Internal Appeal vs External Review: Which Track You're On

Turn to the last page of the denial letter. Somewhere in the small type there are two deadlines, and they are almost never in the same paragraph. One gives you 180 days to appeal. Another, lower down or on the back, says four months.

Four months is shorter than 180 days. So the natural reading is that the shorter one is the real one and you have less time than you thought.

That reading is backwards. The two numbers belong to two different tracks, and the four-month one has not started yet.

Everything below was read against the regulations and agency pages on 16 August 2026, and each number links to the paragraph it comes from. I am not a lawyer or a claims professional, so the point of the links is that you can open them and check the sentence yourself.

Two tracks, one sentence each

Internal appeal is the insurer grading its own paper. You ask the plan or the issuer to look again, and someone inside that organization decides. Federal rules force that person to be someone other than the original decision-maker, and forbid them from deferring to the first decision (29 CFR 2560.503-1(h)(3)(ii)). It is still an internal decision.

External review is a stranger deciding. An independent review organization, an IRO, that has no financial relationship with your plan reads the file and either upholds or reverses. Its answer is binding on the plan, and the plan has to pay without waiting to see whether it wants to sue about it (45 CFR 147.136(c)(2)(xi)).

You almost always have to finish track one before track two opens. The exception is at the bottom of this page and it is more useful than it sounds.

Five things on the letter that tell you which track you are on

Read these in order. The first one that gives a clear answer is your answer.

1. The word "final." Regulations distinguish an adverse benefit determination from a final internal adverse benefit determination. The second phrase, or plain language like "this concludes our internal appeals process," means the internal track is closed and the four-month external review window is running.

2. How many internal levels your coverage gets. If you bought your plan yourself on the individual market, the issuer must give you exactly one level of internal appeal before it issues a final determination — 45 CFR 147.136(b)(3)(ii)(G). One denial of your appeal and you are done inside. An employer plan is different: it may build in a second level, though it cannot require you to file more than two appeals before you go to court (29 CFR 2560.503-1(c)(2)).

3. Whether that second level is required or voluntary. This is the sentence that traps people. If the plan describes a further level as voluntary, the rule requires the plan to waive any argument that you failed to exhaust by skipping it, to toll any statute of limitations or other timeliness defense while it is pending, and to charge you nothing for it (29 CFR 2560.503-1(c)(3)(i), (ii), and (v)). A voluntary level is not standing between you and external review. A required one is.

4. Who is named as the decider. A person, a committee, or a "medical director" at the plan means track one. An organization you have never heard of, or a phone number that is not the insurer's, is usually the IRO or the entity that assigns one.

5. The number of days printed next to the appeal instructions. 180 days is internal. Four months is external. If both appear, item 1 decides which one is live today.

Item 1 is the one people miss, largely because letters rarely use the regulation's own phrase. 45 CFR 147.136(a)(2)(v) defines a final internal adverse benefit determination as one upheld by the plan or issuer "at the completion of the internal appeals process" — or one where that process has been exhausted under the deemed exhaustion rules of (b)(2)(ii)(F). The second half of that definition is why a letter can be final without ever saying so: a plan that blew its own decision deadline may have handed you a final determination dressed as a status update. Read the closing paragraph and the appeal-rights block before you go hunting anywhere else in the envelope.

Track one: the internal appeal, and what you can pull out of it

The filing window is generous and the decision window is not.

A group health plan has to give you at least 180 days after you receive the denial to file the internal appeal (29 CFR 2560.503-1(h)(3)(i)). Then the plan owes you a decision inside these limits, assuming one internal level:

Those come from 29 CFR 2560.503-1(i)(2)(i) through (iii). If your plan runs two internal levels, each level gets half: 15 days pre-service, 30 days post-service. Whether a claim counts as urgent is decided by your attending provider, and the plan has to defer to that determination (45 CFR 147.136(b)(2)(ii)(B)).

While that runs, three things are yours for the asking, and most people never ask:

• Copies of everything relevant, free of charge. Not a summary. The documents, records, and other information relevant to your claim, on request, at no cost (29 CFR 2560.503-1(h)(2)(iii), with "relevant" defined at (m)(8)).
• Anything new the plan generates mid-appeal, before it decides. If the reviewer commissions a new opinion or invents a new rationale, the plan must send it to you free of charge and early enough that you can actually respond before the final denial goes out (45 CFR 147.136(b)(2)(ii)(C)).
• Continued coverage while the appeal is pending, if the denial is an insurer cutting off an ongoing course of treatment rather than refusing to start one (45 CFR 147.136(b)(2)(iii)).

That second bullet is the one worth writing down. A plan cannot quietly build a better denial and spring it on you at the end.

Use the regulation's word when you ask for the first bullet. Relevant is defined at 29 CFR 2560.503-1(m)(8) and it reaches further than a claim file: anything relied upon, anything "submitted, considered, or generated in the course of making the benefit determination, without regard to whether" it was relied upon, anything demonstrating compliance with the plan's own administrative processes and safeguards, and, for a group health plan, any statement of policy or guidance concerning the denied treatment for your diagnosis, again whether or not it was relied upon. The third and fourth categories are the ones nobody volunteers. A request that quotes (m)(8) and asks for all four by name is much harder to answer with a second copy of the denial letter.

Track two: external review, and why who runs it depends on two facts

Once the final internal denial arrives, you have four months from the date you receive it to request external review. Treat four months as the floor rather than the number: a state process only has to allow at least that long, so yours may be more generous (45 CFR 147.136(c)(2)(vi) for state processes, (d)(2)(i) for the federal one). The regulation handles the ugly calendar cases explicitly: if there is no matching date four months out, you get the first day of the fifth month, and if the deadline lands on a weekend or a federal holiday it moves to the next business day.

Not every denial qualifies. HealthCare.gov's external review page lists what does: denials turning on medical judgment, denials calling something experimental or investigational, and rescissions of coverage. A denial purely about eligibility, meaning you were not enrolled that month, gets screened out at the front door.

Then the sequence, using the federal process as the model:

1. You file. The plan or issuer has five business days to do a preliminary review, checking coverage, exhaustion, and completeness (45 CFR 147.136(d)(2)(ii)(A)).
2. Within one business day after that, they must write to you with the result. If your request was incomplete, they have to tell you what is missing and let you fix it within the four-month window or within 48 hours of that notice, whichever is later (45 CFR 147.136(d)(2)(ii)(B)).
3. An IRO is assigned, and it has to write and tell you that you may send it more material. The window in the federal process is ten business days from that notice (45 CFR 147.136(d)(2)(iii)(B)(2)); a state process only has to give you five (147.136(c)(2)(x)). Take the number from the IRO's own letter, not from this page.
4. Standard decision: 45 days from the IRO's receipt of the request (45 CFR 147.136(d)(2)(iii)(B)(6)). Expedited: 72 hours (147.136(d)(3)(iv)). A state process has to meet those same two limits (147.136(c)(2)(xii) and (xiii)).

Who runs it varies, and there is no national answer. Two facts decide it.

The first is whether your employer's plan is self-insured. State insurance law generally does not reach a self-insured plan, so those plans use the federal process unless the state has deliberately opened its own to them, in which case the plan may pick either (45 CFR 147.136(c)(1)(ii)). If the coverage is fully insured, the issuer follows the state process and the state process governs (147.136(c)(1)(i)).

The second is your state. HHS decides whether a state's process contains the minimum consumer protections drawn from the NAIC Uniform Health Carrier External Review Model Act as it stood on 23 July 2010 — that is the benchmark the federal rule names (45 CFR 147.136(a)(2)(viii); the model act itself is published by NAIC). States that clear the bar run their own. States that do not are covered by the HHS-administered federal process or by IROs the issuer contracts with.

CMS publishes the actual list. On the version I read on 16 August 2026 (CMS, State External Appeals Review Processes, page last modified 14 August 2026, table updated 9 July 2024), the HHS-administered or contracted-IRO column held Alabama, Florida, Georgia, Texas, and Wisconsin, plus American Samoa, Guam, the Northern Mariana Islands, and the Virgin Islands. Every other state, and Puerto Rico, ran its own. Do not take that from me — open the page, because it changes, and because your plan type can override it anyway.

Two things about external review are worth knowing before you weigh whether it is worth the effort:

• It is close to free, and often exactly free. The federal process may not impose any cost on you, filing fees included (45 CFR 147.136(d)(2)(iii)(A)(4)). A state process has to make the issuer pay the IRO, and may keep a filing fee only where state law already authorized one as of 18 November 2015. Where such a fee survives it cannot exceed $25, has to be refunded if the denial is reversed, must be waived if paying it would be a hardship, and is capped at $75 per claimant per plan year (147.136(c)(2)(iv)). HealthCare.gov states the same $25 ceiling.
• There is no minimum claim size. A state process may not require the claim to be worth some threshold amount before you can use it (45 CFR 147.136(c)(2)(v)). A $300 denial is eligible.

One more thing, and it expires. The HHS-administered process reopened on 31 July 2026 after a stretch of being unavailable, and CMS says people whose deadline fell between 1 July and 3 August 2026 may have until 2 October 2026 to file. That reaches Alabama, Florida, Georgia, Texas, Wisconsin, territories other than Puerto Rico, and, in any state, a self-insured non-federal governmental plan that uses the federal process (CMS notice, PDF). If your window closed in that stretch, this is worth ten minutes.

Requests to the federal process go through MAXIMUS Federal Services, the contractor named on HealthCare.gov, at its filing portal or by phone at 1-888-866-6205.

The shortcut: when the plan's own mistake opens track two early

If a plan or issuer fails to strictly adhere to the internal claims and appeals requirements, you are treated as having exhausted the internal process even though it is not finished. You can go straight to external review, and in an employer plan you can also pursue remedies under ERISA section 502(a) (45 CFR 147.136(b)(2)(ii)(F)(1); the individual-market twin is (b)(3)(ii)(F)(1)).

Missed decision deadlines are the obvious trigger. A post-service appeal with no answer on day 75 is not a plan being slow; it is a plan outside the rule.

There is a narrow exception for violations that are minor, non-prejudicial, and beyond the plan's control, and a mechanic for what happens if a reviewer or a court rejects your early filing: you get notice within 10 days and the filing periods restart from when you receive it (147.136(b)(2)(ii)(F)(2)). So this is a lever, not a loophole. But if the plan has blown a deadline, say so in writing and name the paragraph.

Keep that letter to four facts: the date you filed, the row of the table above that matches your claim, the date the answer was therefore due, and the paragraph number. For an employer plan there is a second provision to cite next to it — 29 CFR 2560.503-1(l)(1), the ERISA claims rule's own deemed-exhaustion clause, which treats administrative remedies as exhausted where a plan has failed to follow procedures consistent with the rule. Send it to the appeals address printed on the notice rather than to whoever answered the phone, and keep proof of the send date, because that date is now evidence on either track.

Your next action

Do this before you close the tab.

Open a calendar and write two dates, labeled:

• Internal appeal due: the date you received the denial, plus 180 days. Use the date on the envelope or the portal timestamp, not the date printed on the letter.
• Plan's answer due: 72 hours, 30 days, or 60 days from the day you file, whichever row of the table above matches your claim. If that date passes in silence, you may already be on track two.

Leave the four-month external review date blank. You cannot fill it in yet, and guessing at it is how people file too early and get screened out at preliminary review.

Then send one sentence to your insurer, in writing, today:

Under 29 CFR 2560.503-1(h)(2)(iii), please provide, free of charge, copies of all documents, records, and other information relevant to claim [number], including any internal rule, guideline, protocol, or clinical criterion relied on in the denial.

Everything you would put in an appeal comes out of what they send back.

If a number on this page has moved since 16 August 2026, or your letter says something these rules say it cannot, tell me and I will check it and update the page. More about how these guides are sourced is on the about page.