Health Insurance Denials and Appeals: ERISA Plans, ACA Coverage, and External Review

A health insurance denial arrives as a letter that reads like a verdict. It is not one. It is the first stage of an administrative process with defined deadlines, defined content requirements, and — in most cases — a right to review by someone who does not work for the insurer.

A substantial share of denials are overturned on appeal. A substantial share are never appealed. Those two facts, taken together, describe most of what is wrong with how Americans experience health coverage, and they are the reason this article exists.

The first thing to establish is not what the denial says. It is what kind of plan you have, because everything else follows from that.

Part I: The threshold question — which regime governs

Self-funded ERISA plans. Most large employers do not buy insurance; they pay claims from their own assets and hire an insurer or third-party administrator to process them. The plan is governed by the Employee Retirement Income Security Act, and it is exempt from state insurance regulation through ERISA's preemption provision and the "deemer" clause. State mandates — coverage requirements, external review laws, bad faith remedies — generally do not apply.

Fully insured plans. The employer buys a policy; the insurer bears the risk. ERISA still governs the employee benefit plan, but the insurance policy itself is subject to state insurance regulation through the savings clause, so state coverage mandates and state external review apply.

Individual and marketplace coverage. Purchased directly or through an exchange. Governed by the Affordable Care Act and state insurance law. No ERISA.

Government and church plans, Medicare, Medicaid, TRICARE, and VA care each have their own separate regimes.

How to find out. Ask your employer's HR department, in writing: "Is our health plan self-funded or fully insured?" Or look at the Summary Plan Description, which must state it, or the Form 5500 the plan files. This single question determines what law applies, what appeal rights exist, what remedies are available, and whether a court will defer to the insurer's decision.

Why it matters so much:

	Self-funded ERISA	Fully insured / individual
State coverage mandates	Do not apply	Apply
State external review	Generally not — but the federal external review process does	State process applies
Bad faith / punitive damages	Preempted	Available in many states
Damages beyond benefits	Not available	Sometimes
Standard of review in court	Frequently arbitrary and capricious	Varies; sometimes de novo
Jury trial	Generally no	Sometimes

Part II: What the denial actually says

Denial letters use a small vocabulary, and each term points to a different response.

Not medically necessary. The most common. The plan concedes the service is covered in principle but says it is not needed for this patient. This is a clinical dispute, and it is the category most often overturned on external review, because an independent physician reviewer applies clinical judgment rather than a utilization protocol.

Experimental or investigational. The plan says the treatment is not established. Frequently wrong for treatments with published evidence, off-label uses supported by compendia, or newly approved therapies. Nearly every external review regime treats this as a reviewable clinical question.

Not a covered benefit. A contractual exclusion. This is a plan-language dispute rather than a clinical one, and it is won by reading the plan document carefully — the exclusion may be narrower than the letter suggests, or another provision may cover the service.

Out of network. Check three things: whether the provider was in network when the service was rendered; whether an exception applies because no in-network provider was available; and whether the surprise billing protections apply (Part VII).

No prior authorization. Frequently curable. Ask for retrospective authorization, and check whether the service was emergent, whether the provider was told authorization was not required, or whether the plan's own directory was wrong.

Not eligible / coverage terminated. An administrative dispute — check enrollment records, COBRA elections, and premium payments.

Exceeds plan limits. Check whether the limit is lawful; several categories of limit are prohibited under the ACA and under mental health parity requirements.

Part III: The internal appeal

Federal law requires a full and fair review. 29 U.S.C. § 1133 requires every employee benefit plan to provide adequate written notice of a denial setting forth the specific reasons, in a manner calculated to be understood by the participant, and to afford a reasonable opportunity for a full and fair review by an appropriate named fiduciary.

The ACA's internal claims and appeals requirements, at 42 U.S.C. § 300gg-19, extended and standardized this for non-grandfathered plans.

What the denial notice must contain: the specific reason; reference to the specific plan provisions; a description of any additional material needed and why; a description of the appeal procedures and time limits; and — critically — a statement that the claimant is entitled, on request and free of charge, to reasonable access to and copies of all documents, records, and other information relevant to the claim.

Deadlines. Generally 180 days from the adverse benefit determination to file an internal appeal. The plan must then decide within: 72 hours for an urgent care claim; 30 days for a pre-service claim; and 60 days for a post-service claim.

Two rights that decide appeals and are rarely exercised:

1. Request the complete claim file. You are entitled to it free of charge, and it must include the internal guidelines, protocols, and clinical criteria relied on, the identity and credentials of every reviewer, and any expert advice obtained. Read the criteria against your records — a substantial share of denials fail because the reviewer applied criteria the patient actually satisfies.

2. Respond to new evidence before the decision. Under the ACA regulations, a plan must provide any new or additional evidence or rationale it develops during the appeal, free of charge and sufficiently in advance of the deadline to give the claimant a reasonable opportunity to respond. A plan that denies on a ground first disclosed in the final letter has violated this.

Expedited appeals are available where the ordinary timeframe would seriously jeopardize life, health, or the ability to regain maximum function — decided within 72 hours, and available simultaneously with external review.

Part IV: External review — the step that works

This is the most underused right in American health coverage.

What it is. After exhausting internal appeals, the claimant may request review by an Independent Review Organization — a physician reviewer with no relationship to the plan, whose decision is binding on the plan.

Who provides it. For fully insured and individual coverage, the state external review process. For self-funded ERISA plans not subject to a state process, the federal external review process. Both are available at no cost to the claimant.

Deadlines. Generally four months from the final internal denial. Expedited external review is available concurrently with an expedited internal appeal for urgent situations.

Scope. External review covers denials involving medical judgment — medical necessity, appropriateness, level of care, effectiveness — and rescissions of coverage. It generally does not cover pure eligibility or contractual-exclusion disputes, which is why characterizing the denial correctly matters.

How often it works. Independent reviewers overturn a meaningful share of appealed denials, and the share is higher for medical necessity and experimental-treatment denials than for eligibility disputes. The binding nature of the decision is what makes it valuable: the plan must pay.

The practical point. Exhausting the internal appeal is a prerequisite. Many claimants stop after one denial letter, which forecloses the step most likely to succeed.

Part V: ERISA litigation, and why the record is everything

If appeals fail, the remedy for an ERISA plan is a civil action under 29 U.S.C. § 1132(a)(1)(B) to recover benefits due, enforce rights, or clarify rights to future benefits.

The standard of review is the central issue. In Firestone Tire & Rubber Co. v. Bruch, 489 U.S. 101 (1989), the Supreme Court held that a denial is reviewed de novo unless the plan gives the administrator discretionary authority to determine eligibility or construe the plan's terms — in which case review is for abuse of discretion, frequently described as arbitrary and capricious.

Plan drafters responded predictably: nearly every plan now contains a discretionary clause. Several states have banned discretionary clauses in insurance policies, and those bans have generally been upheld as insurance regulation saved from preemption — which means a fully insured plan in such a state may get de novo review while an identical self-funded plan does not.

Structural conflict of interest. In Metropolitan Life Insurance Co. v. Glenn, 554 U.S. 105 (2008), the Court held that where an administrator both evaluates claims and pays them, that dual role creates a conflict of interest that must be weighed as a factor in determining whether there was an abuse of discretion. It does not change the standard, and it is more important where circumstances suggest a higher likelihood of bias — a history of biased claims administration, reliance on a paid file reviewer who never examined the claimant, or a failure to address contrary evidence.

No treating physician rule. In Black & Decker Disability Plan v. Nord, 538 U.S. 822 (2003), the Court held unanimously that ERISA does not require plan administrators to give special weight to the opinions of a claimant's treating physician. But the Court added the sentence that matters: plan administrators may not arbitrarily refuse to credit a claimant's reliable evidence, including the opinions of treating physicians. A decision that ignores contrary medical evidence without explanation is vulnerable on that ground.

The administrative record is usually closed. In most circuits, judicial review is limited to the evidence that was before the administrator. This is the single most consequential procedural fact in ERISA benefits law: everything you want a judge to see must be submitted during the internal appeal. A crucial physician letter obtained after the final denial is generally inadmissible.

Remedies are narrow. Benefits due, prejudgment interest in the court's discretion, and attorney's fees — available under § 1132(g) on "some degree of success on the merits," per Hardt v. Reliance Standard Life Insurance Co., 560 U.S. 242 (2010). No compensatory damages, no punitive damages, no jury. State-law bad faith claims are preempted.

Exhaustion is required by nearly every circuit, with narrow exceptions for futility and for plans that fail to establish or follow reasonable claims procedures — in which case the claimant is deemed to have exhausted and may proceed to court.

Part VI: Where state law still reaches

For fully insured and individual coverage, state law supplies protections ERISA plans lack:

State coverage mandates — infertility treatment, autism services, hearing aids, and dozens of others, varying widely by state.
State external review, frequently with broader scope than the federal process.
Prompt payment statutes with interest penalties.
Bad faith remedies, including in some states extracontractual and punitive damages.
Department of Insurance complaints, which are free, fast, and generate regulatory pressure. This is the most underused consumer tool in health coverage, and insurers respond to it because complaint volumes are tracked and reported.
Continuity of care protections when a provider leaves the network mid-treatment.
State-specific prior authorization reform, including "gold card" exemptions for high-approval providers and turnaround requirements.

Part VII: Three federal protections worth knowing

Emergency care. Non-grandfathered plans must cover emergency services without prior authorization, at in-network cost sharing, regardless of the provider's network status, applying a prudent layperson standard — whether a prudent layperson with average knowledge of health and medicine would believe the condition required emergency care. A denial based on the final diagnosis rather than the presenting symptoms is unlawful.

Surprise billing. The No Surprises Act protects patients from balance billing for emergency services, for non-emergency services by out-of-network providers at in-network facilities, and for air ambulance services. The patient owes only in-network cost sharing; the dispute between the provider and the plan is resolved through an independent dispute resolution process in which the patient is not a participant. If you receive a balance bill in a protected situation, you do not owe it, and there is a federal complaint process.

Mental health parity. The Mental Health Parity and Addiction Equity Act requires that financial requirements and treatment limitations for mental health and substance use disorder benefits be no more restrictive than those applied to medical and surgical benefits — including non-quantitative treatment limitations such as prior authorization requirements, medical necessity criteria, network adequacy, and reimbursement rates. Plans must perform and, on request, disclose a comparative analysis of those limitations. Requesting that analysis is a powerful and rarely used step: a plan that cannot produce it has a compliance problem.

Part IX-A: Building the appeal that wins

Appeals succeed on documents, and the documents are assembled in a specific order.

Step one: get the criteria, then read your records against them. The claim file must include the internal clinical guidelines, protocols, and medical necessity criteria the reviewer applied. Most plans use published criteria sets, and each is a checklist of clinical findings. Print it, and go through your own records line by line marking which criteria you meet and where in the record each one appears. A substantial share of denials fail because the reviewer applied criteria the patient actually satisfies, and nobody checked.

Step two: identify who denied it and what they were qualified to decide. The claim file must disclose the reviewer's identity and credentials. A denial of a specialized treatment by a physician in an unrelated specialty — or by a nurse applying a protocol without physician review — is a substantive point, and in many states a specialty-match requirement applies.

Step three: get a letter of medical necessity that answers the denial. Not a general letter of support. The structure that works:

"I am writing regarding the denial dated [date] of [service] for [patient]. The stated reason was [quote it exactly]. I address each ground below."

Then, for each stated reason: the plan's criterion, the clinical finding that satisfies it, and where it appears in the record. Then the treatment history — what was tried, for how long, and why it failed. Then the consequence of denial — what happens clinically if this is not done. Then the literature, cited.

Step four: submit everything you might ever want a judge to see. In an ERISA case the record generally closes at the final internal denial. The physician letter obtained a month later is inadmissible. Assume this is your only chance to build the file.

Step five: address the plan language, not only the medicine. Pull the Summary Plan Description and the certificate of coverage and quote the provision that covers the service. Where the denial rests on an exclusion, read the exclusion narrowly and check whether another provision applies.

Step six: keep a call log. Date, time, name, badge or reference number, and what was said. Insurers' own notes are discoverable and frequently contradict what claimants were told.

Part X: Denials for specific kinds of care

Mental health and substance use treatment. Denials of residential treatment, intensive outpatient, and length of stay are the most common — and the most vulnerable, because the Mental Health Parity and Addiction Equity Act requires that non-quantitative treatment limitations be no more restrictive than those applied to medical and surgical benefits. Request the plan's comparative analysis of how it applies medical necessity criteria, prior authorization, and network standards on both sides. Plans are required to produce it, and a plan that cannot has a compliance problem that reframes the entire dispute.

Emergency care denied on the final diagnosis. The prudent layperson standard asks what a person with average knowledge of health and medicine would have believed at the time, based on the presenting symptoms. Chest pain that turns out to be reflux was still an emergency. A denial that reasons backward from the discharge diagnosis is unlawful, and saying so plainly usually resolves it.

Out-of-network denials. Check, in this order: was the provider in network on the date of service; is there no in-network provider with the necessary expertise within a reasonable distance (which triggers a network adequacy exception at in-network cost sharing); and do the No Surprises Act protections apply?

Experimental or investigational denials. Frequently wrong. Check FDA approval status, whether the use is supported by a recognized compendium, published peer-reviewed evidence, and whether the plan's own definition of "experimental" actually covers this treatment. These denials are squarely within external review's scope and are overturned often.

Prescription drug denials. Distinguish formulary exclusion (request a formulary exception), step therapy (request an exception based on prior failure, contraindication, or expected ineffectiveness — most states now mandate an exceptions process with short turnaround), and quantity limits.

Durable medical equipment and home health. Denied on documentation more often than on medicine. The fix is usually a detailed written order plus a face-to-face encounter note that ties the equipment to a specific functional limitation.

Retroactive denials after care was authorized. Where the plan authorized the service and then refused payment, raise the authorization, any recorded confirmation, and — in insured coverage — state prompt payment and prior authorization statutes, many of which prohibit retroactive denial absent fraud or material misrepresentation.

Part XI: While the appeal is pending

Do not pay the bill yet, and do not ignore it either.

Tell the provider an appeal is pending, in writing. Most will hold the account rather than send it to collections, and many have their own appeal process running in parallel.

Ask the provider's billing office for financial assistance. Nonprofit hospitals are required to maintain a financial assistance policy and to publicize it, and eligibility thresholds are frequently far above what patients assume. This is separate from the insurance dispute and can resolve the bill regardless of how the appeal ends.

Request an itemized bill and read it. Billing errors are common — duplicate charges, services not rendered, incorrect codes, and charges for items included in a facility fee. Correcting the bill sometimes eliminates the dispute.

Watch for balance billing that is prohibited. In a No Surprises Act situation you owe only in-network cost sharing, and the rest is between the provider and the plan.

Protect your credit. Medical debt reporting has been substantially restricted in recent years, including a waiting period before medical collections may be reported and limits on reporting paid medical collections. If a disputed medical bill appears on your credit report, dispute it under the Fair Credit Reporting Act. See Consumer Financial Protection Statutes.

If care is ongoing and urgent, use the expedited track. Expedited internal appeal and expedited external review run concurrently, and both are decided in days.

And keep receiving care. A denial is a payment decision, not a medical one. Where continuing treatment is clinically indicated, continue it and litigate the payment — a gap in treatment both harms the patient and weakens the appeal, because it suggests the care was not necessary.

Part XI-A: Three denials, three routes

The residential treatment denial. A teenager is admitted for eating disorder treatment. The plan authorizes eleven days and then denies continued stay as "not medically necessary," citing criteria requiring "imminent risk."

Route. The family requests the claim file and receives the plan's criteria and the reviewer's credentials — a physician board-certified in family medicine, reviewing an adolescent eating disorder case. The treating psychiatrist writes a letter addressing each criterion by name, with the vital signs, weight trajectory, and behavioral findings from the chart. The family also requests the plan's mental health parity comparative analysis, asking how continued-stay review for behavioral health compares with concurrent review for medical-surgical admissions.

Outcome. The internal appeal is denied. External review overturns it, and the parity request produces a broader change in the plan's concurrent review process. The parity analysis request is what moved a routine dispute into a compliance question.

The emergency room denial. A man with crushing chest pain goes to the nearest emergency department. The workup is negative; the discharge diagnosis is esophageal spasm. The plan denies the claim because the final diagnosis was not an emergency.

Route. One letter. The prudent layperson standard asks what a person with average knowledge would have believed based on the presenting symptoms, not on the eventual diagnosis. The appeal quotes the standard, attaches the triage note recording chest pain and shortness of breath, and states that a denial reasoning backward from the discharge diagnosis is unlawful.

Outcome. Overturned at the internal appeal. These are frequently resolved by naming the standard.

The self-funded plan that would not budge. A woman with a rare autoimmune condition is denied an infusion as "experimental," although it is FDA-approved for a related indication and supported by a compendium listing.

Route. Her employer confirms in writing that the plan is self-funded ERISA — which means no state mandate applies, no bad faith claim exists, and any litigation will be reviewed for abuse of discretion on a closed record. She therefore treats the internal appeal as her only opportunity: she submits the compendium entry, three peer-reviewed studies, a detailed letter from her rheumatologist addressing the plan's own definition of "experimental," and a response to the reviewer's rationale.

Outcome. Denied internally; overturned on federal external review, which was available because the self-funded plan was not subject to a state process. Had it gone to court instead, everything she submitted would have been in the record — and everything she had not submitted would have been unavailable.

What the three share: the winning move in each was procedural — requesting the file, naming the correct standard, or building the record before it closed.

Part XI-B: Disability and life insurance denials, which follow the same law

The doctrine in this article governs more than health coverage. Employer-provided long-term disability, short-term disability, life insurance, and accidental death benefits are almost all ERISA plans, and denials are governed by the same claims regulation, the same deference rules, and the same closed-record problem.

Long-term disability is the largest category, and the recurring denial patterns are distinct:

The definition changes at 24 months. Most policies define disability as inability to perform your own occupation for the first 24 months, and thereafter as inability to perform any occupation for which you are reasonably suited. A very large share of terminations occur precisely at that transition, and the appeal must address the new definition with vocational evidence, not merely medical evidence.
Mental health and "self-reported symptoms" limitations. Most policies cap benefits at 24 months for conditions that are psychiatric or that rest on self-reported symptoms — which is how fibromyalgia, chronic fatigue, and chronic pain claims are limited. Where an objectively documented physical condition contributes, say so explicitly and separately.
Surveillance and social media. Insurers conduct surveillance and review public posts. A claimant photographed carrying groceries is not thereby able to work an eight-hour day, but the appeal must address it rather than leave it unanswered.
Paper reviews. A file reviewer who never examined the claimant, opining against treating physicians, is precisely the circumstance in which Glenn's conflict factor and Nord's prohibition on arbitrarily refusing to credit reliable evidence carry the most weight.
The Social Security offset. Most policies require the claimant to apply for SSDI and then reduce the benefit by the award — while frequently arguing in the disability appeal that the claimant can work. An SSDI award is powerful evidence in the ERISA appeal, and the inconsistency is worth pointing out.

What to build into the record, because it will close: functional capacity evaluation, treating physician statements addressing specific work functions rather than diagnosis, a vocational expert opinion under the applicable definition, an activity log, and statements from a spouse or employer describing daily function.

Life and accidental death denials turn on different questions — the contestability period and alleged misrepresentation on the application, whether a death was "accidental" within the policy's terms, exclusions for intoxication or self-inflicted injury, and — most commonly and most avoidably — a beneficiary designation that was never updated after a divorce or remarriage. For an ERISA plan, the plan document and the designation on file generally control, and a state revocation-on-divorce statute may not reach it. See Getting Divorced.

Conversion and portability rights are the sleeper issue in group life coverage: an employee leaving employment usually has a short window — often 31 days — to convert group coverage to an individual policy without evidence of insurability. It is stated in the certificate and it is missed constantly.

Part XI-C: For employers and plan sponsors

Everything above describes the claimant's side. The sponsor's side has its own exposure, and most of it is procedural.

You are a fiduciary as to plan administration, and ERISA fiduciary duties — loyalty, prudence, following plan documents insofar as consistent with ERISA — apply to how claims are handled, even where a third-party administrator does the work. Delegating administration does not delegate away the duty to monitor the delegate.

The claims procedure regulation is enforceable, and failure has consequences. A plan that does not follow reasonable claims procedures may lose the deferential standard of review entirely and be deemed to have exhausted, letting a claimant into court immediately and on de novo review. The recurring failures are mundane: missing the decision deadline; a denial letter that does not state the specific reason or the plan provision; failing to disclose the internal criteria on request; and denying on a rationale first raised in the final letter without giving the claimant an opportunity to respond.

Discretionary language must be in the plan document, and it must actually confer discretion to determine eligibility and construe terms. And note that several states ban discretionary clauses in insurance policies — so a fully insured plan in such a state gets de novo review regardless of what the document says, while an identical self-funded plan does not.

Structural conflict is manageable. Where the same entity decides and pays, Glenn makes the conflict a factor. Its weight is reduced by demonstrable steps: walling off claims administration from finance, using independent physician reviewers with specialty matching, tracking reviewer overturn rates, and documenting that the process is designed to promote accuracy.

Mental health parity is the current enforcement priority. Plans must perform and, on request, produce a comparative analysis of non-quantitative treatment limitations. A plan that cannot produce one on demand from a participant or a regulator has a problem that is easier to fix in advance than under a request.

Practical steps that reduce exposure, in order of value: audit denial letters against the regulation's content requirements; calendar and monitor decision deadlines; ensure the claim file assembled for appeal actually includes the criteria and reviewer credentials; require specialty matching for clinical reviews; prepare the parity comparative analysis before it is requested; and monitor the third-party administrator's overturn rates on external review, which is the single most informative metric available about how the plan is being administered.

See ERISA Fiduciary Duties for Plan Sponsors and Committees.

Part XI-D: When coverage itself is the problem

Some disputes are not about a single claim but about whether coverage exists at all, and these have their own deadlines.

Rescission. A plan may not retroactively cancel coverage except for fraud or an intentional misrepresentation of material fact, and only with at least 30 days' advance notice. A rescission is an adverse benefit determination and is subject to internal appeal and external review — a point insurers do not volunteer.

COBRA. On a qualifying event, an election notice must be provided, and the qualified beneficiary generally has 60 days to elect and 45 days thereafter to make the first payment, retroactive to the loss of coverage. Two things go wrong constantly: the notice is never sent (the employer's obligation, with statutory penalties for failure), and the elector does not realize that coverage is retroactive — so care received during the election window is covered once premiums are paid.

Special enrollment periods. Loss of coverage, marriage, birth or adoption, a permanent move, and several other events open a 60-day window to enroll in marketplace or other coverage outside open enrollment. Missing it can mean going a year uninsured, and it is missed because people assume COBRA is the only option — when marketplace coverage with a subsidy is frequently far cheaper.

Eligibility disputes. Whether an employee met the hours threshold, whether a dependent qualifies, whether a domestic partner or a stepchild is covered — these are plan-interpretation disputes, and they follow the same claims and appeal procedure as a medical denial. Request the plan document and the enrollment records.

Termination for nonpayment. Grace periods differ: marketplace enrollees receiving advance premium tax credits get a three-month grace period, with claims in the second and third months held pending payment. Others may get 30 days or less. Know which applies before assuming coverage lapsed.

Coordination of benefits. Where two plans cover the same person, the order of payment is determined by rules in the plan documents, and a denial that says "the other plan is primary" is a coordination dispute rather than a coverage denial. The birthday rule for dependent children, and the active-employee-over-retiree rule, resolve most of them.

And the underlying point. Each of these is an adverse benefit determination subject to the same appeal machinery — written notice with specific reasons, the right to the claim file, internal appeal, and in most cases external review. Claimants treat coverage disputes as bureaucratic problems to be resolved by telephone. They are legal determinations with deadlines, and they should be handled in writing.

Part XII: Frequently asked questions

How long do I have to appeal? Generally 180 days from the denial for the internal appeal, and about four months from the final internal denial for external review. Read the letter; the deadlines are stated.

Will appealing cost me anything? Internal and external appeals are free. Litigation is not, though ERISA fee shifting makes representation available in strong cases.

Can my doctor appeal for me? Yes, as your authorized representative, and providers frequently do — but you should also file, because the provider's appeal may address only the clinical question and may not preserve everything.

What if the plan misses its own deadline? In most circumstances you may treat the claim as denied and proceed to the next stage, and a plan that fails to follow reasonable procedures may lose deferential review.

Does an external review decision bind the plan? Yes. That is what makes it valuable.

Can I sue for the pain and inconvenience? Not under ERISA — the remedies are benefits, interest, and fees. Extracontractual damages may be available for non-ERISA coverage under state law.

How do I know if my plan is self-funded? Ask HR in writing, or read the Summary Plan Description. It determines everything.

Part XIII: For patients — what to do the day the denial arrives

Read the letter for two things: the specific reason and the appeal deadline. Write the deadline on a calendar.
Request the complete claim file in writing today, including the internal clinical criteria used and the credentials of every reviewer. It is free and you are entitled to it.
Find out whether your plan is self-funded, in writing, from HR.
Get your doctor's help, and be specific about what you need: a letter of medical necessity addressing each stated reason for denial, citing the plan's own criteria and the clinical evidence.
File the internal appeal in writing and keep proof of delivery. Do not rely on a phone call.
Ask for an expedited appeal if delay would jeopardize your health.
Do not stop at the internal appeal. Request external review — it is free, binding, and it is the step most likely to succeed.
File a complaint with your state Department of Insurance (for insured coverage) or the Department of Labor (for ERISA plans). Free, and it produces movement.
Do not pay a surprise bill in a protected situation. Check the No Surprises Act protections first.
Keep everything: every letter, every call with the date and the representative's name, every record submitted. If this ends in court on an ERISA plan, the record is the case.

Primary authority

29 U.S.C. § 1132 — ERISA civil enforcement, including the § 1132(a)(1)(B) benefits action and § 1132(g) attorney's fees.
29 U.S.C. § 1133 — the claims procedure requirement: specific reasons, and a full and fair review.
42 U.S.C. § 300gg-19 — the ACA internal appeals and external review requirements.
Firestone Tire & Rubber Co. v. Bruch, 489 U.S. 101 (1989) — de novo review unless the plan confers discretion.
Black & Decker Disability Plan v. Nord, 538 U.S. 822 (2003) — no treating physician rule, but no arbitrary refusal to credit reliable evidence.
Metropolitan Life Insurance Co. v. Glenn, 554 U.S. 105 (2008) — structural conflict weighed as a factor.
Hardt v. Reliance Standard Life Insurance Co., 560 U.S. 242 (2010) — fees on "some degree of success on the merits."
29 C.F.R. § 2560.503-1 (ERISA claims procedure regulation); the Mental Health Parity and Addiction Equity Act; the No Surprises Act; state insurance codes, external review statutes, and discretionary clause bans.