Federal External Review Process or Your State's: Which One

Two people in the same state can be denied the same surgery by the same insurer in the same week and have to send their external review requests to two different places. One mails it to the insurance company. The other files it with a state agency. A third, who works for a county, sends hers to a contractor at 3750 Monroe Avenue in Pittsford, New York.

Nothing on the front of the denial letter explains why.

The difference between the internal appeal and external review is the first fork in the road, and it is the one most letters at least gesture at. This page is about the second fork, which almost none of them explain: once you are past the final internal denial and external review is open to you, who runs it — your state, or the federal process — and what changes depending on the answer. Everything below is cited to the paragraph that sets it, as the eCFR served the text current to 24 September 2026, read on 26 September 2026.

Three questions, in this order

Work down the list. Stop at the first one that answers.

1. Does your employer's plan pay claims out of its own money?

State insurance law regulates insurance contracts, and it generally cannot reach an employer that funds claims out of its own account — which is why a self-insured plan usually lands in the federal process (45 CFR 147.136(c)(1)(i) and (c)(1)(ii)). That mechanism, and the narrow case where a state opens its own process to plans it cannot compel so that the plan may pick either route, is worked through at self-funded or fully insured; if you do not yet know which you have, the employer's Form 5500 filing settles it without asking HR.

What matters for the question on this page is narrower: the answer to question 1 can be "both." When it is, nothing about your diagnosis or your state decides the rest — an election your employer made, probably years ago and probably without telling anyone, does.

2. Has HHS found your state's process good enough?

This is a determination HHS makes against the 16 minimum protections at 147.136(c)(2)(i) through (xvi), and the NAIC model act those protections were drawn from is covered on the track page. Two practical points about the list itself are worth having in front of you before you use it.

The first is where to read it, because it is a table on one CMS page rather than a rule: Affordable Care Act: Working with States to Protect Consumers. On the copy served on 26 September 2026 the column headed "HHS Administered Process/Independent Review Organization Process" held Alabama, Florida, Georgia, Texas and Wisconsin, with American Samoa, Guam, the Northern Mariana Islands and the Virgin Islands under it. Forty-five states plus the District of Columbia sat in the other column, and so did Puerto Rico — the only territory that does.

The second is that the page carries two different dates, and the one that matters is the older one. CMS stamps it "Page Last Modified: 08/14/2026," but immediately under the table it says Table updated July 9, 2024. The state assignments are therefore more than two years old on a page that looks current this month — and they do move: Arizona sits in the state column with a parenthetical effective date of 1 January 2025, which is after the table's own revision stamp. If your state is anywhere near the boundary, the column on that table is a starting point rather than an answer, and your denial letter is better evidence than either.

3. If you are in the federal process, which version of it?

This is the question almost nobody asks, and it changes the address on the envelope. The next section is entirely about it.

Two categories sit outside the whole framework and are worth ruling out early. A grandfathered plan is generally exempt from this section, with one carve-out: external review still applies to denials involving out-of-network emergency services, non-participating providers at participating facilities, and non-participating air ambulance services, for plan years beginning on or after 1 January 2022 (147.136(a)(1)(ii) and (g)). And Medicare and Medicaid do not use any of this — Medicare Advantage and Original Medicare run their own five-level appeal system, and Medicaid runs fair hearings.

"Federal" usually does not mean the government is reading your file

The phrase invites a wrong picture. Two different machines answer to the same name.

Version one: your plan assigns the reviewer. Under 45 CFR 147.136(d), the plan or issuer picks the reviewer itself, from a pool it built: it must hold contracts with at least three accredited independent review organizations and rotate assignments among them, or use some other method it can show to be genuinely unbiased, such as random selection (147.136(d)(2)(iii)(A)(2)). Two guardrails sit beside that. The IRO may not be eligible for financial incentives based on the likelihood that it will uphold the denial ((A)(3)), and the IRO process may not impose any costs on you, filing fees included ((A)(4)). For self-insured ERISA plans the three-IRO rotation is also the shape of the Department of Labor's enforcement safe harbor in Technical Release 2011-02, which phased in two IROs by 1 January 2012 and three by 1 July 2012.

So nobody at any agency touches version one. The rotation requirement means the name that comes up on your file is not chosen for your file — but the pool it was drawn from was assembled by the plan, under contracts the plan signed, against invoices the plan pays. That is a real arrangement with real incentives in it, and a considerably more useful thing to hold in your head than a federal office that does not exist.

Version two: the HHS-administered process. Paragraph (d)(4) creates an alternative, and it is worth reading in the regulation's own words because the whole routing question turns on one sentence:

Insured coverage not subject to an applicable State external review process under paragraph (c) of this section and a self-insured nonfederal governmental plan may elect to use either the Federal external review process, as set forth under paragraph (d) of this section or the Federally-administered external review process, as set forth by HHS in guidance.

That second option is the one run under contract by MAXIMUS Federal Services and marketed as the HHS-administered Federal External Review Process, the FERP. Worth noticing that the regulation names no contractor at all — it points at HHS guidance, and MAXIMUS is who HHS engaged under it. The name on the envelope can change without this paragraph changing.

Now read the eligibility list again for what is missing from it. It has exactly two entries — insured coverage with no applicable state process, and self-insured non-federal governmental plans. A self-insured private employer plan appears in neither, and so cannot elect the HHS-administered route at all. The Department of Labor's twin of the same paragraph, at 29 CFR 2590.715-2719(d)(4), is narrower still: it names insured coverage without an applicable state process and stops there, which makes sense, since a governmental plan is not an ERISA plan and is none of DOL's business.

The practical consequence is worth being blunt about. If you work for a private company that pays its own claims, an envelope addressed to MAXIMUS is going to the wrong place — not late, not incomplete, but outside the process your plan is in. Your reviewer is an IRO your plan is under contract with, and the plan has to tell you which one.

Public-sector plans are the category that gets misfiled in the other direction. A city, county, school district, state agency, or public university plan is not governed by ERISA, and (d)(4) lets it elect the HHS-administered process in any state — including one that runs a perfectly good process for everybody else. Which is how a teacher and the insurance agent who sold her a policy down the street end up on different tracks in the same state, and how two people at the same employer end up on different tracks because they chose different plan options at open enrollment.

Only one of the three addresses belongs to a government office

In the federal process — either version — you file with the plan or issuer. This is the least intuitive thing on the page, so it is worth saying flatly: the organization that denied the claim is the organization that receives your request to have the denial reviewed, and it is the organization that then hands your file to the reviewer. What happens next runs on a timetable set out step by step with citations elsewhere on this site, and is not repeated here.

One deadline inside that sequence does belong here, because it is the only one whose consequences land on the plan instead of on you. Within five business days after the IRO is assigned, the plan or issuer must give the reviewer the documents and information it considered when it made the denial. If it fails to, the regulation says the IRO may terminate the external review and make a decision to reverse the denial, and must tell you within one business day of deciding that (147.136(d)(2)(iii)(B)(3)). Two honest caveats. It is discretionary for the reviewer rather than automatic, and it is not a remedy you apply for: the duty lives in the plan's contract with the IRO, a term the regulation requires the plan to put there. What it is good for is knowing that the plan sitting on its own records is the party running a risk — reason enough to write down the date you are told the IRO was assigned.

If your plan elected the HHS-administered FERP, the request goes to MAXIMUS instead. HealthCare.gov publishes the channels on its external review page: the online portal at maximusferp.my.site.com, phone 1-888-866-6205 to request a paper form, fax 1-888-866-6190, email ferp@maximus.com, or mail to MAXIMUS Federal Services, 3750 Monroe Avenue, Suite 705, Pittsford, NY 14534. The FERP site frames the right as belonging to "consumers or their authorized representatives," which is the opening you want if the person who can actually make the clinical argument is your doctor rather than the person whose name is on the policy; ask the contractor for its representative form before you assume you have to write the appeal yourself.

State processes commonly invert the direction of travel. New York's external appeal application goes to the Department of Financial Services, online or on a fillable form, and not to the health plan at all. California's Independent Medical Review goes to the Department of Managed Health Care, and DMHC is explicit that it will close your case if you have not finished the plan's own grievance process first — with the corollary that you may come to DMHC if the plan has not answered that grievance within 30 days, or if you are not satisfied with the answer. DMHC also says the IMR is free and, once a case qualifies and the required documents are in, is normally decided within 30 days.

One caution specific to California that this page cannot settle for you: DMHC licenses health care service plans, while some insurance products in the state answer to the California Department of Insurance instead, and an application filed with the wrong one of the two is time spent rather than time counted. Which regulator holds your product is printed on your own plan documents and is worth checking before you file, not after.

The broader point applies everywhere. Sending a state application to your insurer, or a federal request to your state's insurance department, does not stop the four-month clock while somebody forwards it — if it gets forwarded at all.

The agency pages above were read on 26 September 2026 and are the kind that get reorganized; if a link has moved, search the agency's own site rather than trusting a summary of it, this one included.

Deadlines, fees, and the one place a state can give you less

Sources for the state column: 147.136(c)(2)(vi), (x), (xii), (xiii), (v) and (iv). Federal column: 147.136(d)(2)(i), (d)(2)(iii)(A)(4), (B)(2), (B)(6) and (d)(3)(iv). The 45-day and 72-hour figures for the HHS-administered column come from HealthCare.gov's external review page, not from the regulation. Four months is a floor rather than a fixed number, and what the rule does about months with no matching date — 30 October plus four months, for instance — is worked out on the track page.

The fee row is worth a second look, because the regulation and the government's own consumer page do not say the same thing. The regulation is flat: the federal IRO process may not impose any costs, including filing fees, on the claimant (147.136(d)(2)(iii)(A)(4)). HealthCare.gov's page tells readers that if their issuer has contracted with an IRO or is using a state process "you may be charged," up to $25. Those two statements only both work if the charge belongs to the state column, since a contracted-IRO review is the federal process, where the regulation forbids it. If you are in a federal-process review and an invoice arrives, that paragraph number is the whole reply. Where a state fee is lawful, the ceilings and the refund and hardship rules are at 147.136(c)(2)(iv).

The row where a state can genuinely give you less is the fourth one, and it is the reason to build the file first. Five business days is the floor for getting material to the reviewer after it writes to you — half of what the federal process allows — and five business days is not enough time to request records from a hospital, get a letter from a treating physician, and obtain the plan's own clinical criteria. None of those three things arrive on demand. Start them while the internal appeal is still open, so that what you are doing after you file is posting a file rather than building one.

What a state process can do that the federal one cannot

The floor is a minimum, and some states are well above it.

New York decides a standard external appeal in 30 days rather than 45, and an expedited one in 72 hours. Non-formulary drug disputes run faster again on both tracks: 72 hours standard, 24 hours expedited — so in New York a drug case filed as a standard appeal is decided in the time the federal rule allows for an emergency. It publishes a searchable database of past external appeal decisions by year, diagnosis, treatment, or keyword, which is the closest thing to case law a patient can read before filing. And it lists four specific No Surprises Act grounds for an external appeal, including that incorrect cost-sharing was applied to a surprise bill, or that the out-of-network claim may have been coded wrong.

That last point is not a New York invention. Since plan years beginning on or after 1 January 2022, external review reaches denials that turn on whether the plan complied with the surprise billing and cost-sharing protections — in the state column at 147.136(c)(2)(i), in the federal column at 147.136(d)(1)(i)(B). External review is not only for "is this medically necessary."

There is one asymmetry running the other way, though, and it is the least advertised thing on this page. The federal scope provision expressly reaches a determination of whether a plan is complying with the nonquantitative treatment limitation provisions — the rules requiring parity in how medical management techniques are applied to mental health and substance use disorder benefits (147.136(d)(1)(i)(A), which names PHS Act section 2726 and §§ 146.136 and 147.160). Set the two lists beside each other and the state minimum at (c)(2)(i) covers medical necessity, appropriateness, health care setting, level of care, effectiveness of a covered benefit, and the surprise billing and cost-sharing protections — and then stops. Parity is not in it. Neither, for that matter, is the wellness-program item that sits in the federal list.

That list is a floor and not a ceiling, so a state may take a parity case regardless, and many will, under their own mental health statutes rather than under this section. But "may" is carrying real weight in that sentence. If a parity argument is the spine of your case rather than a note in the margin — a prior-authorization requirement imposed on therapy that is not imposed on comparable medical care, say — then find out which process you are in and what your own state's parity law actually provides before you decide which argument to lead with. This is the one place on this page where the answer to "who runs it" can change not just the address but what you are permitted to argue.

There is also New York's trap, which is a good example of why the state page matters more than any summary: if your plan offers a second-level internal appeal, you do not have to file one, but if you do, DFS still measures the four months from the first appeal decision. A second internal round can quietly consume the external window.

The denials that get screened out at the door

Preliminary review is not a formality, and two categories die there.

Eligibility. A denial based on your failing to meet eligibility requirements under the terms of the plan — a worker-classification question, an enrollment gap — is not eligible for external review (147.136(d)(1)(i)(A) and (d)(2)(ii)(A)(2)). The confusing part is that eligibility is appealable internally; the MAXIMUS FERP site lists eligibility for coverage after a claim has been filed among the things an internal appeal can address. Internal yes, external no.

Not-yet-exhausted internal appeals, unless you are excused. The exception is the useful one: where the plan failed to follow the internal claims and appeals rules, you are treated as having exhausted them and can go straight out (147.136(b)(2)(ii)(F)(1); the state-process twin is (c)(2)(iii), which also excuses exhaustion where the issuer waived it or where you are asking for expedited external review at the same time as an expedited internal appeal).

One more item belongs here, and it expires almost immediately — on 2 October 2026, six days after this page was written. Read this paragraph for its date first.

The HHS-administered FERP was unavailable for part of this summer and reopened on 31 July 2026. Because of that gap, CMS gave a one-off extension: consumers whose deadline to request external review fell between 1 July and 3 August 2026 have until 2 October 2026 to file with MAXIMUS, that being the 60th calendar day after 3 August, the first full business day after the reopening. It reaches people in the five federal-column states and the four territories other than Puerto Rico whose plan or issuer has elected the HHS-administered process, and, in any state, enrollees in a self-insured non-federal governmental plan that has elected it. If you filed before 1 July 2026 and have not yet had a decision, you do not need to resubmit; if you already have a final FERP decision, the extension does not reach you (CMS, HHS-administered FERP Deadline Extension, PDF).

After 2 October 2026 this paragraph is spent, and nothing replaces it. The extension was relief for one interruption, not a standing rule and not a general grace period: once it lapses, the only deadline that applies to a FERP request is the ordinary four-month window from your final internal denial under 147.136(d)(2)(i), exactly as it was before the outage. A deadline that expired inside that 1 July to 3 August window and was not filed by 2 October is not revived by anything on this page. If you are reading this after that date and think you were in the affected group, the question to put to MAXIMUS is not whether the extension still runs — it does not — but whether your four-month clock is genuinely spent, which depends on the date you received the final internal denial rather than the date printed on it.

The sentence to get in writing before you address the envelope

The final internal denial is required to tell you about external review, and in most cases it names the organization that will handle it — HealthCare.gov points you to exactly that, the Explanation of Benefits or the final internal denial, as the place to look. Read that block first. A state agency named there means question 2 is already answered; MAXIMUS named there means your plan elected the HHS-administered process; an unfamiliar company name means version one, a contracted IRO.

If the letter is vague, send one sentence to the appeals address printed on it and keep proof of the date:

Please state in writing whether this plan's external review is conducted under an applicable state external review process or under the Federal external review process at 45 CFR 147.136(d), and if federal, whether the plan has elected the HHS-administered Federal External Review Process under 147.136(d)(4) or assigns an accredited independent review organization under 147.136(d)(2)(iii); and give the name and filing address of the entity that will receive my request.

Then put one date on a calendar: four months from the day you received the final internal denial, counted from the envelope or the portal timestamp rather than the date printed on the letter. If the answer to the question above takes three weeks to arrive, the clock has still moved three weeks. Everything else on this page is about where to send the file. That date is about whether anyone has to read it.

Two of the things on this page are dated in a way the rest are not. The CMS state table was last revised in July 2024 even though the page around it says August 2026, and the FERP extension dies on 2 October 2026. Those are the two places where a stale copy of this article would actively mislead you, which is why both carry their dates in the text rather than in a footnote. The paragraph numbers are here so you never have to take this page's word for anything: open the section link, and check the currency date the eCFR prints on what it serves you against 24 September 2026. This is a reading of published rules by someone who is not a lawyer and holds no licence to give legal advice. If one of these numbers has moved, or your letter said something this page did not predict, tell me through contact — that is usually how the dated paragraphs get caught. Why anything here is sourced the way it is: about.