certifications, and undocumented programming hours are the recurring failure modes.
  • The narrative should quote the plan’s criteria language back and answer four questions explicitly: why this patient, why this level of care, why now, why still.
  • Payer-specific submission mechanics differ even when the underlying medical-necessity bar is similar — build the note template against the plan the patient actually has.
  • For traditional Medicare PHP, the applicable MAC’s LCD sets the floor — Novitas’s L37633 is the most commonly cited example, with equivalent LCDs from other MACs in their jurisdictions; MA proprietary criteria that are stricter than that LCD are contestable under the 2023 MA final rule.

How Lucida helps

Lucida is the authorization-defense layer for higher-acuity behavioral health programs. We design the concurrent-review workflow against the plans your program actually contracts with, surface the evidence the criteria ask for before each review window, and run alongside your UR and clinical leaders through the engagement — service and software together, not a dashboard handed over a fence.

See it on your own data — request a free Authorization Defense Assessment or book a demo. For background on the criteria your payers apply, see LOCUS vs. ASAM vs. MCG, and for the operating model see how we work.

Want your concurrent-review packets stress-tested?

30 minutes with our clinical reviewer, scored against your actual PHP, IOP, residential, or detox cases.

Book a demo